PPPoE Server

Configure PPPoE server with RADIUS authentication for subscriber broadband management.

~20 min · Intermediate

Overview

PPPoE (Point-to-Point Protocol over Ethernet) is the standard way ISPs deliver broadband to subscribers. Each customer gets a unique username/password, and the router authenticates them via RADIUS before granting internet access.

Vutia automates the entire PPPoE workflow: when you create a customer subscription, the system automatically creates RADIUS credentials, sets bandwidth limits, and provisions the PPPoE secret on the router.

Authentication flow

Customer CPE
Home router sends
PPPoE dial request
PPPoE
Your Router
MikroTik forwards
to RADIUS
RADIUS
Vutia RADIUS
Validates credentials
& sets speed limits
Accept
Connected
Session active with
bandwidth limits
RADIUS sends back
Mikrotik-Rate-Limit — download/upload speed
Session-Timeout — session duration
Framed-IP — assigned IP address

Prerequisites

  • Router connected — complete the Router Setup Guide first
  • Ethernet interface — the interface your customers connect to (e.g. ether2 or a bridge)
  • IP address pool — a range of IPs to assign to PPPoE clients

1. Setup PPPoE in dashboard

The one-click setup creates the PPPoE server, configures RADIUS, and sets up IP pools on your router.

Go to Network → Routers and click on your router
Click the "Setup PPPoE" button in the header
Fill in the configuration:
  • • PPPoE Interface — the interface customers connect to (e.g. ether2)
  • • Service Name — the PPPoE service name (e.g. internet)
  • • Address Pool — IP pool for clients (e.g. pppoe-pool)
  • • Local Address — gateway IP (e.g. 172.16.0.1)
  • • DNS Servers — DNS to push to clients (e.g. 8.8.8.8, 8.8.4.4)
Click Setup PPPoE — the system will automatically:
  • • Create the PPPoE server on your router
  • • Configure RADIUS authentication
  • • Set up IP address pools
  • • Create the PPPoE profile with bandwidth management

2. Create customer packages

Define the internet plans you offer to customers.

Go to Services → Packages
Click New Package
Set the package details:
  • • Name — e.g. "Home Basic 5Mbps"
  • • Type — select "PPPoE"
  • • Price — monthly rate
  • • Download/Upload Speed — bandwidth in Mbps
  • • Validity — typically 30 days

3. Add a customer subscription

When you create a subscription for a customer, the system automatically provisions everything.

Go to Customers and select (or create) a customer
In the customer's detail page, click Add Subscription
Select the Package and Router
The system generates a PPPoE username and password automatically
Activate the subscription — the system creates the RADIUS user and PPPoE secret on the router
Give the PPPoE credentials to your customer so they can configure their CPE (router/modem).

4. Customer CPE setup

Each customer needs to configure their home router (CPE) with PPPoE credentials.

MikroTik CPE

/interface pppoe-client add \
    name=pppoe-out1 \
    interface=ether1 \
    user=customer_username \
    password="customer_password" \
    add-default-route=yes \
    use-peer-dns=yes \
    disabled=no

Generic router

For non-MikroTik CPEs, guide customers to their router's WAN settings and select PPPoE as the connection type. Enter the username and password provided.

How RADIUS authentication works

When a customer's CPE initiates a PPPoE connection, here's what happens:

  1. 1. Customer CPE sends PPPoE connection request to your router
  2. 2. Your router forwards the credentials to the Vutia RADIUS server
  3. 3. RADIUS checks the username/password and subscription status
  4. 4. If valid, RADIUS sends back the bandwidth limits (Mikrotik-Rate-Limit attribute)
  5. 5. Your router creates the PPPoE session with the correct speed limit
  6. 6. Session accounting starts — usage data flows back to Vutia
Automatic enforcement: When a subscription expires or is suspended, the RADIUS server rejects new connections and can disconnect active sessions. No manual intervention needed.

Troubleshooting

Customer can't connect (authentication failure)
  • • Verify the subscription is active in the dashboard (not pending or expired)
  • • Check the PPPoE credentials match what's in the subscription
  • • Monitor RADIUS on the router: /radius monitor 0
  • • Check PPP active connections: /ppp active print
Customer connected but no internet
  • • Check if the customer got an IP: /ppp active print detail
  • • Verify the IP pool has available addresses
  • • Check DNS is being pushed to the client
  • • Verify NAT/masquerade is configured for the PPPoE interface
Speed limits not applied
  • • Check fast-track is disabled: /ip firewall filter print where action=fasttrack-connection — if enabled, fast-track bypasses queues and customers get unlimited speed. The platform disables this automatically during setup, but a router reset may re-enable it. Disable with: /ip firewall filter disable [find action=fasttrack-connection]
  • • Check the package has download/upload speeds configured
  • • Verify RADIUS is sending the Mikrotik-Rate-Limit attribute
  • • Check simple queues on the router: /queue simple print
  • • Try disconnecting and reconnecting the customer
Expired customers still connected
  • • The system checks for expiry periodically via scheduled jobs
  • • You can manually disconnect a user from the subscription page
  • • RADIUS will reject their next reconnection attempt after expiry
← Previous
Hotspot & Vouchers