PPPoE (Telekom) on hAP ac2 with DrayTek Vigor 165 - looking for examplary config

RouterOS Beginner Basics
1

Hello,
I’m switching to a Telekom VDSL line (100down/40up) these days and I’m wondering if anyone could provide an exemplary config for MikroTik RouterBoard when used with a Draytek Modem (Vigor 165) in Bridge-Mode. So, a config for a PPPoE client is needed. My current configuration is still this http://forum.mikrotik.com/t/setup-with-vlans-guest-wifi-home-office-owners-network-lan-printer-via-bridge-plus-physical-switches/146303/1

Thanks to anyone who has an example! Hope I haven’t overseen anything in the forum.

2

Hey, if the DrayTek works as a bridge and you get packets with VLAN7-tag out of it, you should try this and change it to your config/IPs. This creates a virtual VLAN interface that listens for packets with VLAN7-tag on ether1 (I have such a config working with a Fritz!Box in bridge mode on plain DSL and since a couple of weeks also with a Telekom fibre line):

/interface vlan
add comment="Telekom VLAN-Tag" interface=ether1 name=vlan-ppp vlan-id=7

/interface pppoe-client
add disabled=no interface=vlan-ppp max-mru=1492 max-mtu=1492 name=pppoe-out1 \
    password=BB use-peer-dns=yes user=AA
    
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-out1 src-address=\
    192.168.178.0/24

/ip route
add comment="Telekom" distance=1 gateway=pppoe-out1

And then you should check the firewall rules, you can set rules for

in-interface=pppoe-out1

…

3

Hi Peter, typically (in general it should work with)

/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN

/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade” ipsec-policy=out,none
out-interface-list=WAN

The only thing I would quibble with in your setup is there is no need for source address in the masquerade rule.

4

Hi anav, you are right, thank you for the clarification. I am only a “prosumer” aka a consumer who wants to fiddle with his IT and learn from professionals :slight_smile:

That’s why I would never recommend firewall filter rules.

5

Thanks - it works, but slightly different from what you recommended. Hope that’s fine anyway, I just had a quick look and may double-check if any firewall rule is in conflict with the WAN VLAN (ID=7).


It works, but only if the PPPoE client ist set to interface=ether1:


/interface pppoe-client
add disabled=no interface=ether1 max-mru=1492 max-mtu=1492 name=pppoe-out1 \
    password=BB use-peer-dns=yes user=AA




The bridge was already in the LAN list and now both ether1 and PPPoE are in the WAN list. However, as described, I have to set interface=ether1 in the PPPoE client to be able to login via the Draytek.

6

Perfectly normal, for your case of pppoe.

7

Cool, thanks again

8

Good that it’s working now. I guess in this case the Draytek is removing the VLAN7 tag from the packets.