How to Set Up a PPPoE Server on MikroTik (ISP & Multi‑Tenant Networks)

PPPoE (Point‑to‑Point Protocol over Ethernet) is the backbone of many ISP and multi‑tenant networks. It allows you to authenticate each customer with a unique username/password, assign individual IP addresses, apply bandwidth limits, and even integrate with RADIUS for automated billing. This guide walks you through setting up a PPPoE server on MikroTik RouterOS.

Why Use PPPoE?

• Per‑user authentication – Each customer logs in with their own credentials.
• Centralised management – Use RADIUS (like MikroRadius) to handle accounts, payments, and limits.
• Granular bandwidth control – Set upload/download limits per user.
• Session isolation – PPPoE creates a separate interface for each user, improving security.
• Compatibility – Every OS and router supports PPPoE clients.

Prerequisites

• A MikroTik router with at least two interfaces: WAN (internet) and LAN (where clients will connect).
• Basic internet connectivity on the router (DHCP or static IP on WAN).
• A dedicated interface or VLAN for the PPPoE server (clients should not have direct IP access to the router).
• WinBox or SSH access.

Step 1: Prepare the Interface for PPPoE Server

Choose which interface will accept PPPoE connections. This is usually a bridge or a physical port (e.g., ether2). For a multi‑port network, create a bridge and add all customer‑facing ports to it.

/interface bridge add name=pppoe-bridge
/interface bridge port add interface=ether2 bridge=pppoe-bridge
/interface bridge port add interface=ether3 bridge=pppoe-bridge
/interface bridge port add interface=ether4 bridge=pppoe-bridge
/interface bridge port add interface=ether5 bridge=pppoe-bridge

Then use pppoe-bridge as your PPPoE server interface.

Step 2: Create an IP Pool for PPPoE Clients

Each logged‑in user needs a unique IP address from a private range. Choose a subnet that does not conflict with your LAN or WAN.

/ip pool add name=pppoe-pool ranges=10.10.0.2-10.10.0.254

WinBox: IP → Pool → Add New → Name pppoe-pool, ranges 10.10.0.2-10.10.0.254.

Step 3: Create a PPP Profile

The profile defines settings for all PPPoE users: local gateway IP, DNS, and whether to use encryption.

/ppp profile add name=pppoe-profile local-address=10.10.0.1 remote-address=pppoe-pool dns-server=1.1.1.1,8.8.8.8 use-encryption=yes

WinBox: PPP → Profiles → Add New → Name pppoe-profile, Local Address 10.10.0.1, Remote Address pppoe-pool, DNS 1.1.1.1, Use Encryption = yes.

Note: local-address is the gateway IP for PPPoE clients. It must be in the same subnet as the pool.

Step 4: Enable the PPPoE Server

Now bind the server to the interface you prepared.

/interface pppoe-server server add interface=pppoe-bridge service-name="ISP-PPPoE" authentication=mschap2,chap default-profile=pppoe-profile one-session-per-host=yes

WinBox: PPP → PPPoE Servers tab → Add New → Interface = pppoe-bridge, Service Name = ISP-PPPoE, Default Profile = pppoe-profile, check One Session Per Host.

one-session-per-host=yes prevents a customer from logging in multiple times from the same MAC address.

Step 5: Add Local Users (Secrets)

Before integrating RADIUS, you can test with local accounts. Each user needs a username, password, and profile.

/ppp secret add name=customer1 password=pass123 service=pppoe profile=pppoe-profile
/ppp secret add name=customer2 password=pass456 service=pppoe profile=pppoe-profile

WinBox: PPP → Secrets → Add New → Name, Password, Service = pppoe, Profile = pppoe-profile.

Step 6: Configure NAT (Internet Access for PPPoE Clients)

Your PPPoE clients need to reach the internet. Add a masquerade rule for the entire PPPoE subnet.

/ip firewall nat add chain=srcnat src-address=10.10.0.0/24 action=masquerade comment="PPPoE clients to internet"

WinBox: IP → Firewall → NAT → Add New → chain srcnat, src-address 10.10.0.0/24, action masquerade.

Step 7: Firewall Rules (Protect the PPPoE Server)

Your router will already have a WAN interface. Add these rules to allow PPPoE (which uses Ethernet protocol 0x8863 and 0x8864) and to block clients from accessing the router’s management services directly.

First, allow PPPoE discovery and session traffic:

/interface ethernet switch rule add ports=pppoe-bridge protocol=pppoe-dicovery action=accept
/interface ethernet switch rule add ports=pppoe-bridge protocol=pppoe-session action=accept

Note: On many routers, PPPoE traffic is automatically forwarded by the bridge. If your clients cannot connect, you may not need these – but they help if you have strict switch rules.

More important: Block PPPoE clients from accessing the router’s management IP (e.g., WinBox, SSH). Add this to the input chain:

/ip firewall filter add chain=input src-address=10.10.0.0/24 action=drop comment="Block PPPoE clients from router"

Place this rule above your general drop rule but after allow rules for established/related traffic.

Step 8: Bandwidth Limits Per User

You can limit each user’s speed directly in the profile or per secret.

8.1 Limit all users equally (via profile)

/ppp profile set pppoe-profile rate-limit="10M/5M"

This gives 10 Mbps download / 5 Mbps upload.

8.2 Individual limits per user

/ppp secret set customer1 rate-limit="20M/10M"

WinBox: In the secret entry, fill the Rate Limit field as upload/download (e.g., 10M/20M – note MikroTik uses tx/rx from client perspective, so often it's reversed; test accordingly).

Step 9: Integrate with RADIUS (MikroRadius)

For automated billing, account expiry, and central management, point your PPPoE server to a RADIUS server.

9.1 Add RADIUS server

/radius add address=YOUR_RADIUS_IP secret=shared_secret service=ppp authentication-port=1812 accounting-port=1813

WinBox: Radius → Add New → IP address, secret, check PPP.

9.2 Set PPP to use RADIUS for authentication

/ppp aaa set use-radius=yes account-interim-time=5m

account-interim-time sends periodic accounting updates (for data usage tracking).

9.3 Optional: Fallback to local secrets

If you want RADIUS first, then local database if RADIUS is down:

/radius set [find] realm="" use-peer-dns=no
/ppp aaa set use-radius=yes order=radius,local

Now all PPPoE authentication requests will go to MikroRadius, which can handle payment verification, bandwidth profiles, and session limits.

Step 10: Test the PPPoE Server

1. On a client device (laptop, or another router), create a PPPoE interface:
2. Windows: Network Settings → VPN → PPPoE → enter username/password.
3. Linux: nmcli connection add type pppoe con-name "PPPoE" ifname eth0 username customer1 password pass123
4. Connect. The client should receive an IP from the pool (e.g., 10.10.0.2).
5. Browse any website – traffic should route through your MikroTik’s WAN.
6. On the router, view active PPP sessions:

/interface pppoe-server session print
/ppp active print

Troubleshooting

• Client cannot find PPPoE server: Ensure the server interface is correct and that the client is on the same broadcast domain (no VLAN separation unless properly configured). Try disabling any firewall on the client side.
• Authentication fails: Check that the secret exists and that the PPP profile allows the authentication method (MSCHAP2 is recommended). Also verify RADIUS connectivity if using external auth.
• Client gets IP but no internet: Verify the NAT masquerade rule (src-address=10.10.0.0/24). Also check that the router’s WAN has internet and that there is no firewall rule blocking forwarding.
• Bandwidth limit not applied: Make sure the rate-limit is set in the profile or secret. You can see dynamic queues under Queue → Simple Queues – they are created automatically for each PPPoE session.
• RADIUS accounting not working: Check that the RADIUS server is reachable and that the shared secret matches. Run /radius print to see if any packets are being sent.

Advanced: Per‑VLAN PPPoE Server

If you have multiple customers on different VLANs, you can run a separate PPPoE server on each VLAN interface. For example:

/interface vlan add name=vlan100 vlan-id=100 interface=ether2
/interface pppoe-server server add interface=vlan100 service-name="VLAN100-PPPoE" default-profile=pppoe-profile

Then each VLAN’s customers are isolated from each other.

Comparison: PPPoE vs. Hotspot vs. Simple DHCP

Conclusion

A PPPoE server on MikroTik gives you carrier‑grade control over your subscriber network. Combined with a RADIUS server like MikroRadius, you can automate account creation, billing, speed changes, and session limits – all without touching the router for every customer.

Once your PPPoE server is running, consider adding PPP secrets import from CSV or setting up interim accounting for real‑time usage tracking. Your network is now ready for production.