I was recently given an RB5009 as my current Ubiquiti device blows with PPPoE and fiber, and is dropping a considerable amount of performance. I was told to put the RB5009 in bridge mode and let it create the PPPoE connection, and then put the other router behind it in DHCP mode to let it get the IP and avoid double NAT shenanigans. I can successfully use the RB5009 in router mode and get a connection and get full 2,5G down, but once in bridge mode it will not forward the IP to the second router in DHCP mode. Been reading the docs and some other places on the internet that “supposedly”, mikrotik bridge mode is not a classic bridge mode, which to me sounds sus. What’s the correct way to get this work?
Again, setup is ONT → Rb50009 (bridge mode, handle PPPoE) → second router in DHCP (avoid double NAT) → clients/lan/rest of network
PPPoE can’t really be in bridge mode because bridge is L2 and PPPoE is L3. IP address is “integral part” of L3 interface, it can’t be “forwarded” elsewhere.
What usually “put in bridge mode” means is that that device is L2-transparrent … passing either DHCP handshake or PPOoE frames left and right. Any (dumb) ethernet switch does this perfectly.
The reason for popularity of “bridge mode” on ISP devices is that those often work with “weird” L1 technology on WAN side (e.g. xDSL, DOCSIS, GPON, etc.) which many “off the shelf” home routers can’t. So when put in bridge mode, those ISP devices act only as (large and expensive) media converters between “weird” L1 technology and UTP (where both sides transport normal ethernet frames as L2 protocol). ONT is a bit more than simple media converter, usually it also does authentication (I’m talking about simple ONT devices, some are ONT/router combo).
So I wonder what makes connection of “second router” directly to ONT impossible/impractical?
If you read the post you would have noticed I said the performance is awful and there is loss.
I was told to put another device in front of this router since it can’t handle the performance over PPPoE or to deal with it, I was given this RB5009 and told it could be bridged to handle the WAN and give it back to the second router behind it in DHCP mode and it would acquire the WAN. Even Ubuiqiti support told me to put the router in DHCP and put another router in front of it to be the main PPPoE interface.
If you’re telling me that’s not possible then I will gladly give this device back since I’m not ready to ditch my entire Unifi system just yet, I was testing a potential stop gap.
What you need to figure out or tell us, is what is the internet signal coming from?
Does the ISP provide a modem or ONT, from which an ethernet cable is used to connection to the RB5009?
If so, then the RB5009 can do everything you need and you should throw the second router into the garbage, (or use it as a back up )
To answer everyone’s question, because I’ve had a dream machine pro for the last 4-5 years and now that I upgraded from gigabit to 2,5, the pppoe performance is awful leaving a gigabit on the table in loss (~40%). Before I gave up on Ubiquiti completely, I got hold of an Rb5009 and was told I could put it in bridge, setup pppoe and with the dream machine pro in DHCP mode it would acquire the IP from the mikrotik and avoid the performance issues. I have a large unifi environment, including LTE failover, and at the moment I can’t replace everything and budget this upgrade/switch until the summer, so I was trying to guinea pig this setup into holding me over until I make a decision.
You only need ISP/ONT ↔ (PPPoE) Rb50009 ↔ LAN (unless the ‘second router’ has a magical feature set you can’t live without). The Rb50009 will manage both PPP and DHCP.
I think TheWeegee is asking for a way to offload only the pppoe stuff to the RB5009 and than pass through the public ip by dhcp to the UDM. The UDM should stay because his whole network is build around Unifi.
I think this should be possible with two VRF instances and two mangle rules.
This is the closest I’ve managed to get it to work, PPPoE is up but once I do this ping timeouts all the time saying no route to host, and while it says my public ISP IP is bound to my UDM and “working”, the DHCP for server-lan is red and I have no traffic activity in interfaces for the SFP port which I’m using instead of ether2. What you described makes sense, I guess I’ve been accustomed to easy-mode with GUIs for far too long.
Also i missed something in the last post. You need to also add a route to your public ip in the “vrf-lan” instance.
add dst-address= gateway=ether2@vrf-lan routing-table=vrf-lan
This should work. 100.64.0.24 is the public ip in this example.
A red marked dhcp server usually means that the dhcp server interface is on a slave port, e.g. form a bridge, or the port is disabled.
A problem that could also occur is, if you have a dynamic IPv4 address via pppoe because the the dhcp lease will not automatically change. But this could be easily solved with scripting.
But there is. You just have to go to PPP → Profiles, and make a new one (or a copy of default). In the profile you can put your On Up/On Down scripts. Next step is to edit the pppoe-out interface to use the new profie.
Yeah for a Windows 10 client this shoud be fine but for a router i would specify a public dns resolver manuell on the pass through device. Cascading dns resolvers with there own cache is a bad idea in my opinion.
I think this should do the trick. passMACAddress can be empty. Then the first device asking for an ip will get the public ip. Change to the /ip/dhcp/network, for example to the dns server, are persistent.
That works thanks. Ironically this proved either the UDM itself is a hunk of junk or mine being a first day one is a hunk of junk as htop paints a grim picture with CPU usage even in DHCP mode. I will admit I did not give this the time and energy it deserved and could have figure that out myself, my head has been full steam ahead in dealing with a non IT related issue so I did not give this setup much love over the last few weeks.
What makes sense to me is the following
RB5009 terminates the PPPOE connection
RB5009 creates private subnet to send to UDM ( and thus we have WAN2 for UDM )
RB5009 via vlan100 marks the fiber traffic and simply passes it to the USG for termination aka WAN1 for the UDM
What is unknown to me, is
what can this second router handle as incoming.
how many ethernet cables are located between the two routers.
Clearly it would be easier to be able to use different ports on both devices for this transfer (clean).
5009
ether1 - pppoe termination
ether2 - capture fiber output (riding on vlan100 lets say)
ether3 - pass private subnet to USG ( WAN2 for UDM)
ether4 - pass vlan100 to UDM
ether5 - LAN (source pppoe connection)
ether6 - etc…
UDM
ether1 - incoming vlan100 for termination of fiber output
ether2 - incoming WAN 2 private IP from 5009
ether3 - LAN
ether4 - LAN
I am not sure of why we need to complicate matters and use vrf or mangles for that matter if the OP is happy with having two WANs available to UDM and the one pppoe wan available to the 5009 ( and by private IP also WAN2 to the uDM).
