I do not think that op tunnels internet access through his pptp connection. I would just use a simple firewall rule to isolate his vpn connection from local lan: /ip firewall filter chain=forward action=drop src-address=10.0.0.0/24 dst-address=192.168.0.0/24 log=no log-prefix="" /ip firewa...