PPPoE, Securing the Local Network with a Client and a Server

What it is

PPPoE carries PPP sessions over an Ethernet network, and it adds a login to a local network.

On a plain LAN, anyone who plugs in can send traffic. With PPPoE, the client must authenticate with a user name and password before it gets an IP address and access.

Internet providers use PPPoE for the same reason, and the same technology secures a local network. The server accepts the logins, the client logs in, and the service name identifies which server the client means.

How it works

PPPoE runs directly on Ethernet, so the client and the server must be on the same Layer 2 network.

What makes PPPoE different

PPPoE does not use IP to find the server. The client broadcasts a discovery request on the Ethernet segment, and the servers that hear it answer. This means the two ends must share a broadcast domain, with no router between them.

Once a server is chosen, a PPP session starts, and the PPP login takes place. The server then gives an address to the client, and traffic flows through the new PPP interface.

The server interface does not need an IP address of its own for PPPoE to work. Many networks keep the server port free of IP addresses, so that unauthenticated hosts cannot use any IP service.

PPPoE server

The server is created on an interface, and it uses a PPP profile and the PPP secrets.

/ip pool add name=pppoe-pool ranges=10.50.0.10-10.50.0.100
/ppp profile add name=pppoe-prof local-address=10.50.0.1 remote-address=pppoe-pool
/ppp secret add name=user1 password=Str0ngPass service=pppoe profile=pppoe-prof
/interface pppoe-server server add service-name=office interface=ether2 default-profile=pppoe-prof disabled=no

The steps are:

1. Create the pool of addresses for the clients.
2. Create a profile with the local address and the pool.
3. Create a secret for each user, with the service set to pppoe.
4. Create the server entry on the LAN interface, with a service name.

The default-profile is used for users whose secret names no other profile. An authentication method list can also be set on the server to say which login methods it accepts.

The service name

The service name is a label that identifies a PPPoE server. A client names the service it wants, and only a server with a matching name answers.

This lets several servers share one segment. Each client chooses its own service by name. If the client leaves the name empty, it accepts any server that answers.

The service name is not a password. It only selects the server, and the login still needs a valid secret.

PPPoE client

The client is created on the interface that faces the server.

/interface pppoe-client add name=pppoe-out1 interface=ether1 user=user1 password=Str0ngPass service-name=office add-default-route=yes use-peer-dns=yes disabled=no

The client creates a PPP interface, here called pppoe-out1. This interface carries the address that the server assigned. Use it as the WAN interface in firewall and NAT rules, because the traffic leaves through the PPP interface and not through the Ethernet port.

/ip firewall nat add chain=srcnat out-interface=pppoe-out1 action=masquerade

Checking the result

/interface pppoe-client print
/ppp active print

On the client, the interface shows whether it is running. On the server, the active list shows the connected user and the assigned address. If the client does not connect, check these points:

• Both ends are on the same Layer 2 segment.
• The user name and password match a secret that allows pppoe.
• The service name is the same, or empty on the client.
• The server is enabled and its pool is not exhausted.