Lab 08-01 · PPPoE client: log in to your Internet provider¶

Think about the fibre router at home. Nobody at your house typed an IP address into it, and yet it is online. How does your Internet provider know that this box belongs to a paying customer, and not to the neighbour who plugged into the same street cabinet?

The answer, in Spain and in many countries, is a login. Your home router quietly sends a username and a password to the provider every time it starts. If they match a customer, the provider opens a private connection for it and hands it an address. That login protocol is called PPPoE, and in this lab your router uses it to reach the Internet.

One picture for the whole module: the pneumatic tube¶

Imagine a huge public building: corridors, lifts, a busy reception, thousands of people walking around. That building is the shared network, and in the end the Internet.

Now imagine that the building also has pneumatic tubes, like the ones old banks and hospitals used to send little capsules from one office to another. You put your letter in a capsule, drop it in the tube, and it pops out at the other end. People in the corridors never see it, and nobody can take a detour with it.

A tunnel is a private path between two points, built inside another network. Your packets travel inside other packets (the capsule), so the network in between only sees the capsule, not what is inside.

Putting a packet inside another packet is called encapsulation. Every tunnel in this module (PPPoE, PPTP, SSTP) is a different kind of pneumatic tube.

PPP: the rules of the tube¶

PPP (Point-to-Point Protocol, RFC 1661, 1994) connects exactly two devices and manages that link: who you are, which address you get, and how data is packed.

PPP was born for dial-up modems: one phone line, two ends, no one else. It gives a link three services that plain Ethernet does not have:

RouterOS supports several PPP-based tunnels: PPPoE, PPTP, SSTP, L2TP, OVPN and more. They all share the same PPP menus (profiles, secrets, active connections), which is why learning one teaches you most of the others.

PPPoE: PPP over your Ethernet cable¶

PPPoE (PPP over Ethernet, RFC 2516, 1999) carries PPP inside Ethernet frames, so a provider can make every customer log in on a shared Ethernet network.

The provider's side is called the access concentrator (in RouterOS: the PPPoE server). Your side is the PPPoE client. Most operating systems include a PPPoE client, and RouterOS has both client and server.

Here is the clever part: PPPoE works below IP. Your router does not need an IP address to find the server. It simply shouts on the cable "is there any PPPoE server here?", like asking aloud in the building's lobby. That is the discovery stage:

sequenceDiagram
    participant C as r1<br>(PPPoE client)
    participant S as class-ap<br>(PPPoE server)
    C->>S: PADI · "any PPPoE server out there?" (broadcast)
    S->>C: PADO · "me! I offer service mtcnaclass"
    C->>S: PADR · "I choose you"
    S->>C: PADS · "session opened"
    Note over C,S: PPP stage: login (MS-CHAPv2), address 10.10.10.x, DNS
    C-->>S: your traffic, inside the tube

The service name is a label the server announces ("mtcnaclass"). If there is more than one PPPoE server on the same network, set the service name in the client; otherwise the client connects to whichever server answers first (slide 315).

Point-to-point addresses: the /32 surprise¶

When the tunnel comes up, your router gets an address like 10.10.10.200/32. A /32 mask means "this one address and nothing else": there is no subnet to share, because a tube has only two ends.

In a point-to-point address, the "network" column shows the other end of the tunnel, and that other end is your gateway.

PPP addressing saves two addresses per link (slide 328). If the device at the other end does not understand it, you fall back to a /30.

The scenario¶

The trainer's router class-ap plays your Internet provider. Besides its usual DHCP server, it now runs a PPPoE server with the service name mtcnaclass and the account mtcnaclass / mtcnaclass (in the lab files: class-ap-pppoe.rsc).

flowchart LR
    INET["<b>internet</b><br>198.51.100.10<br>web server"]
    subgraph ISP["The provider"]
        AP["<b>class-ap</b><br>10.0.0.1 · DHCP<br>PPPoE server 'mtcnaclass'<br>tunnel end 10.10.10.1"]
    end
    subgraph HOME["Your home"]
        R1["<b>r1</b><br>ether2: WAN<br>bridge1: 192.168.88.1/24"]
        PC1["<b>pc1</b><br>your laptop<br>192.168.88.x (DHCP)"]
    end
    INET ---|"198.51.100.0/24"| AP
    AP ===|"ether2 · today DHCP,<br>after the lab a PPPoE tube"| R1
    R1 ---|"ether3"| PC1

On a real hAP the Internet port is ether1; in the virtual lab ether1 is reserved for the lab itself, so the Internet port is ether2 and the LAN ports start at ether3.

Start the lab¶

Download the lab files and unzip them: 08-01-pppoe-client.zip. Open a terminal inside the 08-01-pppoe-client folder.

sudo containerlab deploy -t topology.clab.yml

RouterOS needs about a minute to boot. Then open two terminals:

ssh admin@clab-mtcna-08-01-r1                  # your router, password: admin
docker exec -it clab-mtcna-08-01-pc1 bash      # your laptop

Step 1 · Look before you change anything¶

Before replacing the way your router reaches the Internet, write down how it does it today. Then ask the cable whether there is a PPPoE server out there.

WinBox: IP → DHCP Client and IP → Routes; the scan is PPP → PPPoE Scan.

/ip dhcp-client print
/ip route print
/interface pppoe-client scan ether2

(Ignore client1 on ether1: that is the virtual lab's management port.) The DHCP client on ether2 is bound with an address like 10.0.0.200, and the default route 0.0.0.0/0 points to 10.0.0.1. The scan keeps refreshing a small table; press Ctrl+C to stop it:

SERVICE     MAC-ADDRESS        AC-NAME
mtcnaclass  AA:C1:AB:CC:5E:63  class-ap

AC-NAME is the name of the access concentrator (the provider's box) and SERVICE is the label you will type in the client.

Done when you have the DHCP address, the gateway and the service name written in your report.

Step 2 · Switch off the DHCP client¶

Two different things trying to be "the way to the Internet" on the same port is a recipe for confusion. The course asks you to switch the DHCP client off (disable, not delete, so you can bring it back at the end).

WinBox: IP → DHCP Client, select the ether2 client, click the red cross (Disable).

/ip dhcp-client disable [find interface=ether2]
/ip address print
/ping 10.0.0.1 count=2

The D 10.0.0.x address disappears and the ping fails. Your router is now offline: expected.

Done when /ip dhcp-client print shows the ether2 client with the X (disabled) flag.

Step 3 · Create the PPPoE client¶

Now you build your end of the tube: which cable to use, which service to ask for, and your badge (username and password from the trainer).

WinBox: PPP → Interface → + → PPPoE Client. Tab General: Interfaces ether2. Tab Dial Out: Service mtcnaclass, User mtcnaclass, Password mtcnaclass, tick Use Peer DNS and Add Default Route.

/interface pppoe-client add name=pppoe-out1 interface=ether2 service-name=mtcnaclass \
    user=mtcnaclass password=mtcnaclass add-default-route=yes use-peer-dns=yes disabled=no

• add-default-route: when the tube opens, send all Internet traffic through it.
• use-peer-dns: use the DNS server that the provider announces.

Done when /interface pppoe-client print shows pppoe-out1 with the R (running) flag.

Step 4 · Read the status of the tube¶

A tunnel you cannot inspect is a tunnel you cannot repair. Learn to read it.

WinBox: double-click pppoe-out1 → Status tab; also IP → Addresses and IP → Routes.

/interface pppoe-client monitor pppoe-out1 once
/ip address print
/ip route print
/ip dns print

Expected (your numbers may differ):

         status: connected
   service-name: mtcnaclass
        ac-name: class-ap
            mtu: 1492
  local-address: 10.10.10.200
 remote-address: 10.10.10.1

#   ADDRESS           NETWORK        INTERFACE
2 D 10.10.10.200/32   10.10.10.1     pppoe-out1

DAv 0.0.0.0/0         pppoe-out1
DAc 10.10.10.1/32     pppoe-out1

dynamic-servers: 10.10.10.1 in /ip dns print is the DNS that came through the tube. The v flag on the default route means it was created by a VPN/tunnel client.

Done when the status is connected and you have an address from 10.10.10.100–10.10.10.200.

Step 5 · Test the Internet, from the router and from the laptop¶

The router being online is only half the job: a home router exists to put the laptops online.

/ping www.mikrotik.com count=3

# on pc1
curl -m 5 http://www.mikrotik.com/

The router pings fine. The laptop... waits five seconds and gives up. Why?

Look at the NAT rule: /ip firewall nat print. It says out-interface-list=WAN action=masquerade. Masquerade (Module 6) rewrites the laptop's private address 192.168.88.x into the router's public address on the way out. But the rule only applies to interfaces in the list WAN, and that list contains ether2, not the brand-new pppoe-out1. The laptop's packets leave through the tube with their private address, and the provider has no way to send the answer back.

WinBox: Interfaces → Interface List → +: List WAN, Interface pppoe-out1.

/interface list member add list=WAN interface=pppoe-out1

# on pc1, again
curl -m 5 http://www.mikrotik.com/

You get <h1>Welcome to the Internet</h1>.

Done when pc1 shows the "Welcome to the Internet" page.

Step 6 · Check your work, then put things back¶

Run the automatic check from the lab folder (on your Ubuntu PC):

CLAB_EXEC="docker exec" ./check.sh

Every line must say PASS. Then, as the course asks (slide 317), restore the previous configuration: disable the PPPoE client and enable the DHCP client again.

WinBox: PPP → Interface, disable pppoe-out1; IP → DHCP Client, enable the ether2 client.

/interface pppoe-client disable pppoe-out1
/ip dhcp-client enable [find interface=ether2]
/ip address print
/ping www.mikrotik.com count=2

The 10.0.0.x address comes back and the ping works again.

Done when the router is back on DHCP and online.

If something goes wrong¶

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

• A tunnel is a private path built inside another network: packets travel inside other packets (encapsulation), like capsules in a pneumatic tube.
• PPP gives a two-ended link authentication, address assignment and optional encryption; RouterOS uses it for PPPoE, PPTP, SSTP and more.
• PPPoE finds its server with a broadcast discovery (PADI, PADO, PADR, PADS) that needs no IP address, then logs in with a username and password.
• The client gets a /32 point-to-point address; the "network" is the far end of the tunnel, which is also the gateway.
• When the Internet moves into a tunnel interface, NAT and firewall rules must follow it: add pppoe-out1 to the list WAN.

Quick check¶

Next, you swap roles: in Lab 08-02 your router becomes the provider and your laptop has to log in to it.