PPPoE with one DHCP AP

RouterOS Beginner Basics
1

Hi,
I run a small WISP. I’ve been using a Mikrotik router with Canopy equipment. The Canopy APs connect to a switch which connects to a port on the Mikrotik which is set up as a PPPoE server. Clients CPEs or routers can login with PPPoE and get access - all this is working fine. I’ve recently gotten a new type of AP that I want to add to the system. This one wants to get a DHCP address so it can access the internet for management purposes. Once it does that, it becomes a transparent bridge. I want the CPEs connected to it to be able to get to the PPPoE server and I don’t want any other device to be able to use the DHCP server. I set up both servers on a single port and I can get it to work, but I have 2 problems:

  1. I’d like to have them on separate ports so only the new AP is connected to the DHCP server port and it doesn’t go to the switch. This means (I think) that I have to bridge the PPPoE port and the DHCP ports at the Mikrotik, but I haven’t been able to get this to work.

  2. If the PPPoE and DHCP servers are on the same port, I can’t figure out the best way to make sure only the new AP can get an address and use that connection. I thought about using a pool with only one address, but clients can still hardcode addresses. Maybe change the port to ARP reply only?

Thanks for any help.
Ryan

2

Hi,
PPPoE can configure on multiple interface. You can use another ethernet for your new AP. Configure DHCP server & PPPoE on that interface. No need to configure bridge.You can configure static only DHCP & bind AP’s mac address so that only AP can get IP address from DHCP.

3

Hi,
Great idea - and it works just fine, thanks! With one exception - if I hard code a client address to be an address in the DHCP network (or even the one that I statically assign), I get access. Is there something I can do to the NAT masquerade rule to limit access to the MAC address of my AP?

Thanks,
Ryan

4

No, NAT or filter can’t protect to access AP. You can protect internet access using NAT or filter.