Syed Jahanzaib Personal Blog to Share Knowledge !

November 23, 2013

FUN with Mikrotik BRIDGE Series#1. Filter PPPoE Requests

Filed under: Mikrotik Related — Tags: , , , — Syed Jahanzaib / Pinochio~:) @ 11:22 PM

If you are running a network or ISP/WISP, and using Mikrotik as a PPPoE server, then you may have ran into this problem that many users have configured wifi router at there home to share internet between mobile/laptop and other devices, its common now a days. Usually PPPoE dialer is configured in user WiFi ROUTER. But the problem begins that if the user account gets expired BUT the router will keep retrying PPPoE dialer again n again 24 hours a day , and imagine if you have lots of routers doing this sort of flooding/bombing, you will see only PPPoE failed authentication messages in Mikrotik logs and you wont be able to see any other valid info due-to continuous logging of failed auth messages. You can ignore it if the number is low, but some times it becomes annoying to see such messages, and also if you are very short in space with lower model of RB, then it will gonna become issue for you. Some times its not just possible to visit at user end to tell him that turn off his router / remove his cable from the switch , OR if you are running layer2 un managed switches, OR you simply don’t want to visit that user. After little searching (did not made extensive search) I found out that from Mikrotik Firewall , you cannot block PPPoE request as it works on BROADCAST.

So I found the following method to block PPPoE request from particular VALID expired users. ( I am using the word VALID expired users, because if the user is not doing it intentionally then its easier to block him at mikrotik level, but if any smart bugger is doing it just to annoy you, you have to hunt him down and cut the cable or block at manageable AP level, because he can change the mac address any time)

Ok the simple theory is ,

1-  Create bridge interface,
2- Enable bridge firewall,
3- Add your LAN interface in it,
4- Finally create a filter that blocks PPPoE discovery for that specific
MAC address 🙂 and that’s it 🙂

Ok here we go . . .
We will first add virtual BRIDGE interface

/interface bridge
add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes disabled=no forward-delay=\
15s l2mtu=65535 max-message-age=20s mtu=1500 name=bridge1 priority=0x8000 protocol-mode=none \

Now we will add LAN interfce in this BRIDGE to intercept every traffic passing from it and block it before it passes to LAN interface

/interface bridge port
add bridge=bridge1 disabled=no edge=auto external-fdb=auto horizon=none interface=LAN-ether2 \
path-cost=10 point-to-point=auto priority=0x80

Now we will enable BRIDGE FIREWALL, it is necessary as mikrotik IP/FIREWALL will not be applicable to filter traffic in BRIDGE interface.

/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-pppoe=yes use-ip-firewall-for-vlan=no

Finally we will create BRIDGE FILTER(s) to drop traffic from particular user to block PPPoE connection attempts only, using his mac address.

/interface bridge filter
add action=drop chain=input comment=\
"Block only PPPoE Discovery (connectivity) from user 'ZAIB' to prevent pppoe flooding" disabled=no \
mac-protocol=pppoe-discovery src-mac-address=00:23:AE:A8:1F:7F/FF:FF:FF:FF:FF:FF


IF you want to BLOCK ANY traffic coming from that or other user mac address to pass from bridge to LAN interface. (some times is a good approach 😉 hmmmmm )

## IF you want to BLOCK ANY traffic coming from that or other  user
#add action=drop chain=input comment="Block ANY traffic from user 'KARACHI'" disabled=yes \
#    mac-protocol=ip src-mac-address=00:23:AE:A8:1F:7F/FF:FF:FF:FF:FF:FF

As showed in the image below . . .



Note: I found this method with some R&D using WIRESHARK capturing tool but I am very confident that there are some suitable methods that maybe more simple and easier to implement with simple rules, If you have info, drop me a message so that I can update these little notes.

Another proper method is to use VLAN and manageable switches combination to block all sorts of flooding at that particular end. But usually its not affordable at smaller networks.

Syed Jahanzaib



  1. dada u are the best


    Comment by asdasd — November 24, 2013 @ 3:04 AM

  2. Very Nice zaib bhai
    i m usung rb433xxx kia main us main yeh rule apply kersukta hoon jub k already use three ports Lan, Wan, Wan2


    Comment by Muhammed Azam Ghouri — November 24, 2013 @ 12:04 PM

  3. Thanx Sayed nice,
    I wanna make the default status to pppoe is blocked, when I get new pppoe user make custom rule to access from pppoe


    Comment by Injaznet Injaznet — November 24, 2013 @ 3:48 PM

  4. Is it possible that if we received more then 10 Request from same MAC Adress in 1 hrs time then it should automatically blocked that specific MAC in bridge filter ?? Do you have something like this ??


    Comment by Nishit — November 25, 2013 @ 9:14 AM

  5. Ji, I cant find the mac protocol in 6.20 routeros
    Can u please rebulid give new script for newer Router OS


    Comment by tamilmaran — October 15, 2015 @ 9:52 PM

  6. I have pppoe setup with mikrotik
    My client want to set dvr kindly guide how can dvr b accessed from anywhere


    Comment by nauman — April 17, 2016 @ 12:16 AM

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: