With PPPoE a device logs in to the network before it gets an address. Usually your router sits on the customer side of that conversation: it fills in the username and password from your provider and gets internet back. That is covered in WAN: your connection to the internet.
This chapter is about the other side. Your router becomes the party that knows the accounts, hands out the addresses and keeps track of the sessions. That is what a provider does.
When you would run one
A PPPoE server earns its place when you want every connection to say who it is, and want to be able to look that up or take it away afterwards:
- A small network where you resell internet: a business centre, a campsite, a shared building.
- A setup where each customer should get a fixed address or a specific speed, tied to their account rather than to whichever port or device they happen to use.
- A network where you want to cut sessions centrally, with RADIUS behind it.
If you do not need that, DHCP is simpler and faster. A PPPoE session costs work per packet, and every customer who cannot log in phones you.
Where it sits
In advanced mode, in the part called Hotspot, PPPoE server, RADIUS, under the PPPoE server group. There is no wizard role for it; this is deliberately advanced work. The part is off by default.
The settings
Interface
The interface the server listens on for login requests. That can be a physical port, a bridge or a VLAN. Never pick the port that goes to your own provider: your server would then be answering on the side where it was supposed to be asking.
Service name
isp by default. The name the server puts in its announcement. A client that states a service name only gets an answer from a server with the same one. With a single server the name hardly matters, as long as your customers leave it empty or copy it exactly.
Local address and address pool
The local address, 10.9.0.1 by default, is the router's address on every session: it becomes your customer's gateway. The address pool, 10.9.0.2-10.9.255.254 by default, is where customers get their address from. Unlike a LAN, that range does not have to be a neat subnet: every session is a point to point link.
Keep the local address out of the pool and make sure the range does not collide with your own networks. The checks above the script watch for overlapping subnets.
DNS for clients
What you put here is handed to customers in their session, comma separated. Leave it empty and they get no DNS from you and have to arrange it themselves.
Subscribers
The Subscribers table is the account list when you do not use RADIUS. Per subscriber: a username, a password (the button generates a twelve character one), optionally a fixed address and optionally a rate.
Watch the rate field. In the script it becomes a comment on the account, not a limit that enforces anything. The script says so as well: a real per subscriber limit goes in a PPP profile of its own per speed, or comes from RADIUS. Fill in only this field and that customer simply gets the whole line.
What ends up in the script
/ip poolnamedpppoe-pool./ppp profilenamedpppoe: the local address, the pool as remote address, your DNS,change-tcp-mss=yesandonly-one=yes./ppp secretper subscriber, with servicepppoeand their fixed address if you gave one./interface pppoe-server serveron the chosen interface, withauthentication=pap,chap,mschap2,one-session-per-host=yesand MTU and MRU at 1480.
change-tcp-mss=yes is not decoration: at an MTU of 1480, customers without MSS adjustment run into sites that hang halfway. only-one=yes and one-session-per-host=yes together stop the same account from being online in two places at once.
RADIUS behind it
With more than a handful of subscribers you do not want the list living in every router. Switch on the RADIUS client in the same section, fill in the server address and the shared secret, and tick at least ppp under For. The generator then writes /ppp aaa with use-radius=yes and accounting on, next to the /radius line itself.
From then on the accounts come from the server, and so do speeds and fixed addresses if your server sends them. Your own subscriber table can stay empty. Incoming CoA on port 3799 lets the server change or cut a running session, for instance when someone stops paying.
The configurator writes the client only. A RADIUS server, User Manager or anything else, is yours to set up.
How it differs from PPPoE as a client
| Client (WAN) | Server (this chapter) | |
|---|---|---|
| Where you fill it in | WAN / internet, per uplink | Hotspot, PPPoE server, RADIUS |
| What you fill in | Your account at the provider | Your customers' accounts |
| Address | You receive one | You hand them out, from the pool |
| In the script | /interface pppoe-client | /interface pppoe-server server |
Both on the same device is fine, as long as they are not on the same interface: client side towards the provider, server side towards your own network.
Things to watch
- Firewall. The sessions customers set up are dynamic interfaces. They are not automatically in the LAN or WAN interface lists the firewall uses, so rules that allow something "from LAN" do not cover them by themselves. Decide deliberately what subscribers may reach on the router. See Firewall.
- NAT. If customers get addresses from the pool, those have to go out through NAT like your LAN does, or they have no internet.
- One server per broadcast domain. With two PPPoE servers on the same segment, whoever answers first wins. That is an unpleasant fault to track down.
- Checking.
/ppp active printshows who is online,/interface pppoe-server printthe server itself, and the log tells you why a login failed.
Further reading: The hotspot, WAN: your connection to the internet and QoS.