I have a Mikrotik Powerbox Pro connected to a few sectors. I have setup the Powerbox as a PPPoE server for my clients to authenticate and connect to the internet. On ether 2 to ether 5 I have sectors connected and configured the ports as PPPoE ports. How can I setup the Powerbox in order to access the web interface on the sectors?
I have a backhaul feeding the Powerbox. What I would like to achieve is to access the sectors over the backhaul for maintenance / monitoring purposes.
Going in to detail here is my setup: I have a RB3011 on my side which has IP 192.168.88.1. There is a backhaul connected to the RB3011 with the AP with IP 172.20.100.10 on my side and the station IP 172.20.100.11. I have setup a NAT rule with masquerade on the RB3011 so I can access the 172.20.100.0/24 range from the 192.168.88.0/24 range. The Powerbox has IP 172.20.100.14. I can access the backhaul and the Powerbox. The sectors have IP’s 172.20.100.15, 172.20.100.16, 172.20.100.17 and 172.20.100.18 which are connected to the Powerbox, but the ports are set as PPPoE ports. The sectors LAN and WLAN ports are setup in bridge mode. When the client connects from their CPE device the PPPoE server uses an IP pool depending on the package they signed up for (20MB, 30MB, 40MB, etc) The pool for these packages are as follow: 20MB - 192.168.20.10 - 192.168.20.250, 30MB - 192.168.30.10 - 192.168.30.250 and 40MB - 192.168.40.10 - 192.168.40.250. These PPPoE accounts have profiles assigned to them as well to set the rate limit for the package they signed up for.
I hope the information makes sense and I will appreciate any help as I have been searching the forums and did a Google search too with no luck.
There is nothing wrong about attaching an IP configuration to the same interface at which a PPPoE server is listening.
The thing is that you have to make sure that bare IP packets from customers’ devices (i.e. those not encapsulated inside the PPPoE ones) will not be let in to the Powerbox and the radios, or forwarded further to the network. This can be ensured e.g. using bridge filter rules on the radios, allowing only pppoe and pppoe-discovery frames to pass from the wireless interface to the Ethernet one. Or you can use a VLAN for the management and permit that VLAN only on the Ethernet port of the radios, not on the wireless port.