PPPoE · Topic 2 of 4

PPPoE Client Configuration

Configure a RouterOS PPPoE client: choose the interface, set the user and password, control the default route and DNS, and check the connection status.

5 min

In a nutshell

The client is configured at /interface pppoe-client and needs an interface, user and password.
add-default-route=yes installs a default route through the link.
use-peer-dns=yes takes DNS servers from the provider.

What it is

A PPPoE client is an interface that dials a provider server and receives an address, a route and DNS.

It is the usual way a RouterOS router connects to a provider that sells access over PPPoE. The client runs on top of a physical interface, which is normally the one facing the provider.

Once connected, the PPPoE interface becomes the router's path to the internet.

How it works

You add the client, let it collect the settings it needs, and then point NAT and the firewall at the new interface.

Creating the client

/interface pppoe-client add name=pppoe-out1 interface=ether1 user=subscriber1 password=Str0ng add-default-route=yes use-peer-dns=yes disabled=no

Setting	What it does
`interface`	The physical interface that carries PPPoE.
`user` and `password`	Credentials the provider issued.
`service-name`	Selects a server by its service name.
`ac-name`	Selects a server by its access concentrator name.
`add-default-route`	Installs a default route through the link.
`use-peer-dns`	Takes DNS servers from the provider.
`default-route-distance`	Distance given to that default route.
`dial-on-demand`	Connects only when traffic needs the link.
`profile`	PPP profile for the client side.
`allow`	Authentication methods the client may use.
`max-mtu` and `max-mru`	Size limits for the link.

Interface rules

The physical interface should not carry an IP address that is used for the PPPoE service. The PPPoE client works at Layer 2 and needs only the link to be up.

Run the client directly on the port that faces the provider. Do not make that port a member of a bridge.

Default route and DNS

With add-default-route=yes, the router installs a default route whose gateway is the PPPoE interface. With use-peer-dns=yes, the router takes DNS servers from the provider.

If the router has more than one uplink, keep the default route of each client at a different distance. The lower distance wins. Without this, the routes tie and traffic may be split in ways you did not intend.

NAT on the PPPoE interface

The provider gives one address to the router. Clients on the LAN reach the internet only if the router translates their addresses.

/ip firewall nat add chain=srcnat out-interface=pppoe-out1 action=masquerade

The rule must name the PPPoE interface, not the physical port, because the packets leave through the PPPoE interface.

Choosing a server

When several servers answer, service-name and ac-name limit the client to one. If both are empty, the client accepts the first offer it gets.

Dial on demand

With dial-on-demand=yes, the link stays down until traffic needs it. This suits a metered or dial style link. It is less useful for an always on broadband line.

Verification

/interface pppoe-client print
/interface pppoe-client monitor pppoe-out1
/ip address print
/ip route print

A connected client shows the flag R. The monitor command shows the status, for example whether the link is connected, along with the addresses and the server that answered.

If the client never connects, the first thing to suspect is that no server answered discovery. Check the cable, the interface, the service name and the provider side.

Version note

The PPPoE client menu and the settings above work in both RouterOS v6 and v7. In v7 the dynamic default route appears in the routing table with its distance, and you read it with /ip route print.

What to remember for the exam

Seven facts cover most PPPoE client questions.

The client is configured at /interface pppoe-client and needs an interface, user and password.
add-default-route=yes installs a default route through the link.
use-peer-dns=yes takes DNS servers from the provider.
service-name and ac-name pick a server when there are several.
NAT must use the PPPoE interface as the out-interface.
The physical port should have no IP address for the service and should not be a bridge port.
A connected client shows the flag R in the interface list.

Exam tip

If browsing works by IP address but not by name, check use-peer-dns and the DNS settings on the router.

Common mistakes

These four errors appear again and again.

Masquerading on the wrong interface. The rule must name the PPPoE interface. A rule on the physical port never matches.

Running the client on a bridge port. The client should sit directly on the physical port that faces the provider.

Wrong credentials. The link comes up and then drops during authentication, and the log shows a login failure.

Two default routes at the same distance. With two uplinks, give each a different distance so that one is preferred, unless you want load sharing as described on the ECMP page.

Watch out

A wrong service name leaves the client unconnected, with no error beyond silence.

Check yourself

Work through these three questions.

Which settings make a PPPoE client install a default route and use the provider DNS?
add-default-route=yes installs the route, and use-peer-dns=yes takes the provider DNS servers.
Which interface should a masquerade rule name for a PPPoE uplink?
The PPPoE interface, set as the out-interface.
What do service-name and ac-name do on a client?
They limit the client to one server when several answer discovery.

Topic 2 of 4 in PPPoE

Test yourself on PPPoE

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.