MikroTik PPPoE Configuration with OneRADIUS: Complete Step-by-Step Guide for ISPs

Introduction to MikroTik PPPoE and OneRADIUS Integration

For ISPs in India managing hundreds or thousands of broadband subscribers, combining MikroTik routers with a powerful AAA RADIUS solution like OneRADIUS is one of the most reliable and cost-effective architectures available today. PPPoE (Point-to-Point Protocol over Ethernet) is the backbone of most broadband networks, providing per-session authentication, IP address assignment, and bandwidth control — all of which can be centrally managed through OneRADIUS.

In this guide, we walk you through the complete MikroTik PPPoE configuration with OneRADIUS, covering everything from RADIUS client setup to PPPoE server profiles and live session monitoring.

---

Why Use OneRADIUS with MikroTik PPPoE?

OneRADIUS is purpose-built for Indian ISPs and integrates seamlessly with MikroTik RouterOS. Here is why this combination is so powerful:

• **Centralised Authentication:** All PPPoE login requests are authenticated via OneRADIUS, eliminating the need for local user databases on each router.
• **Dynamic IP Assignment:** OneRADIUS assigns IP addresses per subscriber based on plan and pool configuration.
• **Bandwidth Management:** Upload and download speeds are enforced via RADIUS attributes (Rate-Limit), removing the need for manual queue configurations.
• **Session Accounting:** OneRADIUS tracks session start, stop, data usage, and duration for accurate billing.
• **Multi-NAS Support:** One OneRADIUS server can manage multiple MikroTik routers across your network.
• **Hotspot + PPPoE:** OneRADIUS supports both MikroTik Hotspot and PPPoE from a single platform.

---

Prerequisites Before You Begin

Before starting the configuration, ensure you have the following ready:

• A MikroTik router running **RouterOS v6.x or v7.x**
• OneRADIUS installed and running (on-premise or cloud)
• A shared **RADIUS secret key** (you will configure this on both sides)
• The **IP address of your OneRADIUS server** accessible from the MikroTik router
• At least one **subscriber account** created in OneRADIUS
• Basic familiarity with MikroTik Winbox or CLI

---

Step 1 — Add OneRADIUS as a RADIUS Client in MikroTik

The first step is to register OneRADIUS as a RADIUS server in your MikroTik router so that PPPoE authentication requests are forwarded to it.

Via Winbox:

1. Open **Winbox** and connect to your MikroTik router.
2. Navigate to **RADIUS** from the left menu.
3. Click the **'+'** button to add a new RADIUS server.
4. Configure the following fields:

• **Service:** Check 'ppp' (and optionally 'hotspot' if needed)
• **Address:** Enter the IP address of your OneRADIUS server
• **Secret:** Enter the shared secret key configured in OneRADIUS
• **Authentication Port:** 1812
• **Accounting Port:** 1813
• **Timeout:** 3000 ms (recommended)
• **Realm:** Leave blank unless using multi-realm setup

1. Click **OK** to save.

Via CLI (Terminal):

/radius add service=ppp address=<OneRADIUS-IP> secret=<your-secret> authentication-port=1812 accounting-port=1813

---

Step 2 — Configure MikroTik as a NAS in OneRADIUS

Now log in to your OneRADIUS admin panel and register your MikroTik router as a Network Access Server (NAS).

1. Go to **NAS Management** in OneRADIUS.
2. Click **Add NAS**.
3. Fill in the details:

• **NAS Name:** Give it a descriptive name (e.g., 'MikroTik-Main-POP1')
• **NAS IP Address:** Enter the MikroTik router's IP address
• **NAS Type:** Select 'MikroTik'
• **Shared Secret:** Enter the same secret used in MikroTik
• **Description:** Optional but recommended for multi-site setups

1. Click **Save**.

---

Step 3 — Enable RADIUS for PPP in MikroTik

By default, MikroTik PPP may use a local user database. You must instruct it to use RADIUS for authentication and accounting.

Via Winbox:

1. Go to **PPP** from the left menu.
2. Click on the **Secrets** tab.
3. Click **PPP Authentication & Accounting** (the button at the top).
4. Enable the following options:

• **Use RADIUS:** Checked (enabled)
• **Accounting:** Checked (enabled)
• **Interim Update:** Set to 00:05:00 (5 minutes) for regular accounting updates
• **Use Circuit ID:** Optional, depending on your setup

1. Click **OK**.

Via CLI:

/ppp aaa set use-radius=yes accounting=yes interim-update=5m

---

Step 4 — Create a PPPoE Server on MikroTik

Now configure the PPPoE server on the interface connected to your subscribers (typically an Ethernet or VLAN interface).

Via Winbox:

1. Go to **PPP** > **PPPoE Servers** tab.
2. Click **'+'** to add a new PPPoE server.
3. Configure:

• **Service Name:** e.g., 'OneRADIUS-PPPoE' (this can be left blank to accept any service name)
• **Interface:** Select the interface facing subscribers (e.g., ether2, bridge1, vlan10)
• **Max MTU:** 1480
• **Max MRU:** 1480
• **Authentication:** Uncheck PAP, keep **CHAP** or **MS-CHAPv2** checked
• **Default Profile:** Select or create a profile (see Step 5)
• **One Session Per Host:** Enable this to prevent duplicate sessions
• **Max Sessions:** Set based on your capacity

1. Click **OK**.

Via CLI:

/interface pppoe-server server add interface=ether2 service-name=OneRADIUS-PPPoE default-profile=radius-profile one-session-per-host=yes disabled=no

---

Step 5 — Create a PPP Profile for RADIUS Users

A PPP profile defines default settings for PPPoE sessions. When using RADIUS, many values (like IP and rate-limit) are overridden by RADIUS attributes.

Via Winbox:

1. Go to **PPP** > **Profiles** tab.
2. Click **'+'** to create a new profile.
3. Configure:

• **Name:** e.g., 'radius-profile'
• **Local Address:** Enter the PPPoE gateway IP (e.g., 10.10.0.1)
• **Remote Address:** Leave blank (RADIUS will assign this)
• **DNS Server:** e.g., 8.8.8.8 and 8.8.4.4 (or your local DNS)
• **Rate Limit:** Leave blank (RADIUS Mikrotik-Rate-Limit attribute will handle this)
• **Use Compression:** No
• **Use Encryption:** No (unless required)

1. Click **OK**.

Via CLI:

/ppp profile add name=radius-profile local-address=10.10.0.1 dns-server=8.8.8.8,8.8.4.4 use-compression=no use-encryption=no

---

Step 6 — Configure Subscriber Plans in OneRADIUS

OneRADIUS allows you to define bandwidth plans and assign them to subscribers. Each plan uses RADIUS reply attributes to enforce speed limits on MikroTik.

Creating a Plan in OneRADIUS:

1. Log in to the **OneRADIUS Admin Panel**.
2. Navigate to **Plans** or **Packages**.
3. Click **Add Plan**.
4. Fill in:

• **Plan Name:** e.g., '50Mbps Unlimited'
• **Download Speed:** 50 Mbps
• **Upload Speed:** 25 Mbps
• **Data Limit:** Unlimited or set FUP in GB
• **Session Timeout:** Optional
• **IP Pool:** Assign an IP pool for this plan

1. Save the plan.

MikroTik Rate-Limit Attribute:

OneRADIUS automatically sends the Mikrotik-Rate-Limit attribute in the RADIUS Access-Accept response. For a 50Mbps/25Mbps plan, it would look like:

Mikrotik-Rate-Limit = '25M/50M'

This format is upload/download as per MikroTik convention. OneRADIUS handles this mapping automatically when you configure speed values in the plan.

---

Step 7 — Add Subscribers in OneRADIUS

Each broadband subscriber needs an account in OneRADIUS with a username and password matching their PPPoE credentials.

1. Go to **Subscribers** or **Users** in OneRADIUS.
2. Click **Add Subscriber**.
3. Enter:

• **Username:** The PPPoE username (e.g., 'customer001')
• **Password:** The PPPoE password
• **Plan:** Select the plan created in Step 6
• **IP Address:** Assign static IP or leave for pool assignment
• **NAS:** Select the MikroTik NAS added in Step 2
• **Expiry Date:** Set subscription validity

1. Save the subscriber.

---

Step 8 — Test PPPoE Authentication

Now it is time to test end-to-end connectivity.

Testing from a Client Device:

1. Connect a PC or CPE router to the subscriber-facing interface of your MikroTik.
2. Create a PPPoE connection on the device using the credentials from Step 7.
3. Attempt to connect.

Verify Active Session in MikroTik:

/ppp active print

You should see the subscriber session listed with an assigned IP address.

Verify in OneRADIUS:

1. Go to **Active Sessions** in OneRADIUS.
2. Confirm the session is listed with correct username, IP, NAS, and start time.

Check RADIUS Logs:

1. In OneRADIUS, navigate to **Logs** or **Authentication Logs**.
2. Look for an **Access-Accept** response for the subscriber's username.
3. If you see **Access-Reject**, check username/password and ensure the subscriber account is active and not expired.

---

Step 9 — Monitor and Manage Sessions from OneRADIUS

One of the biggest advantages of OneRADIUS is its powerful session management capabilities.

Features Available:

• **Live Session View:** See all active PPPoE sessions in real time with username, IP, NAS, upload/download data, and session duration.
• **Force Disconnect (CoA/PoD):** Disconnect a subscriber remotely from the OneRADIUS dashboard using RADIUS Change of Authorization (CoA) or Packet of Disconnect (PoD) — no need to log in to MikroTik.
• **Bandwidth Reports:** View per-subscriber data usage reports for billing and troubleshooting.
• **Plan Change:** Upgrade or downgrade a subscriber's plan directly from OneRADIUS, and the new rate-limit takes effect on reconnection.
• **Expiry Alerts:** Automatically block or disconnect subscribers when their subscription expires.

---

Enabling CoA on MikroTik for Remote Session Control

For OneRADIUS to remotely disconnect or modify sessions, enable CoA support on MikroTik:

/radius incoming set accept=yes port=3799

Also ensure your MikroTik firewall allows incoming UDP 3799 from the OneRADIUS server:

/ip firewall filter add chain=input protocol=udp dst-port=3799 src-address=<OneRADIUS-IP> action=accept

---

Troubleshooting Common Issues

Issue 1: Access-Reject for Valid Credentials

• Verify the username and password in OneRADIUS exactly match PPPoE client credentials (case-sensitive).
• Check if the subscriber account is active and not expired.
• Confirm the NAS IP in OneRADIUS matches the MikroTik source IP.

Issue 2: RADIUS Timeout in MikroTik

• Ping the OneRADIUS server from MikroTik: **ping <OneRADIUS-IP>**
• Check firewall rules on the OneRADIUS server host.
• Verify the RADIUS service is running on OneRADIUS.

Issue 3: Subscriber Gets Wrong IP or No IP

• Check the IP pool configuration in OneRADIUS.
• Ensure the pool has available addresses.
• Verify the Framed-IP-Address or Framed-Pool attribute is correctly returned in Access-Accept.

Issue 4: Speed Not Limited Correctly

• Confirm the Mikrotik-Rate-Limit attribute is being sent by OneRADIUS (check auth logs).
• Remove any conflicting manual Simple Queues.
• Ensure the MikroTik queue type supports the rate-limit attribute.

Issue 5: Sessions Not Appearing in OneRADIUS

• Confirm accounting is enabled in MikroTik PPP AAA settings.
• Verify the accounting port (1813) is reachable.
• Check OneRADIUS accounting logs for incoming packets.

---

Best Practices for MikroTik PPPoE with OneRADIUS

• **Use a dedicated VLAN** for PPPoE subscriber traffic to isolate it from management traffic.
• **Set Interim-Update to 5 minutes** so OneRADIUS gets regular usage updates even for long sessions.
• **Enable One-Session-Per-Host** on the PPPoE server to prevent credential sharing.
• **Regularly back up** your OneRADIUS database and MikroTik configuration.
• **Monitor RADIUS server health** — a down RADIUS server means no new PPPoE connections can be established.
• **Use strong shared secrets** and rotate them periodically.
• **Test CoA and PoD** in a lab before deploying in production to ensure remote disconnect works correctly.
• **Configure fallback behaviour** in MikroTik for cases where RADIUS is unreachable.

---

Conclusion

Integrating MikroTik PPPoE with OneRADIUS gives Indian ISPs a robust, scalable, and fully automated subscriber management system. From authentication and IP assignment to bandwidth control and real-time session monitoring, this combination covers every aspect of broadband subscriber management from a single platform.

OneRADIUS is designed specifically for the needs of Indian ISPs — supporting multiple NAS devices, flexible billing plans, FUP enforcement, and seamless MikroTik compatibility. Whether you are running a small local ISP or a large multi-city network, this architecture scales with you.

Ready to get started? Visit oneradius.com to request a free demo or download OneRADIUS today and transform how you manage your broadband subscribers.

---

*Have questions about MikroTik PPPoE configuration with OneRADIUS? Drop them in the comments or reach out to the ARCR Technologies support team.*