PPPoE is widely used by small ISPs and managed networks because it gives each subscriber a username and password, allows per-user profiles, and makes accounting and suspension workflows easier to manage. A reliable PPPoE deployment, however, starts with a clean Layer 2 design, a clear IP plan, and a configuration that is easy to troubleshoot.
Video walkthrough
Before you configure anything
Write down the WAN interface, subscriber-facing interface or VLAN, customer address pool, DNS servers, and the LAN or management network. Make a RouterOS backup and export before changing a production router. Do not reuse the same IP subnet on two interfaces, and avoid enabling a DHCP server on the same subscriber segment unless you intentionally need both services.
Step 1 — Create a subscriber IP pool
The PPPoE profile can automatically assign an address from a pool to each authenticated client. In this example, the subscribers receive addresses from 10.20.0.2 through 10.20.3.254 while the router uses 10.20.0.1 as the local PPP address. Adjust the range for your design.
/ip pool add name=pppoe-pool ranges=10.20.0.2-10.20.3.254
/ppp profile add name=pppoe-default local-address=10.20.0.1 remote-address=pppoe-pool dns-server=1.1.1.1,8.8.8.8 only-one=yesStep 2 — Enable the PPPoE server
Choose the exact bridge, Ethernet port, or VLAN that faces subscribers. The service name can be left blank, but using a meaningful name helps with troubleshooting. Replace PPPoE-BRIDGE with the correct interface on your router.
/interface pppoe-server server add interface=PPPoE-BRIDGE service-name=GLACXYSTEM default-profile=pppoe-default one-session-per-host=yes disabled=noIf your subscriber network is carried on a VLAN, create and test the VLAN first, then bind the PPPoE server to that VLAN interface rather than to the physical trunk port.
Step 3 — Add a test subscriber
Create one test account before importing many users. Use a strong password and confirm that the account receives the expected profile.
/ppp secret add name=test-client password=CHANGE-ME service=pppoe profile=pppoe-defaultConnect a test CPE or laptop, authenticate, and verify that an address from the pool is assigned.
Step 4 — Add internet access carefully
A basic lab usually needs NAT toward the actual internet-facing interface. In production, you may already have a NAT rule, upstream routing, policy routing, or CGNAT design. Do not add duplicate masquerade rules without checking the existing firewall.
/ip firewall nat add chain=srcnat out-interface=WAN action=masquerade comment="PPPoE internet NAT - verify before production"Replace WAN with your real egress interface. Networks with multiple ISPs should use a routing-aware design instead of a single generic rule.
Validation checklist
After the client connects, check /ppp active print, verify that the customer has a remote address, ping a public IP, resolve a domain name, and confirm that browsing works. Test reconnect behavior and duplicate-login behavior. Finally, save an export so you have a known-good reference.
Common problems
If authentication works but the client has no internet, verify the default route, NAT, DNS, firewall forward rules, and the assigned address. If the client cannot discover the PPPoE server, check VLAN tagging, bridge membership, port isolation, and whether another device is filtering PPPoE discovery frames. If sessions randomly drop, inspect physical errors, optical power, CPE logs, MTU/MSS behavior, and upstream packet loss before changing queue settings.
Frequently asked questions
Does PPPoE require DHCP?
No. PPPoE can assign the client IP through the PPP profile and pool. DHCP is a separate service.
Can I run PPPoE on a VLAN?
Yes. Create the VLAN interface, verify tagging end to end, and bind the PPPoE server to that VLAN interface.
Should I copy a full script from another network?
Use scripts as references, not as blind replacements. Interface names, subnets, routing, firewall rules, and subscriber counts differ between networks.
Next step
Document the result of your test and keep a known-good export. If your network behaves differently from the example, diagnose the topology rather than adding more rules blindly. Continue with a related guide from the tutorial library.