PPPoE Server Setup on MikroTik: Complete ISP Deployment Guide

Why PPPoE Is Still the ISP Standard

Point-to-Point Protocol over Ethernet (PPPoE) remains the dominant subscriber authentication method for ISPs worldwide. Unlike static IP or DHCP-based setups, PPPoE provides per-user authentication, bandwidth control, and session accounting — all essential for billing accuracy.

MikroTik RouterOS has built-in PPPoE server support that scales to thousands of concurrent sessions when configured correctly. The key is proper planning of IP pools, profiles, and integration with RADIUS for centralised management.

Network Architecture Overview

A typical PPPoE deployment consists of the MikroTik router acting as the PPPoE server (BNG/BRAS), subscriber CPE devices initiating PPPoE sessions, and optionally a RADIUS server for authentication and accounting.

The router assigns each subscriber an IP from a defined pool, applies bandwidth limits via the PPP profile, and logs session data for billing. With RADIUS, you centralise all of this — ISPbills manages the RADIUS server automatically.

• BNG/BRAS Router — MikroTik CCR or hAP running PPPoE server
• IP Pools — separate pools for each package tier or region
• PPP Profiles — define rate limits, DNS, and session parameters
• PPP Secrets — local user database (or RADIUS for scale)
• RADIUS Server — centralised auth via FreeRADIUS + ISPbills

Step 1: Create IP Address Pools

IP pools define the range of addresses assigned to PPPoE subscribers. Create separate pools for different service tiers or network segments to simplify management.

/ip pool
add name=pool-basic ranges=10.10.1.2-10.10.1.254
add name=pool-premium ranges=10.10.2.2-10.10.2.254
add name=pool-business ranges=10.10.3.2-10.10.3.254

Keep pool sizes aligned with your subscriber capacity. A /24 pool gives you 253 usable addresses. For larger deployments, use /22 or /21 ranges.

Step 2: Configure PPP Profiles

PPP profiles define the bandwidth limits, DNS servers, and other parameters applied when a subscriber connects. Create one profile per service package.

/ppp profile
add name=10Mbps local-address=10.10.0.1 remote-address=pool-basic     rate-limit=10M/10M dns-server=8.8.8.8,1.1.1.1     only-one=yes change-tcp-mss=yes use-mpls=no
add name=25Mbps local-address=10.10.0.1 remote-address=pool-premium     rate-limit=25M/25M dns-server=8.8.8.8,1.1.1.1     only-one=yes change-tcp-mss=yes
add name=50Mbps local-address=10.10.0.1 remote-address=pool-business     rate-limit=50M/50M dns-server=8.8.8.8,1.1.1.1     only-one=yes change-tcp-mss=yes

The rate-limit format is rx/tx (upload/download from the subscriber perspective). Setting only-one=yes prevents duplicate sessions for the same username.

Step 3: Enable PPPoE Server on Interface

Bind the PPPoE server to the interface where subscribers connect. This is typically your LAN or bridge interface facing the access network.

/interface pppoe-server server
add service-name=ISP-PPPoE interface=ether2-lan     default-profile=10Mbps authentication=pap,chap     max-mtu=1480 max-mru=1480 mrru=disabled     keepalive-timeout=30 one-session-per-host=yes

Set MTU to 1480 to account for the 8-byte PPPoE overhead (1500 - 8 - 12 PPP). This prevents fragmentation issues that cause slow browsing and failed downloads.

Step 4: Add PPP Secrets (Local Auth)

For small deployments or testing, you can add subscribers directly as PPP secrets. For production ISPs with 100+ subscribers, skip this and use RADIUS instead.

/ppp secret
add name=user001 password=SecurePass123 service=pppoe     profile=10Mbps comment="John Doe - Basic Plan"
add name=user002 password=AnotherPass456 service=pppoe     profile=25Mbps comment="Jane Smith - Premium Plan"

Step 5: Integrate with RADIUS

RADIUS is essential for ISPs at scale. It centralises authentication, authorisation, and accounting (AAA). ISPbills manages FreeRADIUS automatically — when you assign a subscriber to a package, it creates the RADIUS user with the correct rate-limit attributes.

/radius
add service=ppp address=10.10.0.5 secret=YourRadiusSecret     authentication-port=1812 accounting-port=1813 timeout=3000ms

/ppp aaa
set use-radius=yes interim-update=5m accounting=yes

The interim-update=5m sends accounting updates every 5 minutes, giving you near-real-time session data in ISPbills for traffic monitoring and usage reporting.

Troubleshooting Common PPPoE Issues

Here are the most frequent PPPoE problems ISP operators encounter and how to resolve them:

How ISPbills Automates PPPoE Management

Managing PPP secrets, profiles, and IP pools manually across multiple routers is error-prone. ISPbills automates the entire PPPoE lifecycle:

• Auto-provisioning — assign a subscriber to a package and ISPbills creates the RADIUS user with correct Mikrotik-Rate-Limit attributes automatically
• Package changes — upgrade or downgrade a subscriber and the rate limit updates instantly on next reconnect
• Session monitoring — see all active PPPoE sessions, uptime, IP assignments, and real-time bandwidth in one dashboard
• Auto-suspension— when a subscriber's invoice is overdue, ISPbills disables their RADIUS account and optionally redirects to a payment page
• Bulk operations — push profile changes to all routers simultaneously via the MikroTik API