MikroTik PPPoE Client Setup: Connect to Your ISP and Route Traffic

Your ISP gives you a PPPoE username and password. Your MikroTik replaces their consumer router. This guide covers the complete PPPoE client setup â€“ connecting to the ISP, routing, NAT, DNS, and firewall â€“ so your entire network gets internet through the PPPoE session.

Prerequisites

A MikroTik router with RouterOS v6 or v7.
ISP-provided PPPoE credentials (username and password).
An Ethernet cable from the ISP's modem/ONT to MikroTik ether1.

Step 1: Create PPPoE Client

/interface pppoe-client add name=pppoe-isp interface=ether1 user=your_isp_username password=your_isp_password add-default-route=yes use-peer-dns=yes default-route-distance=1 disabled=no comment="ISP PPPoE"

WinBox: PPP â†’ + â†’ PPPoE Client.

interface=ether1 â€“ The port connected to your ISP modem/ONT.
add-default-route=yes â€“ Automatically adds a default route through the PPPoE connection.
use-peer-dns=yes â€“ Use the DNS servers provided by your ISP.
default-route-distance=1 â€“ Priority of the auto-added default route.

Step 2: Verify Connection

/interface pppoe-client print
/interface pppoe-client monitor pppoe-isp

You should see status=connected, an assigned IP address, and uptime counting up. Test with:

/ping 8.8.8.8
/ping google.com

Step 3: LAN Setup

# Bridge for LAN ports
/interface bridge add name=bridge-lan
/interface bridge port add interface=ether2 bridge=bridge-lan
/interface bridge port add interface=ether3 bridge=bridge-lan
/interface bridge port add interface=ether4 bridge=bridge-lan
/interface bridge port add interface=ether5 bridge=bridge-lan

# LAN IP
/ip address add address=192.168.88.1/24 interface=bridge-lan

# DHCP server for LAN
/ip pool add name=lan-pool ranges=192.168.88.100-192.168.88.254
/ip dhcp-server add name=dhcp-lan interface=bridge-lan address-pool=lan-pool
/ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1

Step 4: DNS

/ip dns set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8

Or leave use-peer-dns=yes on the PPPoE client to use ISP DNS automatically.

Step 5: NAT Masquerade

/ip firewall nat add chain=srcnat out-interface=pppoe-isp action=masquerade comment="Internet NAT"

Important: Use out-interface=pppoe-isp, NOT out-interface=ether1. The PPPoE interface is a virtual interface on top of ether1. NAT must reference the PPPoE interface.

Step 6: Firewall

# Input chain (protect the router)
/ip firewall filter add chain=input connection-state=established,related action=accept
/ip firewall filter add chain=input connection-state=invalid action=drop
/ip firewall filter add chain=input in-interface=pppoe-isp action=drop comment="Drop all from WAN"

# Forward chain (protect LAN clients)
/ip firewall filter add chain=forward connection-state=established,related action=accept
/ip firewall filter add chain=forward connection-state=invalid action=drop
/ip firewall filter add chain=forward in-interface=pppoe-isp connection-state=new action=drop comment="Block inbound"

See our firewall guide for comprehensive protection.

Step 7: MSS Clamping

PPPoE reduces the MTU from 1500 to 1492 (8-byte PPPoE header). This can cause websites to partially load or hang. Fix with MSS clamping:

/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn in-interface=pppoe-isp action=change-mss new-mss=clamp-to-pmtu passthrough=yes comment="MSS clamp"
/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn out-interface=pppoe-isp action=change-mss new-mss=clamp-to-pmtu passthrough=yes comment="MSS clamp"

Or simply set it in the PPP profile:

/ppp profile set default change-tcp-mss=yes

Step 8: Important Settings

No IP on ether1

When using PPPoE on ether1, do NOT assign an IP address to ether1. The PPPoE virtual interface handles addressing. Having an IP on ether1 can cause routing conflicts.

Auto-Reconnect

PPPoE clients automatically reconnect if the session drops. Set keepalive:

/interface pppoe-client set pppoe-isp keepalive-timeout=30

VLAN Tag (Some ISPs)

Some ISPs require PPPoE over a specific VLAN:

/interface vlan add name=vlan-isp interface=ether1 vlan-id=100
/interface pppoe-client set pppoe-isp interface=vlan-isp

Dual WAN with PPPoE

# ISP1 via PPPoE (primary)
/interface pppoe-client add name=pppoe-isp1 interface=ether1 user=user1 password=pass1 add-default-route=yes default-route-distance=1

# ISP2 via PPPoE or DHCP (backup)
/interface pppoe-client add name=pppoe-isp2 interface=ether2 user=user2 password=pass2 add-default-route=yes default-route-distance=2

# NAT for both
/ip firewall nat add chain=srcnat out-interface=pppoe-isp1 action=masquerade
/ip firewall nat add chain=srcnat out-interface=pppoe-isp2 action=masquerade

Distance 1 vs. 2 creates automatic failover. See our dual-WAN guide for load balancing.

Complete Script

# ============================================
# PPPoE Client â€“ Full Internet Setup
# ============================================

# PPPoE
/interface pppoe-client add name=pppoe-isp interface=ether1 user=USERNAME password=PASSWORD add-default-route=yes use-peer-dns=no default-route-distance=1

# LAN
/interface bridge add name=bridge-lan
/interface bridge port add interface=ether2 bridge=bridge-lan
/interface bridge port add interface=ether3 bridge=bridge-lan
/interface bridge port add interface=ether4 bridge=bridge-lan
/interface bridge port add interface=ether5 bridge=bridge-lan
/ip address add address=192.168.88.1/24 interface=bridge-lan

# DNS
/ip dns set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8

# DHCP
/ip pool add name=lan-pool ranges=192.168.88.100-192.168.88.254
/ip dhcp-server add name=dhcp-lan interface=bridge-lan address-pool=lan-pool
/ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1

# NAT
/ip firewall nat add chain=srcnat out-interface=pppoe-isp action=masquerade

# Firewall
/ip firewall filter add chain=input connection-state=established,related action=accept
/ip firewall filter add chain=input connection-state=invalid action=drop
/ip firewall filter add chain=input in-interface=pppoe-isp action=drop
/ip firewall filter add chain=forward connection-state=established,related action=accept
/ip firewall filter add chain=forward connection-state=invalid action=drop
/ip firewall filter add chain=forward in-interface=pppoe-isp connection-state=new action=drop

Troubleshooting

PPPoE won't connect (timeout): Verify the cable is in the correct port. Check that no IP is assigned to ether1. Try a different authentication method (authentication=pap,chap,mschap1,mschap2). Contact your ISP to verify credentials.
Connected but no internet: Check that the default route exists (/ip route print). Verify NAT masquerade uses out-interface=pppoe-isp, not ether1.
Websites partially load: MSS clamping issue. Enable change-tcp-mss=yes or add the mangle rules above.
Frequent disconnects: Check ISP-side logs. Increase keepalive-timeout. Some ISPs disconnect PPPoE sessions every 24 hours â€“ this is normal.
ISP requires VLAN tag: Create a VLAN interface on ether1 and point the PPPoE client to the VLAN interface instead of ether1.

Conclusion

PPPoE client on MikroTik is a one-command operation. Add the client, let it auto-create the default route, set up NAT and DNS, and your network is online. The key details to remember: NAT references the PPPoE interface (not ether1), MSS clamping prevents page-loading issues, and no IP goes on the physical WAN interface.