MikroTik PPPoE Client Setup and Troubleshooting (ISP Connection)

Problem

Your ISP gave you a PPPoE username and password, but the router has no Internet — or the session connects and some websites still do not load.

Symptoms

• The PPPoE interface never reaches the connected state.
• The log shows authentication failures.
• Small pages load but large downloads, HTTPS sites or VPNs stall.

Likely causes

• Wrong credentials, or the ISP has bound the account to the previous router's MAC address.
• The ISP expects PPPoE on a VLAN (common with fibre ONUs) and the client is on the untagged port.
• No default route or NAT after the session comes up.
• MTU/MSS mismatch: PPPoE adds 8 bytes of overhead, so 1500-byte packets do not fit.

Prerequisites

• PPPoE username and password from the ISP, and whether a VLAN ID is required.
• The WAN cable in the port you will use (this guide uses ether1). Remove any DHCP client on that port first.

Solution

1. Create the PPPoE client

In WinBox: PPP → Interface → + → PPPoE Client, choose ether1, enter the credentials and tick Add Default Route and Use Peer DNS. Or in the terminal:

/interface pppoe-client
add name=pppoe-out1 interface=ether1 user=YOUR_ISP_USER password=YOUR_ISP_PASSWORD add-default-route=yes use-peer-dns=yes disabled=no

If the ISP needs a VLAN, create it first and run PPPoE on the VLAN interface:

/interface vlan add name=vlan-wan vlan-id=100 interface=ether1
/interface pppoe-client set pppoe-out1 interface=vlan-wan

Use the VLAN ID your ISP gives you — 100 is only an example.

2. Masquerade LAN traffic out of the PPPoE interface

/ip firewall nat add chain=srcnat out-interface=pppoe-out1 action=masquerade comment="NAT to ISP"

3. Clamp TCP MSS to avoid MTU problems

/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn out-interface=pppoe-out1 action=change-mss new-mss=clamp-to-pmtu passthrough=yes comment="MSS clamp"

Verification

/interface pppoe-client monitor pppoe-out1 once
/ip address print where interface=pppoe-out1
/ip route print where dst-address=0.0.0.0/0
/ping 1.1.1.1 count=4

You should see a connected status, a public (or ISP-assigned) address on pppoe-out1, an active default route, and ping replies.

Common errors

• Stuck before authentication: no PPPoE server answered. Check the cable or ONU, and whether a VLAN is required.
• Authentication failed: re-type the password, then ask the ISP to clear any MAC binding.
• Connected, but no browsing: check the NAT rule and DNS (/ip dns print).
• Some sites hang: confirm the MSS clamp rule is counting packets.

For detailed logs while troubleshooting:

/system logging add topics=pppoe,debug action=memory
/log print where topics~"pppoe"

Remove the debug logging rule when you are done.

Rollback

/interface pppoe-client disable pppoe-out1

Re-enable your previous WAN method (for example the DHCP client) if you had one.