PPPoE Server MikroTik Configuration Script for RouterOS v7

What this baseline configures

This guide creates a small, understandable PPPoE test service. It does not pretend to solve every ISP design. The blocks cover:

• An IP pool for fallback local PPP users.
• A PPP profile with local address, DNS, and a conservative rate limit.
• One local test account so you can prove PPPoE before adding RADIUS.
• A RADIUS client entry for PPP authentication and accounting.
• PPP AAA settings with an interim accounting update.
• A PPPoE server on the subscriber-facing interface.

For a real WISP, add VLAN design, subscriber isolation, routing, queue strategy, monitoring, backups, and a tested firewall policy separately. The generator on this site can produce a starting file, but the review steps below remain necessary.

1. Decide the values before touching RouterOS

The subscriber interface must be the correct Layer 2 path. Do not use the WAN interface by accident. RouterOS documentation also warns against assigning a normal IP or DHCP service to the interface that receives PPPoE requests unless the topology explicitly requires it.

2. Create a backup and inspect the starting point

Export a readable backup before adding anything:

/export file=before-pppoe-setup

Check the interfaces so you do not confuse the uplink with the subscriber side:

/interface print

Check the installed RouterOS version:

/system resource print

Record the version and the interface names in your change log. If the router is remote, verify that you can return to it through a local console, an existing VPN, or another tested management path.

3. Add the subscriber IP pool

Run this only after checking that the range is unused and does not overlap a LAN, VPN, tower management, or customer network:

/ip pool add name=<POOL_NAME> ranges=<POOL_RANGE> comment="PPPoE fallback pool"

Verify the pool:

/ip pool print detail

4. Create a PPP profile

The rate-limit format is from the router’s perspective: rx-rate/tx-rate means subscriber upload/subscriber download. Start with a modest test rate and change it after you verify the direction:

/ppp profile add name=pppoe-test local-address=<ROUTER_PPP_IP> remote-address=<POOL_NAME> dns-server=1.1.1.1,8.8.8.8 rate-limit=5M/10M only-one=yes change-tcp-mss=yes comment="PPPoE test profile"

Verify the profile:

/ppp profile print detail where name="pppoe-test"

Do not treat this profile as a universal QoS policy. Large networks often use RADIUS attributes, PCQ, Queue Tree, or a separate queue architecture.

5. Add one local test account first

Use a temporary test username and a strong temporary password. Replace both placeholders and remove the account after the RADIUS path is proven:

/ppp secret add name=<TEST_USER> password=<TEMPORARY_PASSWORD> service=pppoe profile=pppoe-test comment="Temporary PPPoE validation account"

Verify that the secret exists without sharing its password:

/ppp secret print detail where name="<TEST_USER>"

This local test isolates PPPoE discovery, the PPP profile, IP assignment, and the client device from RADIUS. If the local account cannot connect, do not troubleshoot RADIUS yet.

6. Create the PPPoE access concentrator

Use the subscriber-facing interface, not the WAN:

/interface pppoe-server server add interface=<SUBSCRIBER_IF> service-name=<SERVICE_NAME> default-profile=pppoe-test one-session-per-host=yes max-mtu=1480 max-mru=1480 disabled=no comment="PPPoE access concentrator"

The service name helps clients identify the access concentrator. If you use VLANs, make the VLAN design explicit. RouterOS supports pppoe-over-vlan-range, but do not overlap a VLAN interface and a PPPoE VLAN range accidentally.

Verify the server:

/interface pppoe-server server print detail

From the test client, connect with the temporary local account. Then verify active sessions:

/ppp active print detail

7. Add RADIUS for PPP authentication

Only continue after the local test works. Add the server with the real address and a secret that matches the RADIUS server’s client/NAS definition:

/radius add service=ppp address=<RADIUS_IP> secret=<RADIUS_SHARED_SECRET> authentication-port=1812 accounting-port=1813 comment="Primary PPP RADIUS"

If the RADIUS server expects a specific source IP, set it deliberately and ensure the server defines that IP as the NAS client:

/radius set [find where address="<RADIUS_IP>" and service=ppp] src-address=<RADIUS_SOURCE_IP>

Print the entry for review, but redact the secret before sharing any output:

/radius print detail

8. Enable PPP AAA and accounting

Enable RADIUS authentication and accounting for PPP:

/ppp aaa set use-radius=yes accounting=yes interim-update=5m

Verify:

/ppp aaa print

RouterOS may check the local PPP secret before consulting RADIUS. For the RADIUS test, use a username that is not present in /ppp secret, otherwise a successful login may not prove that the RADIUS path works.

9. Test authentication and accounting separately

Watch RADIUS and PPPoE logs while making one login attempt:

/log print follow where topics~"radius|ppp|pppoe"

Inspect RADIUS counters after the test:

/radius monitor [find]

Interpret the result:

• No RADIUS request: check local-secret selection and /ppp aaa.
• Timeout: check route, UDP firewall, server listener, VRF, and source IP.
• Reject: read the RADIUS server’s user or policy reason.
• Bad reply: compare the shared secret and the source client definition.
• Login works but usage is empty: check accounting UDP 1813, accounting=yes, interim updates, and the server accounting log.

RADIUS authentication normally uses UDP 1812 and accounting uses UDP 1813. The standards describe Access-Request/Access-Accept/Access-Reject for authentication and Start/Interim/Stop accounting records; your billing platform may add vendor-specific attributes and policy.

10. Add NAT only after the PPP session is proven

NAT is a separate forwarding decision. If this router is the internet gateway and subscribers must share the WAN address, add a narrow masquerade rule for the intended WAN interface:

/ip firewall nat add chain=srcnat out-interface=<WAN_IF> src-address=<SUBSCRIBER_SUBNET> action=masquerade comment="PPPoE subscribers to WAN"

Replace the subnet with the real subscriber range. Verify counters during one test browse:

/ip firewall nat print stats

Do not add this rule if NAT is performed upstream or if your design routes public subscriber addresses directly. The correct choice depends on the topology.

11. Production hardening checklist

12. Remove the temporary local test account

After the RADIUS test user authenticates and accounting is visible, remove the temporary local account by its exact name:

/ppp secret remove [find where name="<TEST_USER>"]

Keep a local emergency account only if your access policy requires one, and protect it with a unique password, restricted service, and documented break-glass procedure.

Sources and version notes

The syntax and behavior in this guide are based on the current MikroTik documentation for PPPoE, RADIUS, PPP AAA, and RouterOS logging. The PPPoE protocol itself is specified in RFC 2516. Verify commands against the target RouterOS release before applying them.