I have a high site consisting of routerboard 600 and 3 WLAN interfaces which feed 3 sector antennas to which my clients connect.

The high site also has one backbone interface.

Each of the WLAN interfaces has a PPPoE server running on it with no IP address assigned to the WLAN interfaces for security reasons, only the backhaul interface has an IP address assigned to it.

The client routers dial into the PPPoE servers on their respective sectors which issue IP address and get internet access in this way.

I would like to expand my service and would like to offer VPN services as well.

What would be the best and most flexible method to enable a VPN service on my high site, taking into account that the only authentication method I currently use is PPPoE?