block anything else but PPPoE connection

hello
i have a router board with public interface and private one
on the private i configured PPPoE server ..
the PPPoE connections works fine my issue is when i put an IP address manually on my laptop connected to the PPPoE interface i get internet without having to authenticate and terminate a PPPoE session …
we are running an WISP so that’s an issue if a customer changed his router configuration i will have no control on the speed or the amount of bandwidth he can use …
how can i make the only allowed internet access is through PPPoE connection only ?? …

You mix something…


“/export compact” of the pppoe-server and of the pppoe-client.

thank you for your help..
but i did not understand the solution
can you explain more please ??

Put the private interface like ether1 and the pppoe server in a bridge and set Bridge-Filter.

/interface bridge filter
add chain=input in-interface=ether1 mac-protocol=pppoe-discovery
add chain=input in-interface=ether1 mac-protocol=pppoe
add action=drop chain=input in-interface=ether1