Lab 08-02 · PPPoE server: become the Internet provider¶

In Lab 08-01 your router logged in to the provider. Have you ever wondered what the provider's side looks like? Somewhere there is a machine with a list of every customer, a stack of free addresses, and a rule book that says what each customer gets.

Today that machine is your router. A hotel, a campus residence or a small village Internet provider does exactly this with a MikroTik: every room or house logs in with its own username, gets an address from a pool, and the owner can see who is connected right now and cut anyone off.

The pneumatic tube, seen from the station¶

In Lab 08-01 we imagined the network as a big public building, and a tunnel as a private pneumatic tube inside it: your packets travel in a capsule from one end to the other, and the corridors only see the capsule (that wrapping is called encapsulation).

Now you run the tube station. To open tubes for other people you need four things:

IP pool: the rack of addresses¶

An IP pool is a named range of addresses that RouterOS services hand out automatically.

DHCP servers, PPP servers and HotSpot all take their addresses from pools (slide 318). You already used one in Module 4 for DHCP. Here the pool pppoe-pool holds 10.88.0.10–10.88.0.50: 41 addresses for 41 simultaneous customers.

PPP profile: the rule card¶

A PPP profile is a set of settings applied to every client that uses it: the server's own tunnel address, which pool to take client addresses from, DNS, encryption...

Writing the rules once in a profile and pointing many users at it is much easier than configuring each user (slide 320). The important fields:

All tubes share the same local address 10.88.0.1. That is fine: with point-to-point addresses each tube is a separate /32 link with only two ends, so there is no subnet to clash (slides 327–328).

PPP secret: the guest list¶

A PPP secret is one entry in the router's local user database: a username, a password, the profile to use and, optionally, settings for that user only.

If a secret sets something that the profile also sets (for example a fixed remote address for one VIP customer), the secret wins (slide 322). In this lab there is one secret: student / mtcnalab. Its service stays any, so the same account will also work for PPTP and SSTP in Lab 08-03.

PPPoE server: the door¶

The PPPoE server (the access concentrator) listens on one interface for PPPoE discovery and opens a session for every client that logs in correctly.

Two rules from slide 324:

• It cannot run on an interface that is a bridge port. A bridge port is no longer an independent interface: the bridge owns its traffic. Either take the port out of the bridge, or run the server on the bridge itself.
• For security, that interface should not have an IP address. Then the only way in is to log in: someone who plugs in a cable and just sets an IP by hand gets nothing.

Authentication is how the client proves its password. Use MS-CHAPv2 (mschap2): PAP sends the password as plain text, and MPPE encryption only works with MS-CHAP.

The scenario¶

Your laptop pc1 is plugged into ether5 of your router. At the start ether5 is an ordinary LAN port in bridge1, so the laptop gets 192.168.88.x by DHCP. In the lab you turn ether5 into a PPPoE "door" (in class you would move the laptop's cable to the PPPoE port; here the cable already sits in the right place).

flowchart LR
    INET["<b>internet</b><br>198.51.100.10"]
    AP["<b>class-ap</b><br>10.0.0.1<br>class gateway"]
    subgraph R1["r1 · your router = the provider"]
        WAN["ether2 · WAN<br>DHCP 10.0.0.x"]
        BR["bridge1<br>192.168.88.1/24<br>ether3, ether4"]
        E5["ether5 · no IP<br><b>PPPoE server 'mtcna'</b><br>tube end 10.88.0.1"]
    end
    PC1["<b>pc1</b> · your laptop<br>pppd: user student<br>gets 10.88.0.x/32"]
    INET --- AP
    AP ---|"10.0.0.0/24"| WAN
    E5 ===|"PPPoE tube"| PC1

On a real hAP the Internet port is ether1; in the virtual lab ether1 is reserved for the lab itself, so the Internet port is ether2 and the LAN ports start at ether3.

Start the lab¶

Download the lab files and unzip them: 08-02-pppoe-server.zip. Open a terminal inside the 08-02-pppoe-server folder.

sudo containerlab deploy -t topology.clab.yml

Wait about a minute for RouterOS, then:

ssh admin@clab-mtcna-08-02-r1                  # your router, password: admin
docker exec -it clab-mtcna-08-02-pc1 bash      # your laptop

Step 1 · Free ether5 from the bridge¶

The door must be an independent interface with no address. Check both conditions, then take ether5 out of the bridge (slide 329; in RouterOS v6 this was "master port: none", in v7 it is a bridge port).

WinBox: Bridge → Ports, select ether5, click − (remove). Check IP → Addresses.

/interface bridge port print
/interface bridge port remove [find interface=ether5]
/interface bridge port print
/ip address print where interface=ether5

ether5 no longer appears among the ports, and it has no address. On the laptop, the old connection is now dead:

# on pc1
ping -c 2 -W 2 192.168.88.1

100% packet loss: the laptop is now on a port that only speaks PPPoE, and nothing is listening yet.

Done when ether5 is not a bridge port and has no IP address.

Step 2 · Create the pool and the profile¶

First the rack of addresses, then the rule card that uses it.

WinBox: IP → Pool → +: Name pppoe-pool, Addresses 10.88.0.10-10.88.0.50. Then PPP → Profiles → +: Name pppoe-profile, Local Address 10.88.0.1, Remote Address pppoe-pool, DNS Server 10.88.0.1, Protocols tab: Use Encryption yes; General tab: Interface List LAN.

/ip pool add name=pppoe-pool ranges=10.88.0.10-10.88.0.50
/ppp profile add name=pppoe-profile local-address=10.88.0.1 remote-address=pppoe-pool \
    dns-server=10.88.0.1 use-encryption=yes interface-list=LAN
/ppp profile print detail where name=pppoe-profile

Done when the profile shows local-address=10.88.0.1 remote-address=pppoe-pool and interface-list=LAN.

Step 3 · Add the secret (the guest list)¶

WinBox: PPP → Secrets → +: Name student, Password mtcnalab, Service any, Profile pppoe-profile.

/ppp secret add name=student password=mtcnalab profile=pppoe-profile
/ppp secret print

Done when the secret student is listed with the profile pppoe-profile.

Step 4 · Open the door: the PPPoE server¶

WinBox: PPP → PPPoE Servers → +: Service Name mtcna, Interface ether5, Default Profile pppoe-profile, One Session Per Host ticked, Authentication: only mschap2.

/interface pppoe-server server add service-name=mtcna interface=ether5 \
    default-profile=pppoe-profile authentication=mschap2 one-session-per-host=yes disabled=no
/interface pppoe-server server print

One session per host stops the same laptop (same MAC address) from opening two tubes at once.

Done when the server is listed without the X (disabled) flag.

Step 5 · Dial in from the laptop¶

Linux has a PPPoE client: pppd (the PPP daemon) with its pppoe.so plugin. First, forget the old DHCP address and look for the door:

# on pc1
dhclient -r eth1
ip addr flush dev eth1
pppoe-discovery -I eth1

Access-Concentrator: r1
Service-Name: mtcna

Now write a small peer file (the client's settings) and dial:

cat > /etc/ppp/peers/mtcna <<'EOF'
plugin pppoe.so
nic-eth1
rp_pppoe_service mtcna
user "student"
password "mtcnalab"
noauth
defaultroute
usepeerdns
persist
EOF
pppd call mtcna
sleep 5
ip -4 addr show ppp0
ip route

Expected:

ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492
    inet 10.88.0.50 peer 10.88.0.1/32 scope global ppp0
default dev ppp0 scope link

noauth means "I do not ask the server to prove who it is"; defaultroute and usepeerdns are the Linux twins of RouterOS's add-default-route and use-peer-dns. pppd stores the announced DNS in /etc/ppp/resolv.conf; copy it so the laptop uses it, then test:

cp /etc/ppp/resolv.conf /etc/resolv.conf
dig +short www.mikrotik.com
curl -m 5 http://www.mikrotik.com/

You get 198.51.100.10 and <h1>Welcome to the Internet</h1>. Your laptop reaches the Internet through your tube, and your router masquerades it out of ether2 like any LAN device.

Done when pc1 has a 10.88.0.x address on ppp0 and the web page loads by name.

Step 6 · Watch your customers¶

A provider must see who is online. In class you would also connect with MAC WinBox (Module 1) from the laptop to watch this live.

WinBox: PPP → Active Connections; Interfaces shows the dynamic <pppoe-student>; Interfaces → Interface List shows it inside LAN.

/ppp active print
/interface print where type=pppoe-in
/interface list member print

# NAME     SERVICE  CALLER-ID          ADDRESS     UPTIME
0 student  pppoe    AA:C1:AB:DC:26:43  10.88.0.50  1m2s

CALLER-ID is the laptop's MAC address, because PPPoE works on Ethernet.

Now run the automatic check from the lab folder on your Ubuntu PC; every line must say PASS:

CLAB_EXEC="docker exec" ./check.sh

Done when you see student in the active connections and check.sh passes.

Step 7 · Hang up and put things back¶

The course ends by disconnecting and moving the laptop back to its usual port (slide 331). Hang up from the laptop, and watch the session disappear on the router:

# on pc1
poff mtcna

/ppp active print

The list is empty. To kick a customer from the router side instead: PPP → Active Connections → −, or /ppp active remove [find name=student] (with persist, pppd dials again a few seconds later).

Keep the pool, profile and secret: Lab 08-03 reuses them. On a real router you would now put ether5 back in the bridge (/interface bridge port add bridge=bridge1 interface=ether5) and the laptop would get its 192.168.88.x address again.

Done when /ppp active print is empty.

If something goes wrong¶

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

• A PPP server is four pieces: an IP pool (addresses), a PPP profile (shared rules), PPP secrets (users) and the server itself on one interface.
• A secret overrides its profile: the profile is the default, the secret is the exception.
• The PPPoE server cannot run on a bridge port, and its interface should carry no IP address, so logging in is the only way in.
• Every client tube becomes a dynamic interface (<pppoe-student>); put it in the right interface list or the firewall will treat it as a stranger.
• PPP → Active Connections shows who is online (name, MAC as caller-id, address, uptime) and lets you disconnect them.

Quick check¶

Next, in Lab 08-03 you reuse this pool, profile and secret to build tunnels between two routers across the network, with PPTP and SSTP.