MikroTik ISP Network Design: IP Planning, Topology, Redundancy & Scaling (2026)

Our ISP mega-guide showed you how to configure a single NAS router. This guide zooms out to the network design – the decisions you make before writing any configuration that determine whether your ISP scales to 10,000 subscribers or collapses at 500.

ISP Network Layers

┌─────────────────────────────┐
│         Internet            │
│    (Upstream / Transit)     │
└─────────┬───────────────────┘
          │
┌─────────▼───────────────────┐
│      Core / Border          │  ← BGP, NAT, backbone
│  (CCR2116 / CCR2004)        │
└─────────┬───────────────────┘
          │
┌─────────▼───────────────────┐
│    Distribution              │  ← OSPF, aggregation
│  (RB5009 / CRS326)          │
└───┬─────────────────┬───────┘
    │                 │
┌───▼────┐       ┌────▼───┐
│Access 1│       │Access 2│     ← PPPoE, customer-facing
│(hEX/OLT)│      │(hEX/AP)│
└────────┘       └────────┘
  ││││              ││││
Subscribers      Subscribers

Layer 1: Core / Border

• Role: Connects to upstream transit, handles BGP, performs NAT/CGNAT, runs the main firewall.
• Hardware: CCR2116-12G-4S+ or CCR2004-1G-12S+2XS. Needs high PPS (packets per second) for NAT.
• Redundancy: Two border routers with VRRP and dual uplinks.
• Key config: BGP peering, NAT masquerade or CGNAT, firewall RAW for DDoS protection.

Layer 2: Distribution

• Role: Aggregates access layer traffic, runs OSPF for dynamic routing, inter-VLAN routing.
• Hardware: RB5009UG+S+IN or CRS326-24G-2S+ with SFP+ uplinks.
• Key config: OSPF area backbone, trunk links to access layer, VLAN segmentation.

Layer 3: Access

• Role: Customer-facing. Runs PPPoE server, connects to OLTs (FTTH) or wireless APs (WISP).
• Hardware: hEX S (small POPs), RB5009 (medium POPs), or dedicated OLTs for fiber.
• Key config: PPPoE server, RADIUS client to MikroRadius, DHCP for management VLAN.

IP Address Planning

Management Network

172.16.0.0/16 – Management/infrastructure
  172.16.0.0/24 – Core routers (loopbacks)
  172.16.1.0/24 – Distribution switches
  172.16.2.0/24 – Access POPs
  172.16.10.0/24 – Servers (RADIUS, monitoring, DNS)

Subscriber Networks

10.0.0.0/8 – Subscriber PPPoE pools (private, NATted)
  10.0.0.0/16 – Area 1 subscribers
  10.1.0.0/16 – Area 2 subscribers
  10.2.0.0/16 – Area 3 subscribers

Each /16 gives ~65,000 subscriber IPs. Each area (POP/NAS) gets its own /16 for clean addressing.

Point-to-Point Links

10.255.0.0/16 – Inter-router transit links
  10.255.0.0/30 – Core1 ↔ Dist1
  10.255.0.4/30 – Core1 ↔ Dist2
  10.255.1.0/30 – Dist1 ↔ Access1

Use /30 subnets for point-to-point links (2 usable IPs each). Or /31 to save addresses.

CGNAT vs. Public IP

Most small ISPs use CGNAT (private 10.x.x.x addresses behind NAT). Offer public IPs as a premium service. Deploy IPv6 alongside for future-proofing.

CGNAT on MikroTik

/ip firewall nat add chain=srcnat src-address=10.0.0.0/8 out-interface=ether1-wan action=src-nat to-addresses=203.0.113.0-203.0.113.31 comment="CGNAT"

Map your subscriber pool to a range of public IPs. MikroTik distributes port ranges across the public IPs.

Fiber (FTTH) Design

• OLT (Optical Line Terminal) – Central device at the POP. Connects to subscribers via fiber splitters.
• ONT (Optical Network Terminal) – Device at the customer site. Provides Ethernet port.
• MikroTik role: The MikroTik router sits behind the OLT as the PPPoE server / BRAS (Broadband Remote Access Server).
• Architecture: OLT → MikroTik NAS (PPPoE + RADIUS) → Distribution → Core → Internet.

Wireless ISP (WISP) Design

• Tower sites with MikroTik sector antennas (e.g., mANTBox, SXT, LHG).
• PTP backhauls between towers using 60 GHz (Wireless Wire) or licensed microwave.
• CPE at customer sites connects to the nearest tower.
• MikroTik role: Both the wireless infrastructure AND the routing/PPPoE/RADIUS.

Redundancy Checklist

• ✅ Dual uplinks – Two ISP transits with BGP or dual WAN failover.
• ✅ VRRP on core – Two border routers, VRRP for gateway redundancy.
• ✅ Redundant power – UPS on all network equipment.
• ✅ RADIUS redundancy – Primary + secondary MikroRadius servers.
• ✅ Configuration backups – Automated daily backups of all routers.
• ✅ Monitoring – The Dude or Zabbix monitoring every device.

Hardware Selection

Scaling Strategy

1. 0-200 subscribers: Single NAS router + MikroRadius. Simple flat network.
2. 200-1000: Add distribution layer. Multiple access NAS routers. OSPF for routing.
3. 1000-5000: Dedicated core routers. BGP with upstream. CGNAT pool. Multiple POPs.
4. 5000+: Dual core with VRRP. Multiple distribution rings. MPLS backbone (optional). Dedicated monitoring and backup infrastructure.

Common Design Mistakes

• Flat network: Everything on one subnet. Works at 50 subscribers, fails at 500. Use VLANs and proper L3 segmentation from the start.
• Single point of failure: One core router, one uplink, one power feed. Plan redundancy even if you don't deploy it immediately.
• Undersized NAT router: NAT consumes CPU proportionally to connections, not bandwidth. A 1 Gbps link with 5,000 active users can max out a hEX's connection tracking.
• No IP plan: Random addressing creates conflicts and makes troubleshooting impossible. Document your IP plan on day one.
• No monitoring: If you can't see it, you can't fix it. Deploy The Dude or Zabbix before your first customer.

Conclusion

A well-designed network is the difference between an ISP that scales gracefully and one that requires constant firefighting. Plan your layers (core, distribution, access), address your IP space systematically, build in redundancy from the start, and choose hardware that can grow with you.

MikroRadius fits into every scale – from 10 subscribers to 10,000 – providing the user management, billing, and session control layer that MikroTik's routing handles at the network level. Together, they're the complete MikroTik ISP stack.