Tunnels · Topic 1 of 4
PPP Profiles, Secrets, Status and Point-to-Point Addresses
Configure PPP profiles and secrets on RouterOS, read PPP status in the console, and understand the local and remote addresses of a point-to-point link.
- 5 min
- A PPP profile holds shared settings such as addresses, DNS and
only-one. - A PPP secret holds a user name, a password, a service and a profile.
- Settings on the secret override the profile.
What it is
PPP is the family of point-to-point protocols that RouterOS uses for dial-in style connections and tunnels.
Two menus hold the shared settings. A PPP profile holds the settings for a group of connections, such as the addresses and the rate limit. A PPP secret holds one user, with a name and a password.
Every PPP connection joins two ends, so it has a local address and a remote address. These are the point-to-point addresses, and they do not need a shared subnet.
How it works
The server finds the secret, takes the settings from the profile, and creates a link with an address at each end.
PPP profile
A profile is a named set of settings that connections can use.
/ppp profile add name=office local-address=10.99.0.1 remote-address=vpn-pool dns-server=10.99.0.1 only-one=yes
/ppp profile print| Setting | Meaning |
|---|---|
local-address | The address of the server end of the link |
remote-address | The address given to the client end, or an IP pool name |
dns-server | The DNS server that the client is told to use |
only-one | Allow only one active session for each user |
use-encryption | Whether the connection must be encrypted, where the protocol supports it |
rate-limit | A speed limit for the connection |
RouterOS includes default profiles. A secret that names no profile uses the default one.
The remote-address can be a single address or the name of an IP pool. With a pool, each client receives the next free address from it, and the pool page covers this in detail.
PPP secret
A secret is one user account for PPP services.
/ppp secret add name=user1 password=Str0ngPass service=pppoe profile=office
/ppp secret printThe name and password are the login. The service setting limits the secret to one service, such as pppoe, pptp or sstp. A value of any allows all services.
The profile setting links the secret to a profile. A secret can also carry its own local-address and remote-address. When it does, those values override the profile.
This is how you give a particular user a fixed address, while everyone else takes an address from the pool.
/ppp secret add name=boss password=Str0ngPass service=any profile=office remote-address=10.99.0.50Give each user a separate secret, because then you can see who is connected and remove one user without touching the others.
PPP status
Check connections with the active list and the interface list.
/ppp active print
/interface printThe active list shows each connected user, the service, the address assigned and how long the session has been up. If a user is not listed, they are not connected.
The server creates a dynamic interface for every connected client. In the interface list it appears with the D flag, and it disappears when the client disconnects. You can use these interfaces in firewall rules and queues, as with any other interface.
Point-to-point addresses
A PPP link is point-to-point, so it connects exactly two devices. Each end gets one address, and the addresses are used as a pair.
| End | Address |
|---|---|
| Server | local-address |
| Client | remote-address |
The two addresses do not need to be in the same subnet. RouterOS adds a route for the remote address that points to the PPP interface, so each end can reach the other by its address.
This differs from an Ethernet LAN, where all hosts share one subnet and have a netmask. On a PPP link, a single address per end is enough.
The local address can be shared by many clients. A server often uses one local address, such as 10.99.0.1, for all its PPP links, and gives each client its own remote address.
Reaching networks behind a client
A PPP link reaches only the two end addresses. To reach a LAN behind the client, add a static route on the server.
/ip route add dst-address=192.168.50.0/24 gateway=10.99.0.50The gateway is the remote address of the client. Without this route, the server has no idea that the LAN lies behind the client, and traffic for it is lost.
If the server and the client use overlapping LAN subnets, routing across the link fails, so plan separate subnets first.
What to remember for the exam
Seven facts cover this topic.
- A PPP profile holds shared settings such as addresses, DNS and
only-one. - A PPP secret holds a user name, a password, a service and a profile.
- Settings on the secret override the profile.
/ppp active printshows the connected users and their addresses.- Each connected client gets a dynamic interface on the server.
- A PPP link has a local and a remote address, which need not share a subnet.
- A LAN behind the client needs a static route to the client remote address.
Common mistakes
These four mistakes are common.
Choosing the wrong service in the secret. A secret for pppoe does not work for a PPTP login.
Forgetting the route to the client LAN. The server only knows the single remote address.
Expecting the profile value to win. A value on the secret overrides the profile.
Giving two clients the same fixed address. The two connections conflict, so one of them fails.
Check yourself
Work through these three questions.
What is the difference between a PPP profile and a PPP secret?
A profile holds shared settings such as addresses and DNS. A secret holds one user with a name, a password, a service and a profile.
What are the local address and the remote address?
The local address belongs to the server end, and the remote address belongs to the client end. They need not be in the same subnet.
How do you see which PPP users are connected?
Run
/ppp active print. It shows each user, the service and the address they received.
Topic 1 of 4 in Tunnels
Test yourself on Tunnels
The full MikroTik MTCNA question bank has 558 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.