Pseudo-PPPoE: Authentication via MAC Address

RouterOS General
1

Hi,

My ISP is currently in the early phases of implementing PPPoE. However we would like to do a bit of a pseudo-PPPoE apporach and have authentication via MAC Addresses.

The user tries to connect to the internet.
The radio sends a packet with a MAC address to the Mikrotik box
The Mikrotik box asks freeRADIUS if the MAC address is valid
freeRADIUS responds yes or no
The customer is granted or denied internet access

Is this possible to do? I have looked around and it seems that it can be done with hotspots, via Wireless → Security Profiles, but is it possible to do that with PPoE(ish) setup on the Mikrotik box?

Another question, while I’m at it: is it possible that freeRADIUS can have a database of MAC addresses, available to all Mikrotik routers in the field, but only certain Mikrotik boxes can authenticate certain MAC addresses? For example, a user on one leg authenticates using his own MAC address, but if that MAC address tries to authenticate on another leg it gets booted. Is this possible (if so, how?)

Thanks for your time and help.

  • GPAC
2

You could do that using hotspot (which can work on ethernet, too!) and configuring it to use the MAC address for authentication against a RADIUS server. I think there are examples in the forum for creating such a config.

3

Thanks for the reply. If anyone knows of a newbie howto on that, I’d love to see it. The following post seems to be somewhat helpful, however the solution at the near-bottom of the thread is for someone who is in bridged-mode, which is something I’m trying to move away from.

http://forum.mikrotik.com/t/bandwidth-control-with-radius/14981/8