RB5009UG+S+ - Zyxel SFP GPON Module not working

RouterOS Beginner Basics
1

Hey there,

I’m new to mikrotik and I really need your help because I don’t know how to proceed. I am trying to install a PMG3000-D20B SFP GPON-Module in my RB5009UG+S+ Router. The Module is active, but not running, and obviously it hasn’t established a link. I can see the Vendor Name and the Vendor Part Number. But I don’t see any traffic, besides one outgoing package per second. I created a Vlan with VLAN-ID 1 following my ISP rules. My ISP uses DHCP and not PPPoe. I connected my module with a SC-APC cable. The Module should be reachable via 10.10.1.1 to configure it. I added IP 10.10.1.2/24 to the sfp-port, but I can’t access the Module via 10.10.1.1, which is my main problem atm.

I already tried to set the ethernet speed manually to 1G baseX, with flow control disabled, but no luck so far.

Any help would be appreciated. Thanks in advance!

Here is my config (with auto-negotiation and flow control enabled):

2026-03-17 16:49:31 by RouterOS 7.22

software id = CX9A-2XHL

model = RB5009UG+S+

serial number = HKB0AKMC7B4

/interface bridge
add admin-mac=04:F4:1C:B2:C9:47 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] l2mtu=1500
set [ find default-name=ether2 ] l2mtu=1500
set [ find default-name=ether3 ] l2mtu=1500
set [ find default-name=ether4 ] l2mtu=1500
set [ find default-name=ether5 ] l2mtu=1500
set [ find default-name=ether6 ] l2mtu=1500
set [ find default-name=ether7 ] l2mtu=1500
set [ find default-name=ether8 ] l2mtu=1500
set [ find default-name=sfp-sfpplus1 ] l2mtu=1500 rx-flow-control=auto 
tx-flow-control=auto
/interface vlan

MTU > L2MTU

add interface=sfp-sfpplus1 name=sfp-sfpplus vlan-id=1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=1d name=defconf
/system script
add comment="Change Mode Properties" dont-require-permissions=no name=
"Change Mode Properties" owner=admin policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=
"system/device-mode/update mode=home scheduler=yes"
add comment=AutoReboot dont-require-permissions=no name=AutoReboot owner=
admin policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="#
_------------------- header --------------------
\n# Script by Ricardo Franzen - rfranzengmail.com
\n# If you use this script, or edit and
\n# re-use it, please keep the header intact.
\n# Description: script to auto-upgrade routerboard
\n# Tested on: routeros v6.35
\n# ------------------- header --------------------
\n
\n:if ([/system routerboard get current-firmware] != [/system routerboard 
get upgrade-firmware] ) do={
\n    :log warning "Upgrade routerboard from $[/system routerboard get c
urrent-firmware] to $[/system routerboard get upgrade-firmware]";
\n
\n    /system routerboard upgrade
\n    :delay 300s;
\n    /system reboot
\n}"
add comment=AutoUpdate dont-require-permissions=no name=AutoUpdate owner=
admin policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/
system package update
\ncheck-for-updates once
\n:delay 3s;
\n:if ( [get status] = "New version is available") do={ install }"
add comment=AutoBackup dont-require-permissions=no name=AutoBackup owner=
admin policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=
"/system backup save"
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment="WAN Change" interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
/ip neighbor discovery-settings
set discover-interface-list=all lldp-mac-phy-config=yes lldp-max-frame-size=
yes lldp-vlan-info=yes
/interface detect-internet
set detect-interface-list=all internet-interface-list=all lan-interface-list=
all wan-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment="WAN Change" interface=ether8 list=WAN
add comment="WAN Change" interface=sfp-sfpplus1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
add address=10.10.1.2/24 interface=sfp-sfpplus1 network=10.10.1.0
/ip dhcp-client
add comment="WAN Change" default-route-tables=main interface=ether8 name=
ether8

Interface not active

add comment="WAN Change" default-route-tables=main interface=sfp-sfpplus1 
name=sfp-sfpplus1
/ip dhcp-server network
add address=10.10.1.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
/ip dns
set address-list-extra-time=10s allow-remote-requests=yes doh-timeout=15s 
servers=1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001 
use-doh-server=https://dns.cloudflare.com/dns-query verify-doh-cert=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
add address=1.1.1.1 name=1.1.1.1 type=A
add address=1.0.0.1 name=1.1.1.1 type=A
add address=2606:4700:4700::1111 name=1.1.1.1 type=AAAA
add address=2606:4700:4700::1001 name=1.1.1.1 type=AAAA
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" 
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" 
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" 
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" 
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" 
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat 
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" 
ipsec-policy=out,none out-interface-list=WAN
add action=redirect chain=dstnat dst-port=53 protocol=tcp
add action=redirect chain=dstnat dst-port=53 protocol=udp
add action=masquerade chain=srcnat dst-address=10.10.1.1 protocol=tcp
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" 
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" 
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" 
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" 
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/system clock
set time-zone-name=Europe/Berlin
/system leds
set 0 disabled=yes
/system leds settings
set all-leds-off=after-1min
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.de.pool.ntp.org
add address=1.de.pool.ntp.org
add address=2.de.pool.ntp.org
add address=3.de.pool.ntp.org
/system routerboard settings
set auto-upgrade=yes
/system scheduler
add comment=AutoUpdate interval=1d name=AutoUpdate on-event=
"/system/script/run AutoUpdate;" policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon 
start-date=2026-01-08 start-time=03:00:00
add comment=AutoBackup interval=1d name=AutoBackup on-event=
"/system/script/run AutoBackup;" policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon 
start-date=2026-01-08 start-time=02:00:00
add comment=AutoReboot interval=1d name=AutoReboot on-event=
"/system/script/run AutoReboot;" policy=
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon 
start-date=2026-01-16 start-time=04:00:00
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Interface monitor:

name: sfp-sfpplus1
status: no-link
auto-negotiation: disabled
supported: 10M-baseT-half
10M-baseT-full
100M-baseT-half
100M-baseT-full
1G-baseT-half
1G-baseT-full
1G-baseX
2.5G-baseT
2.5G-baseX
5G-baseT
10G-baseT
10G-baseSR-LR
10G-baseCR
sfp-supported: 1G-baseX
sfp-module-present: yes
sfp-rx-loss: yes
sfp-tx-fault: no
sfp-type: SFP/SFP+/SFP28/SFP56
sfp-connector-type: SC
sfp-encoding: nrz
sfp-link-length-sm: 20km
sfp-vendor-name: ZYXEL
sfp-vendor-part-number: PMG3000-D20B
sfp-vendor-revision: V1.0
sfp-vendor-serial: S234105500431
sfp-manufacturing-date: 15-05-25
sfp-wavelength: 1310nm
sfp-temperature: 56C
sfp-supply-voltage: 3.3V
sfp-tx-bias-current: 20mA
sfp-tx-power: 3.01dBm
sfp-rx-power: -8.085dBm
eeprom-checksum: good

2

This is unnecessary:

add address=10.10.1.0/24 dns-server=192.168.88.1 gateway=192.168.88.1

And this command:

add action=masquerade chain=srcnat dst-address=10.10.1.1 protocol=tcp

Should be like this: add action=masquerade chain=srcnat dst-address=10.10.1.1 out-interface=sfp-sfpplus1

After this, check with ping from Mikrotik if the module responds to ping or not.

3

I would recommend you remove all the l2mtu's.
You almost always need more than 1500. The defaults are usually ok.

I would be very careful about auto upgrade scripts, especially initially.
My thought is that it would need to check the current new update is at least a couple of weeks old before even considering upgrading to it.

Unless you need it turn off the smb.

It is usually recommended to turn off Detect internet. (Often causes grief) Set all items to none.

I would probably attempt to remove or disable the /interface vlan 1 entry.
(vlan 1, usually means no vlan required, your case might be different)

You could perhaps enable ignore rx loss on the sfp+ interface and see if that helps.

4

That is very suspicious. Try to find out if there is other information that confirms this, I would not expect an ISP to require VLAN 1 as a tagged VLAN, that is just asking for confusion and/or trouble.

It should either be a different VLAN (like 7 or 132) or no VLAN at all (some people would call that “VLAN 1” but this is not what you get with the above configuration).

5

Having just played with an XGS-pon on my MT, I am a bit familiar.

As noted, unless the ISP states you need a vlan of specific number, (1) to means no vlan is required otherwise you have a typo. Who is your ISP??

So typically its 35 for DHCP in many places for example.
We create vlan35, and it becomes the interface we put in IP DHCP client.
We add vlan35 to the interface list for WAN.

Typically the GPON has its own address and its damn difficult to access.
I gained success by creating a vlan for that subnet, lets say 10.10.1.1 is the address of the GPON.
The other thing you will need is a place to access the subnet.

SO take a port on the 5009, or if you have a switch downstream like me then create the vlan also going to the other switch and dedicate a port on that switch for that subnet that you can easily plug in your PC (and you wont have to go to the router to access the gpon). I have both setup.
and so I create…..
/interface vlan
add interface=bridge vlan=gponVLAN vlan-id=100
/ip address
add address=10.10.1.2/24 interface=vlan100 network=10.10.1.0

+++++++++++++++++++++++++++++++++++++++++

/interface bridge ports ( lets say sfp+1 is the wan port with gpon )
add bridge=bridge frame-types=admit-all interface=sfp+1 pvid=100
(optional)
add bridge=bridge frame-types=admit-only-priority-and-untagged interface=PortOn5009 pvid=100

/interface bridge vlan
add bridge=bridge tagged=bridge untagged=sfp+1,PortOn5009 vlan-ids=100
OR
add bridge=bridge tagged=bridge,DownStreamSwitch untagged=sfp+1 vlan-ids=100
OR BOTH
add bridge=bridge tagged=bridge,DownStreamSwitch untagged=sfp+1,PortOn5009 vlan-ids=100

+++++++++++++++++++++++++++++++

In summary I was unable to access the GPON from any other subnet, I had to be within the same subnet and that can be done from a port on the router untagged to the subnet OR, a downstream port untagged to the subnet, preferably from a switch where you can easily plug in your PC.

6

You only need a masquerade rule. You don't even need to add an explicit rule if your firewall is based on defconf, just add your gponVLAN to the WAN interface list. This put the GPON on the WAN side, and also protects your LAN, preventing the GPON module from accessing your LAN, in case that module has any kind of spyware :D.

Here is my interface list definition:

image
image659×249 7.18 KB

image
image353×247 4.85 KB

I can then give some other exceptions to the GPON list (to let IPTV multicast through). And use 192.168.2.10 from any allowed subnets to access the module configuration page.

You can see that OP also has his masquerade rule, @magicc12 post as well also mention the masquerade rule.

7

Awesome, safer is always better.

But why the structure 192.168.2.2 and network 192.168.2.10 ?? what does that accomplish??

so the vlan is not attached to the bridge, but directly to the interface ???

8

My SFP stick is at the address 192.168.2.10. I assign address=192.168.2.2/32 network=192.168.2.10 to the VLAN interface. As a result a single route dst-address=192.168.2.10/32 is created in the routing table, and the router uses 192.168.2.2 as source address when talking to the module (and with the masquerade rule, my PC at 10.x.y.z can also talk to the module using 192.168.2.10 directly.

The created route with destination 192.168.2.10/32 is enough. If I use the address=192.168.2.2/24 network=192.168.2.0 assignment then the created route has dst-address=192.168.2.0/24 which has 250+ destination addresses that I don't need.

In my config the vlan1000 is attached to the bridge (all ports of this RB5009 are on the same bridge)

image
image513×136 2.94 KB

But the same thing works on my other router that uses an external GPON converter plugged to ether1

image
image589×457 9.14 KB

I manage the converter by going to 192.168.20.1 from my 10.x.y.z networks.

9

Okay so the vlan is tagged to the bridge and untagged to the gpon port?
still no joy following your method.

10

Yes:

image
image408×245 4.85 KB

image
image467×512 8.17 KB

The RB5009 is a good candidate for this because it has L2 HW offload with Bridge VLAN Filtering for all ports (all ports attached to same switch chip). It would not be preferable to do that with devices that has one port out of the switch chip and attached to the CPU like hEX refresh or L009.

11

Hmm my gpon address is 192.168.11.1

So for address for the vlan I have used 192.168.11.2 with network of 192.168.11.10 is that wrong?

should be 192.168.11.0 or 192.168.11.1

12

If you want to have only a /32 route created then you put in network the address of the destination device, in this case address=192.168.11.2/32 network=192.168.11.1.

You will then see a route with dst-address=192.168.11.1/32 in the routing table.

The same thing happens with /24 address assignment. The route created has the destination made of network + /prefix_lengh_assigned_to_address.

So address=192.168.11.2/24 network=192.168.11.0 produces route with destination 192.168.11.0/24.

13

right I see that after trying it, but still no access hmmmm?

14

Make sure the SRCNAT masquerade is working for out-interface=gponVLAN (or if you use defconf then put it in WAN list).

15

SUCCESS, forgot to rejig my bridge port for pon port, back to frametypes admit all and put pvid 111 back in. Once done, in like butta

Now does this allow ANY device access to the gpon??? Me thinks we need something like
add chain=forward action=drop dst-address=192.168.11.2 src-address-list=!admin

16

Yes, you need firewall rules, that's why I have that GPON interface list (which is part of WAN only to reuse the masquerade rule), and have other restrictions on accessing that GPON list.

image
image332×222 5.09 KB

17

Interesting I have never seen or used the interface list name restricted………

How does that work exactly, does that mean anybody on the LAN interface list cannot access GPON and GPON cannot access anybody on LAN ( at layer 3)???

If so seems better because I prefer allow rules so one would need an accept rule, in the forward chain, for the admin list.

18

Ha ha, I am using the reverse of what you normally advise on the forum (which is to explicitly allow traffic then having a drop all rule, and what you recommend is totally correct and legit). I have explicit drop rules. So that RESTRICTED list contains destination interfaces (out-interface-list=RESTRICTED) for the drop rules. LAN contains all VLAN interfaces as well as some VPN interfaces for example. Only a couple of in-interface have the ability to make connection to interfaces in that RESTRICTED list.

GPON being part of WAN is already blocked from accessing almost everything (the default defconf drop rule can already do that).

19

Haha too funny.

By pigeon holing me into putting my gpon access as a WAN interface list device, then all users can put in the IP address of it and the router will think its normal LAN to WAN traffic and be allowed (bend over).

Considering everything, I think I will do it this way.
Change GPON back to LAN interface ( more accurate in my estimation anyway) and since I have a different list for internet access, it wont get that, nor DNS access.
Make a separate SRCNAT rule for GPON, reasonable since identifying its freakishness is fine with me.
Since I have a drop rule, any gpon outgoing traffic is not going anywhere soon.
Since my admin can already access all LAN devices good to go.

20

sfp-rx-loss: yes

Your gpon will not answer ethernet with this. Tick that box Ignore Rx LOS and give it a few minutes for the GPON to boot. Don’t ask me how I know.