FUN with Mikrotik BRIDGE Series# Filter PPPoE Requests – Part#1

↓

Part #1 : FUN with Mikrotik BRIDGE Series# Filter PPPoE Requests – Part#1 < You are Here
Part #2 : FUN with Mikrotik BRIDGE Series# Redirecting Traffic with Mikrotik Bridge

 

---

Disclaimer! This is important!

Every Network is different , so one solution cannot be fit/applied to all. Therefore try to understand logics & create or modify the solutions as per your network scenario. Never follow copy paste blindly.

My humble request is that kindly donot consider me as an expert on this stuff, I am NOT certified in anything Mikrotik/Cisco/Linux or Windows. However I have worked with some core networks and I read , research & try stuff all of the time. So I am not speaking/posting about stuff I am formerly trained in, I pretty much go with experience and what I have learned on my own. And , If I don’t know something then I read & learn all about it.

So , please don’t hold me/my-postings to be always 100 percent correct. I make mistakes just like everybody else. However – I do my best, learn from my mistakes and try to share tips that worked for me.

Regard’s
Syed Jahanzaib~

---

If you are running a network or ISP/WISP, and using Mikrotik as a PPPoE server, then you may have ran into this problem that many users have configured wifi router at there home to share internet between mobile/laptop and other devices, its common now a days. Usually PPPoE dialer is configured in user WiFi ROUTER. But the problem begins that if the user account gets expired BUT the router will keep retrying PPPoE dialer again n again 24 hours a day , and imagine if you have lots of routers doing this sort of flooding/bombing, you will see only PPPoE failed authentication messages in Mikrotik logs and you wont be able to see any other valid info due-to continuous logging of failed auth messages. You can ignore it if the number is low, but some times it becomes annoying to see such messages, and also if you are very short in space with lower model of RB, then it will gonna become issue for you. Some times its not just possible to visit at user end to tell him that turn off his router / remove his cable from the switch , OR if you are running layer2 un managed switches, OR you simply don’t want to visit that user. After little searching (did not made extensive search) I found out that from Mikrotik Firewall , you cannot block PPPoE request as it works on BROADCAST.

So I found the following method to block PPPoE request from particular VALID expired users. ( I am using the word VALID expired users, because if the user is not doing it intentionally then its easier to block him at mikrotik level, but if any smart bugger is doing it just to annoy you, you have to hunt him down and cut the cable or block at manageable AP level, because he can change the mac address any time)

Ok the simple theory is ,

1-  Create bridge interface,
2-  Enable bridge firewall,
3-  Add your LAN interface in it,
4-  Finally create a filter that blocks PPPoE discovery for that specific MAC address 🙂 and that’s it 🙂

Ok here we go . . .

We will first add virtual BRIDGE interface

/interface bridge
add admin-mac=00:00:00:00:00:00 ageing-time=5m arp=enabled auto-mac=yes disabled=no forward-delay=\
15s l2mtu=65535 max-message-age=20s mtu=1500 name=bridge1 priority=0x8000 protocol-mode=none \
transmit-hold-count=6

Now we will add LAN interface in this BRIDGE to intercept every traffic passing from it and block it before it passes to LAN interface

/interface bridge port
add bridge=bridge1 disabled=no edge=auto external-fdb=auto horizon=none interface=LAN-ether2 \
path-cost=10 point-to-point=auto priority=0x80

Now we will enable BRIDGE FIREWALL, it is necessary as mikrotik IP/FIREWALL will not be applicable to filter traffic in BRIDGE interface.

/interface bridge settings
set use-ip-firewall=yes use-ip-firewall-for-pppoe=yes use-ip-firewall-for-vlan=no

Finally we will create BRIDGE FILTER(s) to drop traffic from particular user to block PPPoE connection attempts only, using his mac address.

/interface bridge filter
add action=drop chain=input comment=\
"Block only PPPoE Discovery (connectivity) from user 'ZAIB' to prevent pppoe flooding" disabled=no \
mac-protocol=pppoe-discovery src-mac-address=00:23:AE:A8:1F:7F/FF:FF:FF:FF:FF:FF

If you want to BLOCK ANY traffic coming from that or other user mac address to pass from bridge to LAN interface. (some times is a good approach 😉 hmmmmm )

## IF you want to BLOCK ANY traffic coming from that or other  user
#add action=drop chain=input comment="Block ANY traffic from user 'KARACHI'" disabled=yes \
#    mac-protocol=ip src-mac-address=00:23:AE:A8:1F:7F/FF:FF:FF:FF:FF:FF

---

As shown in the image below . . .

↓

↓

---

ote: I found this method with some R&D using WIRESHARK capturing tool but I am very confident that there could be suitable methods that maybe more simple and easier to implement with simple rules, If you have info, drop me a message so that I can update these little notes.

---

 

↓
Regard’s
Syed Jahanzaib