PPP · Topic 2 of 3

PPP Secrets and the Local User Database

Learn how PPP secrets store usernames, passwords, services and per user settings in RouterOS, and how they override the profile and tie users to a service.

  • 4 min
In a nutshell
  • Secrets live under /ppp secret and are separate from router login accounts.
  • A secret holds a name, a password, a service and a profile.
  • The service value limits which server may use the account.

What it is

A PPP secret is a local user account that a router checks when a PPP client connects.

Secrets live under /ppp secret. They are used by every PPP based server on the router, and they are separate from the router's own administrator accounts.

Each secret holds a name and a password, the service it may use, and optional settings for that one user.

Clientsends name and passwordloginPPP serverPPTP, L2TP or PPPoElooks upSecretname, service, profileacceptsSessionaddresses assigned

How it works

The server finds the secret, checks the service and the password, and then applies the profile and any overrides.

Main settings

SettingWhat it does
nameThe username the client sends.
passwordThe password for the account.
serviceLimits the account to one service, or to any.
profileThe PPP profile for this user.
local-addressRouter end address, overriding the profile.
remote-addressClient address, overriding the profile.
caller-idRestricts the account to one caller.
routesAdds routes when the user connects.
limit-bytes-in and limit-bytes-outTraffic limits for the account.

The service setting

The service setting names the kind of server the account may use. Values include pptp, l2tp, pppoe, sstp, ovpn and any. A secret set to pppoe is ignored when the same name tries to log in over PPTP.

Use any only when one account must work everywhere. A narrow service value is safer.

Fixed addresses and profile overrides

If the secret has a remote-address, that client always gets the same address. This is the usual way to give a branch router a fixed tunnel address.

/ppp secret add name=branch1 password=Str0ng service=l2tp profile=staff remote-address=10.10.10.100 local-address=10.10.10.1

Any setting left empty in the secret falls back to the profile.

Caller ID

The caller-id setting limits an account to one caller, and its meaning depends on the service. For PPPoE it is the MAC address of the client. For PPTP and L2TP it is the client IP address.

Leave it empty to accept the account from anywhere. A wrong value makes a correct password fail.

Routes

The routes setting adds routes on the router while the user is connected. This is how a remote LAN behind a client router becomes reachable.

The value lists a destination, a gateway and a metric. For example, 192.168.50.0/24 10.10.10.100 1 sends the branch LAN toward the client.

Where authentication happens

By default, PPP users are checked against the local secrets. The /ppp aaa menu can send authentication and accounting to a RADIUS server instead, as covered in the RADIUS chapter.

/ppp aaa print

Viewing users and sessions

/ppp secret print
/ppp active print

/ppp secret print lists the accounts. /ppp active print lists the people who are connected right now, with the service and the address of each.

What to remember for the exam

Seven facts cover most secret questions.

  • Secrets live under /ppp secret and are separate from router login accounts.
  • A secret holds a name, a password, a service and a profile.
  • The service value limits which server may use the account.
  • Settings in the secret override the same settings in the profile.
  • A remote-address in the secret gives that user a fixed address.
  • caller-id is a MAC address for PPPoE and an IP address for PPTP and L2TP.
  • /ppp active print shows the connected users.
Exam tip

A fixed tunnel address for a branch router belongs in the secret, not in the shared profile.

Common mistakes

These four errors appear again and again.

Wrong service value. A secret set to pppoe does not allow a PPTP login, even with the right password.

Wrong caller ID. For PPPoE the value is a MAC address. An IP address there never matches.

Duplicate fixed addresses. Two secrets with the same remote-address cannot both connect. The second login is refused or the address clashes.

Forgetting the routes. A site to site tunnel can be up while the remote LAN is unreachable, because no route points to the client.

Watch out

Do not reuse an administrator password for a PPP secret. Secrets are stored on the router and given to remote users.

Check yourself

Work through these three questions.

  • What does the service setting of a PPP secret do?

    It limits the account to one kind of server, such as pppoe or pptp, or allows any service with any.

  • How does a secret give a branch router the same tunnel address every time?

    Set remote-address in the secret. The secret overrides the profile.

  • What does caller-id mean for PPPoE and for PPTP?

    For PPPoE it is the MAC address of the client. For PPTP and L2TP it is the client IP address.

Topic 2 of 3 in PPP

Test yourself on PPP

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.