Fiber with PPPoE «logged-in Internet» to ETH1 + ETH2

RouterOS Beginner Basics
1

Hello All

I’m new to MikroTik and need help. I’ve a RB2011iLS-IN. Also i’ve a Fiber Connection based on PPPoE together with 5 fixed IPs. First one will be given out over DHCP for the one which is doing the PPPoE Logon.

I’ve heard that my thing which i want working should be possible with MikroTik. But because i’m new to MikroTik i’m need some help how to achieve this.

My goal is that the RB2011 is doing the PPPoE Login on the SFP Port. And put the «logged-in» Internet to ETH1-2. Port 5 for Management and Port 3, 4 and 6 to 10 we can disabled (don’t need them). So i can connect on Port 1 and 2 my Firewall Cluster which will use a static public IP. My Firewall Cluster can’t do a PPPoE Login when they are on HA/Cluster-Mode. That’s why i need todo the PPPoE Logon in front and put the “logged on” Internet to those 2 Ports.

Do you have any tipps how to resolve? Thanks!

2

PPPoE uses IPCP for address assignment, not DHCP. You mention you have 5 fixed IP addresses - presumably a /29 subnet?

You would connect to the ISP with some thing like:

/interface pppoe-client
add add-default-route=yes disabled=no interface=sfp1 name=pppoe-out password=*PASS* use-peer-dns=yes user=*NAME*

And create a bridge for the routed subnet:

/interface bridge
add name=bridge protocol-mode=none
/interface bridge port
add bridge=bridge interface=ether1
add bridge=bridge interface=ether2
/ip address
add address=*gatewayIP*/29 comment="routed subnet" interface=bridge

Replacing USER, PASS and gatewayIP with your values. Disable unnecessary services, and apply firewall rules as required (typically block pretty much everything from WAN in the input chain to prevent external access to the Mikrotik)

If you want a separate management interface, rather than accessing the Mikrotik on its public gateway address via the servers, add a private IP address to ether5. Depending on your setup you may need one or more of a DHCP server (if your managment client does not have a static address), a DNS server (if your managment client needs to resolve hostnames), a NAT masquerade rule (if your management client requires internet access)

3

Wuuhuu. Perfect. Thank you very much! It is working perfectly.