Community discussions

MikroTik App
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Using PPPoE without a bridge

Mon Apr 20, 2015 12:06 pm

People say you can do PPPoE without a bridge ( the bridge causing slowdown ) on an RB, well I have tried and I can not make it work, even bought a new RB951-2HnD to play with, so I do not screw up my live stuff.

I have no trouble making it work with a bridge, I have multiple RB's all communicating with 2 Synchronised radius servers running free radius, MySQL and DaloRadius.

I am even looking at using NPS as a proxy radius server, so if anybody has any ideas along those lines that would help.

But primarily want get rid of bridge.

ZeroByte I have tried what you said to no avail.
 
User avatar
hossain2004a
Member Candidate
Member Candidate
Posts: 247
Joined: Mon Dec 22, 2014 7:34 pm
Location: Iran

Re: Using PPPoE without a bridge

Mon Apr 20, 2015 5:22 pm

I'm not PPPoE expert, but once I tried it in past just had to write some Route rules...
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: Using PPPoE without a bridge

Mon Apr 20, 2015 5:44 pm

You can PM me with your un-edited configuration.
(removing any passwords / private keys / etc. would be okay - just don't change any IP addresses / mac addresses / etc.)

/export compact
You can right-click the terminal window and choose "copy all"


Also - explain in general terms what your desired topology is. Do you have a physical network that you want the PPPoE users to become a part of? Do you have a range of IP addresses that is routed to the PPPoE server, and you simply want to make assignments from it like a pool? Do you want to assign "lan-side" small subnets to customers, who connect with PPPoE? (router ---> cust-router ---> /29 LAN) - in this last case, you don't even need any IP addresses on the PPPoE link itself!
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: Using PPPoE without a bridge

Mon Apr 20, 2015 7:21 pm

I'm not PPPoE expert, but once I tried it in past just had to write some Route rules...
I have just got it to work without a bridge on a test unit which has NAT on the WAN, but on a public routed system, I can not make it work.
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: Using PPPoE without a bridge

Mon Apr 20, 2015 7:56 pm

You can PM me with your un-edited configuration.
(removing any passwords / private keys / etc. would be okay - just don't change any IP addresses / mac addresses / etc.)

/export compact
You can right-click the terminal window and choose "copy all"


Also - explain in general terms what your desired topology is. Do you have a physical network that you want the PPPoE users to become a part of? Do you have a range of IP addresses that is routed to the PPPoE server, and you simply want to make assignments from it like a pool? Do you want to assign "lan-side" small subnets to customers, who connect with PPPoE? (router ---> cust-router ---> /29 LAN) - in this last case, you don't even need any IP addresses on the PPPoE link itself!

I have 200+ users on a Community Wireless Broadband Network and I have 2 ranges of public IP's that I would like to assign to users using PPPoE.

On the main Backhaul router's WAN connected to the internet I have *.*.137.6 MASK 255.255.255.224 which I think is /27 this is ISP specified, on the LAN side of the this router, I have a *.*.137.240 /28, range, ISP issued of which I have assigned *.*.137.241/28 to the LAN, 1 ( *.*.137.242 ) of the remaining 13 addresses is assigned to the WAN port of the router that I am trying to use as my PPPoE server, and route one of my other ranges through ( see below ), the other 12 are assigned to a second router which as NAT on the WAN, 2 of the remaining 12 addresses are port forwarded to mail servers, the rest are 1:1 NAT to customers routers.

I also have the following ranges to supply to customers routers, *.*.138.0 - 128 /25, 126 Useable IP's and *.*.138.128 - 192 /26, 62 usable IP's .129 to .191, these are the addresses I am trying to assign to customers routers using a PPPoE server and I can do it no problem with a bridge configured, without the bridge it will not work.

Will try to get it together to PM
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: Using PPPoE without a bridge

Mon Apr 20, 2015 8:19 pm

I also have the following ranges to supply to customers routers, *.*.138.0 - 128 /25, 126 Useable IP's and *.*.138.128 - 192 /26, 62 usable IP's .129 to .191, these are the addresses I am trying to assign to customers routers using a PPPoE server and I can do it no problem with a bridge configured, without the bridge it will not work.

Will try to get it together to PM
Ok - on the backhaul router, you will need to create a static route:
dst=x.x.138.128/26 gateway=x.x.137.24? (I got lost in your description of the locally-attached networks on the backhaul router - whatever IP is the WAN ip of the PPPoE router)

Now on the PPPoE router - create a static route type=blackhole, dst=x.x.138.128/26
This will cause any IP that's not currently in use to just "disappear" while idle, so no bouncing back and forth....

Then make a pool PPPOEPOOL with x.x.138.128 - x.x.138.191 (yes, include the first and last addresses, they're useful in this scenario)

For your PPPoE profile that the customers will use:
- set local address = IP address of wan interface of the PPPoE server.
- set remote address = PPOEPOOL
- leave bridge stuff blank.
- Optionally set the DNS server address(es) here also.
- In the protocols tab, un-check IPv6/MPLS (unless you're using them, I assume you're not)
- queue tab- set this up or not, according to your needs, it has no bearing on reachability.

If your accounts are assigned by RADIUS, then you can use framed-ip-address=255.255.255.254 to tell the pppoe server "use whatever pool you want" - if have a customer with a static IP address, you can put it here - make sure the backhaul router knows to route the static IP to this server.

Make sure the PPPoE server configuration itself is bound to the correct interface (and not a bridge) - remove the interface from the bridge - Done.

If a customer is supposed to receive a /29 or some small prefix, then make sure the prefix is correctly routed to the PPPoE server, that the PPPoE server has the proper black hole route, this time with distance=254, and finally, on the user's secret set routes = "x.x.x.x/29 0.0.0.0 1" or in RADIUS set framed-ip-route to that value. Yes, really use 0.0.0.0 in the framed route...

So in summary:
make sure the master pool prefix is correctly routed to the EoIP server.
The EoIP server has the prefix routed to black hole, and has the pool configured to include the entire range of IPs.
PPP profile is configured to use that pool as remote, pppoe server's wan IP as local. (note that they're not even in the same network, and that's fine. PPP is basically a wormhole)
PPP secrets / RADIUS profile have no special configurations for standard dynamic customers.
Static customers get specific IP addresses / routes on their secret / RADIUS profile, and those should be SEPARATE from the pool!
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: Using PPPoE without a bridge

Mon Apr 20, 2015 10:16 pm

I also have the following ranges to supply to customers routers, *.*.138.0 - 128 /25, 126 Useable IP's and *.*.138.128 - 192 /26, 62 usable IP's .129 to .191, these are the addresses I am trying to assign to customers routers using a PPPoE server and I can do it no problem with a bridge configured, without the bridge it will not work.

Will try to get it together to PM
Ok - on the backhaul router, you will need to create a static route:
dst=x.x.138.128/26 gateway=x.x.137.24? (I got lost in your description of the locally-attached networks on the backhaul router - whatever IP is the WAN ip of the PPPoE router)

Now on the PPPoE router - create a static route type=blackhole, dst=x.x.138.128/26
This will cause any IP that's not currently in use to just "disappear" while idle, so no bouncing back and forth....

Then make a pool PPPOEPOOL with x.x.138.128 - x.x.138.191 (yes, include the first and last addresses, they're useful in this scenario)

For your PPPoE profile that the customers will use:
- set local address = IP address of wan interface of the PPPoE server.
- set remote address = PPOEPOOL
- leave bridge stuff blank.
- Optionally set the DNS server address(es) here also.
- In the protocols tab, un-check IPv6/MPLS (unless you're using them, I assume you're not)
- queue tab- set this up or not, according to your needs, it has no bearing on reachability.

If your accounts are assigned by RADIUS, then you can use framed-ip-address=255.255.255.254 to tell the pppoe server "use whatever pool you want" - if have a customer with a static IP address, you can put it here - make sure the backhaul router knows to route the static IP to this server.

Make sure the PPPoE server configuration itself is bound to the correct interface (and not a bridge) - remove the interface from the bridge - Done.

If a customer is supposed to receive a /29 or some small prefix, then make sure the prefix is correctly routed to the PPPoE server, that the PPPoE server has the proper black hole route, this time with distance=254, and finally, on the user's secret set routes = "x.x.x.x/29 0.0.0.0 1" or in RADIUS set framed-ip-route to that value. Yes, really use 0.0.0.0 in the framed route...

So in summary:
make sure the master pool prefix is correctly routed to the EoIP server.
The EoIP server has the prefix routed to black hole, and has the pool configured to include the entire range of IPs.
PPP profile is configured to use that pool as remote, pppoe server's wan IP as local. (note that they're not even in the same network, and that's fine. PPP is basically a wormhole)
PPP secrets / RADIUS profile have no special configurations for standard dynamic customers.
Static customers get specific IP addresses / routes on their secret / RADIUS profile, and those should be SEPARATE from the pool!
Thanks, it was the bridge on this live router, I had a bridge between wlan1 and the Ethernet Port as you would normally for the Wi-Fi to work, it does not really need it up there at that site, was just handy to have when you travel to this remote site and be able to get email etc., sooner have the performance.

I do not suppose there is anyway to get the Wi-Fi working without a bridge.

By the way it also works by assigning the profile local IP to the LAN port, although I have done what you said and assigned it to WAN, I just tried it.
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: Using PPPoE without a bridge

Mon Apr 20, 2015 10:23 pm

I do not suppose there is anyway to get the Wi-Fi working without a bridge.

By the way it also works by assigning the profile local IP to the LAN port, although I have done what you said and assigned it to WAN, I just tried it.
If you want to use the WiFi as a local administrative access while on-site, I would just put a private IP on it and do NAT.
Or if you want, you can add a PPPoE server interface to the WiFi and use the same profile and everything - PPPoE will let you have your IP no matter which interface you connect on....

There's no real reason to bridge because there is no "LAN" interface on the PPPoE server - at least not an IP interface...

If you did have an IP address on the PPPoE interface which you intended for standard IP forwarding, you could put the PPPoE server on the bridge interface and connect wlan1 and ether2 as ports, but you're right - that adds another lap through the packet forwarding diagram due to encapsulation / decapsulation....
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: Using PPPoE without a bridge

Mon Apr 20, 2015 10:31 pm

I do not suppose there is anyway to get the Wi-Fi working without a bridge.

By the way it also works by assigning the profile local IP to the LAN port, although I have done what you said and assigned it to WAN, I just tried it.
If you want to use the WiFi as a local administrative access while on-site, I would just put a private IP on it and do NAT.
Or if you want, you can add a PPPoE server interface to the WiFi and use the same profile and everything - PPPoE will let you have your IP no matter which interface you connect on....

There's no real reason to bridge because there is no "LAN" interface on the PPPoE server - at least not an IP interface...

If you did have an IP address on the PPPoE interface which you intended for standard IP forwarding, you could put the PPPoE server on the bridge interface and connect wlan1 and ether2 as ports, but you're right - that adds another lap through the packet forwarding diagram due to encapsulation / decapsulation....
Thanks again, just something one misses, the network just grew so fast, last month 5.6 Terra Bytes went across the Ubiquiti radios and through the RB1100AHx2
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: Using PPPoE without a bridge

Mon Apr 20, 2015 10:43 pm

I do not suppose there is anyway to get the Wi-Fi working without a bridge.

By the way it also works by assigning the profile local IP to the LAN port, although I have done what you said and assigned it to WAN, I just tried it.
If you want to use the WiFi as a local administrative access while on-site, I would just put a private IP on it and do NAT.
Or if you want, you can add a PPPoE server interface to the WiFi and use the same profile and everything - PPPoE will let you have your IP no matter which interface you connect on....

There's no real reason to bridge because there is no "LAN" interface on the PPPoE server - at least not an IP interface...

If you did have an IP address on the PPPoE interface which you intended for standard IP forwarding, you could put the PPPoE server on the bridge interface and connect wlan1 and ether2 as ports, but you're right - that adds another lap through the packet forwarding diagram due to encapsulation / decapsulation....
Thanks again, just something one misses, the network just grew so fast, last month 5.6 Terra Bytes went across the Ubiquiti radios and through the RB1100AHx2

P.S. If I put local IP on the wlan1 and NAT on the Wan would that not screw up the routing for the PPPoE
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: Using PPPoE without a bridge

Mon Apr 20, 2015 10:52 pm

P.S. If I put local IP on the wlan1 and NAT on the Wan would that not screw up the routing for the PPPoE
nope - suppose you put 10.10.10.1/24 on the wlan, and dhcp server.
You can have NAT with exactly this one and only NAT rule in the entire system:
/ip firewall nat
add chain=srcnat src-address=10.10.10.0/24 action=src-nat to-addresses=x.x.x.x

x.x.x.x can be the "wan" address of the router, or if you want it to appear distinct, it can be any other public IP address which is routed to this Mikrotik... or you could be totally lazy and just use action=masquerade

If it were me, I would be lazy and use masquerade.
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: Using PPPoE without a bridge

Mon Apr 20, 2015 11:13 pm

P.S. If I put local IP on the wlan1 and NAT on the Wan would that not screw up the routing for the PPPoE
nope - suppose you put 10.10.10.1/24 on the wlan, and dhcp server.
You can have NAT with exactly this one and only NAT rule in the entire system:
/ip firewall nat
add chain=srcnat src-address=10.10.10.0/24 action=src-nat to-addresses=x.x.x.x

x.x.x.x can be the "wan" address of the router, or if you want it to appear distinct, it can be any other public IP address which is routed to this Mikrotik... or you could be totally lazy and just use action=masquerade

If it were me, I would be lazy and use masquerade.
OK I have done that, everything seems OK, but cannot test Wi-Fi until I drive up there.

Will let you know. Thanks
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: Using PPPoE without a bridge

Tue Apr 21, 2015 12:16 pm

P.S. If I put local IP on the wlan1 and NAT on the Wan would that not screw up the routing for the PPPoE
nope - suppose you put 10.10.10.1/24 on the wlan, and dhcp server.
You can have NAT with exactly this one and only NAT rule in the entire system:
/ip firewall nat
add chain=srcnat src-address=10.10.10.0/24 action=src-nat to-addresses=x.x.x.x

x.x.x.x can be the "wan" address of the router, or if you want it to appear distinct, it can be any other public IP address which is routed to this Mikrotik... or you could be totally lazy and just use action=masquerade

If it were me, I would be lazy and use masquerade.
OK I have done that, everything seems OK, but cannot test Wi-Fi until I drive up there.

Will let you know. Thanks
P.S.

I thought everything was OK, but when I go into /ip route there is an dynamic route to wlan1 that is unreachable
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: Using PPPoE without a bridge

Tue Apr 21, 2015 1:05 pm

P.S.

I thought everything was OK, but when I go into /ip route there is an dynamic route to wlan1 that is unreachable
Sure - nobody's attached to wlan1 right? Only when an interface is active will a dynamic connected route be active.
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: Using PPPoE without a bridge

Tue Apr 21, 2015 1:10 pm

P.S.

I thought everything was OK, but when I go into /ip route there is an dynamic route to wlan1 that is unreachable
Sure - nobody's attached to wlan1 right? Only when an interface is active will a dynamic connected route be active.
If I add wlan1 to a bridge on its own and assign the LAN IP to the bridge, the route becomes reachable even though the interface shows disabled.
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: Using PPPoE without a bridge

Tue Apr 21, 2015 1:39 pm

P.S.

I thought everything was OK, but when I go into /ip route there is an dynamic route to wlan1 that is unreachable
Sure - nobody's attached to wlan1 right? Only when an interface is active will a dynamic connected route be active.
If I add wlan1 to a bridge on its own and assign the LAN IP to the bridge, the route becomes reachable even though the interface shows disabled.
Because the bridge isn't down. The PORT is down.
This concept is absolutely fundamental to routing.
If devices didn't remove networks from their routing tables when the device goes down, there wouldn't be any dynamic routing. It is crucial that when the link goes down, the router removes that network from its routing table so that if there is another way to get there, that route will be used instead. When the link is fixed, the interface comes up again, and the locally-connected route becomes active again, so the router stops using the longer path and resumes using the direct connection.
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: Using PPPoE without a bridge

Tue Apr 21, 2015 1:50 pm

That makes sense, thanks a lot, when I get all the PPPoE configured routers working, I will probably be back regarding VLAN on Mikrotik for the radio management.

Thanks a million.
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: Using PPPoE without a bridge

Tue Apr 21, 2015 1:59 pm

That makes sense, thanks a lot, when I get all the PPPoE configured routers working, I will probably be back regarding VLAN on Mikrotik for the radio management.

Thanks a million.
There's a thread going on about that right now - and it's got some good answers, especially if you have UBNT gear - something about their advanced vlan configuration just refuses to soak into my brain.
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: Using PPPoE without a bridge

Tue Apr 21, 2015 2:06 pm

That makes sense, thanks a lot, when I get all the PPPoE configured routers working, I will probably be back regarding VLAN on Mikrotik for the radio management.

Thanks a million.
There's a thread going on about that right now - and it's got some good answers, especially if you have UBNT gear - something about their advanced vlan configuration just refuses to soak into my brain.
It is almost all UBNT
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: Using PPPoE without a bridge

Tue Apr 21, 2015 6:38 pm

P.S. If I put local IP on the wlan1 and NAT on the Wan would that not screw up the routing for the PPPoE
nope - suppose you put 10.10.10.1/24 on the wlan, and dhcp server.
You can have NAT with exactly this one and only NAT rule in the entire system:
/ip firewall nat
add chain=srcnat src-address=10.10.10.0/24 action=src-nat to-addresses=x.x.x.x

x.x.x.x can be the "wan" address of the router, or if you want it to appear distinct, it can be any other public IP address which is routed to this Mikrotik... or you could be totally lazy and just use action=masquerade

If it were me, I would be lazy and use masquerade.
OK I have done that, everything seems OK, but cannot test Wi-Fi until I drive up there.

Will let you know. Thanks
When I set the rule as above I get no traffic, if I set it to masquerade, I get traffic but then when I do a what is my IP from a machine with a Public *.*.138.x assigned, I get *.*.137.242 it is the same on every machine even though they have *.*.138.x addresses assigned.
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: Using PPPoE without a bridge

Tue Apr 21, 2015 6:40 pm

When I set the rule as above I get no traffic, if I set it to masquerade, I get traffic but then when I do a what is my IP from a machine with a Public *.*.138.x assigned, I get *.*.137.242 it is the same on every machine even though they have *.*.138.x addresses assigned.
You got the masquerade rule wrong, then.

Make sure the masquerade rule matches ONLY when src-address=10.10.10.0/24

Who is online

Users browsing this forum: AlbeeDC, mk01, sindy and 33 guests