PPPoE AC topology question - firewalling

[bugino]

Thank you for reply.

1. of course i have separate vlan for management. But this protect only our devices.
2. What about customer routers which they leave open wan access to management their own devices? What about customers radios - eg with terminated pppoe? I can change port or make firewall on customers devices.
3. I was adcived by mikrotik support to have PPPoE AC without connection tracking, firewall and NAT: Everything is due to problem i cannot go over 1.4k users on single one AC: PPPoE server on ccr1036 getting to 1,5k users: no ip in addresses, no route
   
   
   

But I would presume you are using a management VLAN for your radios etc, correct? So if your CCR1072 is doing the inter-VLAN routing between the customers and the management, you would have the firewall rule there to protect your management from the customers, wouldn’t you? Unless you aren’t using a management VLAN currently and are doing management on the customer subnet itself.

If your network topology is such that you are having to put bizarre workarounds like that in place for security purposes, your topology is probably not well thought out. In that case, you should fix the topology to make it more secure, and not resort to such strange workarounds.

If you really can’t fix the topology, I’m not entirely sure why you are wanting to avoid adding forward chain rules. You wouldn’t have to add very many, and it shouldn’t place much additional load on those PPPoE AC’s.