PPPoE · Topic 3 of 4

PPPoE Server Configuration

Configure a RouterOS PPPoE server: build the profile and pool, add secrets, enable the server on a LAN interface, limit sessions and check active clients.

5 min

In a nutshell

The server is configured at /interface pppoe-server server.
It listens on one interface, usually a LAN port or a bridge.
service-name is the name advertised to clients.

What it is

A PPPoE server is a service that listens on one interface and accepts PPPoE clients that log in.

Small providers, hotels and campus networks use it to give each user a login, an address and a speed limit on a shared Ethernet segment. The server uses the same profile, secret and pool objects as the other PPP services.

Each connected client gets its own dynamic interface on the server.

How it works

You prepare the pool, profile and secrets first, and then enable the server on the right interface.

Step 1: pool and profile

/ip pool add name=pppoe-pool ranges=172.16.0.10-172.16.0.200
/ppp profile add name=pppoe-prof local-address=172.16.0.1 remote-address=pppoe-pool dns-server=172.16.0.1 rate-limit=2M/10M

The local-address is the router end of every client link. The remote-address names the pool that supplies client addresses.

Step 2: secrets

/ppp secret add name=user1 password=Str0ng service=pppoe profile=pppoe-prof

The service value must be pppoe or any. A secret set to another service is ignored by this server.

Step 3: the server

/interface pppoe-server server add service-name=isp interface=bridge-lan default-profile=pppoe-prof authentication=chap,mschap2 one-session-per-host=yes max-sessions=100 disabled=no

Setting	What it does
`service-name`	The name the server advertises to clients.
`interface`	The interface the server listens on.
`default-profile`	Profile used when a secret names none.
`authentication`	Methods the server accepts: pap, chap, mschap1, mschap2.
`one-session-per-host`	Allows one session per client MAC address.
`max-sessions`	Limits the number of simultaneous sessions.
`keepalive-timeout`	Time before a silent client is dropped.
`max-mtu` and `max-mru`	Size limits for client links.

Authentication methods matter. PAP sends the password in clear, CHAP uses a challenge, and the MS-CHAP versions also allow MPPE encryption.

Interface choice

The server listens on a Layer 2 interface, such as a LAN port or a bridge. Clients must be on that segment, since discovery is a broadcast.

The point of PPPoE is that clients get addresses from the session, not from the segment.

Static server interfaces

Dynamic interfaces are created when clients connect. A static interface fixes the name for one user.

/interface pppoe-server add name=pppoe-user1 user=user1

A stable name is useful for queues and firewall rules that must always match the same user.

Securing the segment

Anyone on the segment can reach the server, so firewall rules should limit what unauthenticated hosts can do. Clients that have not logged in should have no path to the internet or to other users.

Dynamic client interfaces are not bridge ports unless the profile sets bridge.

The interface the PPPoE server listens on should carry no IP address. PPPoE discovery works at Layer 2, so the server does not need one there. Without an address, a client that has not logged in has nothing to reach on the segment, and the only way in is a session.

/ip address print
/ip address remove [find interface=ether2]

Use a dedicated interface for this. Do not strip the address from a bridge or port that you also use to manage the router.

Exam tip

Clients still get an address from the profile and pool once the session is up, so removing the interface address does not stop them.

Verification

/interface pppoe-server server print
/ppp active print
/interface pppoe-server print

/ppp active print lists each connected user, with the address and the uptime. /interface pppoe-server print lists the dynamic and static client interfaces.

If clients fail to connect, check that the secret uses service=pppoe and that the authentication methods match the client.

Version note

The PPPoE server menu and settings above apply to RouterOS v6 and v7.

What to remember for the exam

Seven facts cover most PPPoE server questions.

The server is configured at /interface pppoe-server server.
It listens on one interface, usually a LAN port or a bridge.
service-name is the name advertised to clients.
The secret needs service=pppoe or any.
The profile supplies local and remote addresses, DNS and rate limit.
one-session-per-host and max-sessions limit sessions.
/ppp active print shows the connected users.

Exam tip

Keep one profile for each class of subscriber, so speed changes are made in one place.

Common mistakes

These four errors appear again and again.

Wrong service in the secret. A secret set to pptp is ignored by a PPPoE server.

Listening on the wrong interface. If the server sits on a port the clients are not on, discovery never reaches it.

Authentication mismatch. A client that offers only methods the server does not accept is refused.

A pool that is too small. When the pool is empty, new users cannot connect.

Watch out

A PPPoE server on a segment that also carries unauthenticated traffic needs firewall rules that limit what those hosts can reach.

Check yourself

Work through these three questions.

Which service value must a secret have for a PPPoE server?
service=pppoe, or any.
What do one-session-per-host and max-sessions do?
one-session-per-host allows one session for each client MAC address. max-sessions limits the total number of sessions.
Where do clients get their addresses from on a PPPoE server?
From the profile, which can name an IP pool in remote-address.

Topic 3 of 4 in PPPoE

Test yourself on PPPoE

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.