I see.
Reset to factory defaults, then connect via Winbox by MAC address (important! You're going to remove IP addresses further down, so you MUST connect via MAC address). The below is all text format configuration, so click the Terminal button and copy/paste the commands in.
Then run this to clean up the default interface configuration:
/ip address remove [/ip address find]
/ip dhcp-client remove [/ip dhcp-client remove]
Then add your PPPoE client to ether1-gateway, this interface then plugs into your modem. Replace your username and password for the service:
/interface pppoe-client
add interface=ether1-gateway user=user password=passwd disabled=no add-default-route=yes use-peer-dns=yes name=pppoe-ether1
Then configure an IP address for your LAN, make the DNS caching resolver available, and configure a DHCP server for the LAN. This assumes a LAN of 192.168.0.0/24. Replace all references as required if you need different IP addressing:
/ip address
add address=192.168.0.1/24 interface=ether2-local-master
/ip dns
set allow-remote-requests=yes
/ip pool
add name=DHCP-Pool ranges=192.168.0.100-192.168.0.254 disabled=no
/ip dhcp-server network
add address=192.168.0.0/24 gateway=192.168.0.1 dns-server=192.168.0.1 disabled=no
/ip dhcp-server
add authoritative=yes disabled=no interface=ether2-local-master lease-time=1d address-pool=DHCP=Pool
And then finally configure NAT for the LAN network out the PPPoE interface:
/ip firewall nat
add chain=src-nat out-interface=pppoe-ether1 action=masquerade
Some firewalling is probably a good idea:
/ip firewall filter
add chain=input connection-state=established action=accept
add chain=input connection-state=related action=accept
add chain=input connection-state=invalid action=drop
add chain=input in-interface=ether2-local-master action=accept
add chain=input action=drop
add chain=forward connection-state=established action=accept
add chain=forward connection-state=related action=accept
add chain=forward connection-state=invalid action=drop
add chain=forward in-interface=ether2-local-master action=accept
add chain=forward action=drop
That should do it. If you need to forward ports for services available from the WAN, here an example of forwarding port tcp/80 to an inside machine at 192.168.0.10:
/ip firewall nat
add chain=dst-nat in-interface=pppoe-ether1 protocol=tcp dst-port=80 action=dstnat to-address=192.168.0.10
Then you also need to make a firewall rule permitting that traffic:
/ip firewall filter
add chain=forward protocol=tcp dst-port=80 dst-address=192.168.0.10 action=accept
And then move that rule above the default drop rule in the forward chain.
Hope that helps.
