PPPoE - Point-to-Point Protocol over Ethernet

PPPoE (Point-to-Point Protocol over Ethernet) is a network protocol for encapsulating PPP frames inside Ethernet frames. PPPoE is widely used by DSL providers and internet service providers to deliver broadband access with authentication, encryption, and connection management.

Introduction to PPPoE

What is PPPoE?

PPPoE is a protocol that:

Encapsulates PPP frames in Ethernet frames
Provides user authentication (PAP, CHAP, MS-CHAP, MS-CHAPv2)
Manages connection setup and teardown
Supports dynamic IP address assignment
Is used for DSL, FTTH, and cable modems

PPPoE Architecture

Components:

PPPoE Client - initiates the connection (VyOS router)
PPPoE Server - accepts the connection (ISP equipment)
Access Concentrator (AC) - the provider’s server
DSL/Ethernet Modem - the physical device

Connection setup stages:

Discovery Stage - locate the Access Concentrator
- PADI (Active Discovery Initiation)
- PADO (Active Discovery Offer)
- PADR (Active Discovery Request)
- PADS (Active Discovery Session-confirmation)
PPP Session Stage - establish the PPP session
- LCP (Link Control Protocol)
- Authentication (PAP/CHAP)
- NCP (Network Control Protocol)
- IP configuration

Operating Modes

Mode 1: Home users (Transparent Mode)

[Computer] ---- [DSL Modem with PPPoE] ---- [ISP]
                     (auto-connect)

The modem automatically establishes the PPPoE connection
Receives a private IP address (RFC 1918)
Double NAT is possible

Mode 2: VyOS router (Bridge Mode)

[LAN] ---- [VyOS Router] ---- [DSL Modem Bridge] ---- [ISP]
                PPPoE Client

VyOS initiates the PPPoE connection
The modem operates in bridge mode
Full control over the network configuration
A single layer of NAT

When to Use PPPoE?

Recommended for:

Connecting to a DSL provider
FTTH (Fiber to the Home) connections
Cable modems with PPPoE
Any connection that requires ISP authentication
Connections with a dynamic IP from the provider

Applications:

Home internet over DSL/FTTH
Office connection to a provider
Backup connection over DSL
Testing PPPoE infrastructure

PPPoE Configuration

Basic Setup

configure

# Create a PPPoE interface
set interfaces pppoe pppoe0 source-interface eth0
set interfaces pppoe pppoe0 authentication username 'myuser@isp.ru'
set interfaces pppoe pppoe0 authentication password 'SecretPassword123'

# Use the default route from the ISP
set interfaces pppoe pppoe0 default-route auto

commit
save

Result:

PPPoE connection over eth0
Automatic IP address assignment from the ISP
Default route points to the PPPoE interface

Configuration Parameters

Source Interface

# Physical interface for PPPoE
set interfaces pppoe pppoe0 source-interface eth0

# PPPoE over a VLAN interface
set interfaces ethernet eth0 vif 100
set interfaces pppoe pppoe0 source-interface eth0.100

Important: The source interface must be:

A physical Ethernet interface
A VLAN sub-interface
A bond interface
In the UP state

Authentication

# Username and password from the ISP
set interfaces pppoe pppoe0 authentication username 'user@provider.com'
set interfaces pppoe pppoe0 authentication password 'MyPassword'

# Plaintext password (not recommended in production)
set interfaces pppoe pppoe0 authentication plaintext-password 'MyPassword'

Authentication types:

PAP (Password Authentication Protocol) - password sent in cleartext
CHAP (Challenge Handshake Authentication Protocol) - password hash
MS-CHAP, MS-CHAPv2 - Microsoft variants

VyOS automatically negotiates the authentication method with the ISP.

IP Address Configuration

# Automatic IP assignment from the ISP (default)
set interfaces pppoe pppoe0

# Static IP (if the ISP provides one)
set interfaces pppoe pppoe0 address 203.0.113.10/32

# IPv6 over DHCPv6
set interfaces pppoe pppoe0 ipv6 address autoconf
set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address 1
set interfaces pppoe pppoe0 dhcpv6-options pd 0 length 56

Default Route

# Automatically add a default route over PPPoE
set interfaces pppoe pppoe0 default-route auto

# Explicitly add a default route
set interfaces pppoe pppoe0 default-route force

# Do not add a default route
set interfaces pppoe pppoe0 default-route none

# Default route with a metric
set interfaces pppoe pppoe0 default-route-distance 10

Options:

auto - add the route if PPPoE is the only connection
force - always add the route
none - do not add the route

MTU and MRU

# MTU (Maximum Transmission Unit)
set interfaces pppoe pppoe0 mtu 1492

# MRU (Maximum Receive Unit)
set interfaces pppoe pppoe0 mru 1492

MTU recommendations:

Ethernet MTU: 1500 bytes
PPPoE overhead: 8 bytes (PPPoE header + PPP header)
Recommended MTU: 1492 bytes
Some ISPs require an MTU of 1480-1490

Automatic TCP MSS clamping:

# Set the TCP MSS to prevent fragmentation
set interfaces pppoe pppoe0 ip adjust-mss 1452
set interfaces pppoe pppoe0 ipv6 adjust-mss 1432

Connect on Demand

# Establish the connection on demand (when traffic appears)
set interfaces pppoe pppoe0 connect-on-demand

# Idle timeout - tear down the connection after N seconds of inactivity
set interfaces pppoe pppoe0 idle-timeout 300

# Holdoff time - pause before reconnecting
set interfaces pppoe pppoe0 holdoff 30

Use case: Saving traffic, metered connections

Service Name

# Specify a particular service name (if the ISP requires it)
set interfaces pppoe pppoe0 service-name 'MY-SERVICE'

# Use any available service
# (default behavior - do not specify a service-name)

Access Concentrator

# Connect to a specific AC (if several are available)
set interfaces pppoe pppoe0 access-concentrator 'BRAS-01'

Interface Description

# Add a description
set interfaces pppoe pppoe0 description 'ISP Connection - Main Link'

Host-uniq Tag

# Unique tag for the session (hex)
set interfaces pppoe pppoe0 host-uniq '0x12345678'

Purpose: Session identification on the client side

Local and Remote IP

# Local IP address (usually obtained automatically)
set interfaces pppoe pppoe0 local-address 192.168.100.1

# Remote-end IP address (ISP gateway)
set interfaces pppoe pppoe0 remote-address 192.168.100.254

Note: Usually not required - IP addresses are negotiated automatically

Practical Scenarios

Scenario 1: Basic DSL Connection

Topology:

[LAN 192.168.1.0/24] ---- [VyOS eth1] [VyOS eth0] ---- [DSL Modem Bridge] ---- [ISP]
                                           PPPoE

Goal: Set up an internet connection through a DSL provider

Configuration:

configure

# WAN interface (to the DSL modem)
set interfaces ethernet eth0 description 'DSL Modem'

# PPPoE connection
set interfaces pppoe pppoe0 source-interface eth0
set interfaces pppoe pppoe0 authentication username 'user@dsl-provider.ru'
set interfaces pppoe pppoe0 authentication password 'MySecretPass'
set interfaces pppoe pppoe0 default-route auto
set interfaces pppoe pppoe0 mtu 1492
set interfaces pppoe pppoe0 description 'ISP Connection'

# LAN interface
set interfaces ethernet eth1 address 192.168.1.1/24
set interfaces ethernet eth1 description 'LAN'

# NAT for internet access
set nat source rule 100 outbound-interface name pppoe0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

# DHCP server for the LAN
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start 192.168.1.100
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop 192.168.1.200
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option default-router 192.168.1.1
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option name-server 8.8.8.8
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option name-server 8.8.4.4

# DNS forwarding
set service dns forwarding listen-address 192.168.1.1
set service dns forwarding allow-from 192.168.1.0/24

commit
save

Verification:

# PPPoE interface status
show interfaces pppoe pppoe0

# Assigned IP address
show interfaces pppoe pppoe0 brief

# Default route
show ip route

# Connectivity test
ping 8.8.8.8 interface pppoe0

Scenario 2: PPPoE over VLAN

Topology:

[VyOS] ---- eth0.100 (VLAN 100) ---- [Switch] ---- [ISP with VLAN tagging]

Goal: The ISP requires VLAN 100 for the PPPoE connection

Configuration:

configure

# Create a VLAN interface
set interfaces ethernet eth0 vif 100 description 'ISP VLAN'

# PPPoE over VLAN
set interfaces pppoe pppoe0 source-interface eth0.100
set interfaces pppoe pppoe0 authentication username 'customer@fiber-isp.ru'
set interfaces pppoe pppoe0 authentication password 'FiberPass123'
set interfaces pppoe pppoe0 default-route auto
set interfaces pppoe pppoe0 mtu 1492
set interfaces pppoe pppoe0 description 'Fiber ISP Connection'

# Service name if required
set interfaces pppoe pppoe0 service-name 'FIBER-100M'

commit
save

VLAN verification:

# Check the VLAN interface
show interfaces ethernet eth0 vif 100

# Check PPPoE
show interfaces pppoe pppoe0

Scenario 3: Dual PPPoE (two providers)

Topology:

                  ┌─ eth0 ── PPPoE0 ── [ISP-A Primary]
[VyOS Router] ────┤
                  └─ eth1 ── PPPoE1 ── [ISP-B Backup]

Goal: Redundancy across two DSL providers with failover

Configuration:

configure

# Primary ISP (eth0)
set interfaces pppoe pppoe0 source-interface eth0
set interfaces pppoe pppoe0 authentication username 'user@isp-a.ru'
set interfaces pppoe pppoe0 authentication password 'PasswordA'
set interfaces pppoe pppoe0 default-route-distance 10
set interfaces pppoe pppoe0 mtu 1492
set interfaces pppoe pppoe0 description 'ISP-A Primary'

# Backup ISP (eth1)
set interfaces pppoe pppoe1 source-interface eth1
set interfaces pppoe pppoe1 authentication username 'user@isp-b.ru'
set interfaces pppoe pppoe1 authentication password 'PasswordB'
set interfaces pppoe pppoe1 default-route-distance 20
set interfaces pppoe pppoe1 mtu 1492
set interfaces pppoe pppoe1 description 'ISP-B Backup'

# NAT over both interfaces
set nat source rule 100 outbound-interface name pppoe0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

set nat source rule 110 outbound-interface name pppoe1
set nat source rule 110 source address 192.168.1.0/24
set nat source rule 110 translation address masquerade

commit
save

Failover logic:

Primary route over pppoe0 (distance 10)
Backup route over pppoe1 (distance 20)
If pppoe0 goes down, automatic switchover to pppoe1

Verification:

# Routing table - there should be two default routes
show ip route

# Failover test
# 1. Disconnect pppoe0
disconnect interface pppoe0

# 2. Check the active route
show ip route 0.0.0.0/0

# 3. Reconnect
connect interface pppoe0

Scenario 4: PPPoE with IPv6 and DHCPv6-PD

Goal: Obtain an IPv6 prefix from the ISP and distribute it to the LAN

Configuration:

configure

# PPPoE with IPv4 and IPv6
set interfaces pppoe pppoe0 source-interface eth0
set interfaces pppoe pppoe0 authentication username 'user@ipv6-isp.ru'
set interfaces pppoe pppoe0 authentication password 'IPv6Password'
set interfaces pppoe pppoe0 default-route auto
set interfaces pppoe pppoe0 mtu 1492

# IPv6 autoconfig
set interfaces pppoe pppoe0 ipv6 address autoconf

# DHCPv6 Prefix Delegation
set interfaces pppoe pppoe0 dhcpv6-options pd 0 length 56
set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address 1
set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 sla-id 1

# LAN interface with IPv6
set interfaces ethernet eth1 address 192.168.1.1/24

# IPv6 Router Advertisement for the LAN
set service router-advert interface eth1 prefix ::/64

commit
save

DHCPv6-PD explained:

pd 0 - prefix delegation ID
length 56 - request a /56 prefix from the ISP
interface eth1 - assign a subnet to eth1
address 1 - use ::1 as the router address
sla-id 1 - subnet ID from the delegated prefix

IPv6 verification:

# PPPoE IPv6 address
show ipv6 interface pppoe0

# Delegated prefix
show dhcpv6 client leases

# IPv6 routing
show ipv6 route

# Ping IPv6
ping 2001:4860:4860::8888 interface pppoe0

Scenario 5: Connect on Demand with Idle Timeout

Goal: Metered PPPoE connection, connect only when needed

Configuration:

configure

# PPPoE with on-demand mode
set interfaces pppoe pppoe0 source-interface eth0
set interfaces pppoe pppoe0 authentication username 'user@metered-isp.ru'
set interfaces pppoe pppoe0 authentication password 'MeteredPassword'
set interfaces pppoe pppoe0 default-route auto
set interfaces pppoe pppoe0 mtu 1492

# Connect on demand
set interfaces pppoe pppoe0 connect-on-demand

# Idle timeout of 5 minutes
set interfaces pppoe pppoe0 idle-timeout 300

# Holdoff of 30 seconds before reconnect
set interfaces pppoe pppoe0 holdoff 30

commit
save

Behavior:

The connection is established when traffic appears
After 300 seconds without traffic - disconnect
A 30-second pause before the next connect
Reconnect when new traffic appears

Testing:

# Check the status (should be down when idle)
show interfaces pppoe pppoe0

# Generate traffic
ping 8.8.8.8

# Check the connection (should come up)
show interfaces pppoe pppoe0

# Wait 5 minutes without traffic - disconnect

Scenario 6: PPPoE in VK Cloud

Goal: Use VyOS in VK Cloud to test a PPPoE server

Topology:

[VK Cloud VyOS Client] ---- [Private Network] ---- [VyOS PPPoE Server]

Client configuration:

configure

# PPPoE client in the cloud
set interfaces pppoe pppoe0 source-interface eth1
set interfaces pppoe pppoe0 authentication username 'testuser'
set interfaces pppoe pppoe0 authentication password 'TestPass123'
set interfaces pppoe pppoe0 default-route none
set interfaces pppoe pppoe0 mtu 1450
set interfaces pppoe pppoe0 description 'VK Cloud PPPoE Test'

commit
save

Notes for VK Cloud:

MTU in VK Cloud: 1500, use a PPPoE MTU of 1450
PPPoE works in private networks
For production, use VPC peering instead of PPPoE

Scenario 7: Russian DSL Providers

Configuration for a typical Russian DSL provider:

configure

# Rostelecom / MTS / Beeline DSL
set interfaces pppoe pppoe0 source-interface eth0
set interfaces pppoe pppoe0 authentication username 'login@provider'
set interfaces pppoe pppoe0 authentication password 'password'
set interfaces pppoe pppoe0 default-route auto
set interfaces pppoe pppoe0 mtu 1492

# Some providers require a service-name
# set interfaces pppoe pppoe0 service-name 'Internet'

# LAN network
set interfaces ethernet eth1 address 192.168.0.1/24

# NAT
set nat source rule 100 outbound-interface name pppoe0
set nat source rule 100 source address 192.168.0.0/24
set nat source rule 100 translation address masquerade

# DNS from the provider (automatic over PPPoE)
set system name-server pppoe0

# DHCP for the LAN
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 range 0 start 192.168.0.100
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 range 0 stop 192.168.0.200
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 option default-router 192.168.0.1

commit
save

Characteristics of Russian providers:

An MTU of 1492 is often used
Username format: login@provider or login
Some require VLAN tagging
IPTV may require a separate VLAN

Monitoring and Debugging

Checking PPPoE Status

# General information
show interfaces pppoe

# Detailed information for a specific interface
show interfaces pppoe pppoe0

# Brief output
show interfaces pppoe pppoe0 brief

# Statistics
show interfaces pppoe pppoe0 statistics

Example output:

pppoe0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492
    inet 203.0.113.45 peer 203.0.113.1/32
    RX: bytes    packets  errors  dropped  overrun       mcast
        10485760    8192       0        0        0           0
    TX: bytes    packets  errors  dropped carrier collisions
         5242880    4096       0        0       0           0

Operational Commands

# Disconnect the PPPoE connection
disconnect interface pppoe0

# Connect the PPPoE connection
connect interface pppoe0

# Check PPPoE log messages
show log | match pppoe

# Check the authentication log
show log auth | match pppoe

Debugging PPPoE

# Enable debug for PPPoE
debug pppoe interface pppoe0

# View the debug output
show log tail

# Disable debug
no debug pppoe interface pppoe0

Debug information includes:

Discovery packets (PADI, PADO, PADR, PADS)
LCP negotiation
Authentication attempts
IP address assignment
Keepalive packets

Packet Capture

# Capture PPPoE traffic on the source interface
monitor traffic interface eth0 filter "pppoe"

# Capture traffic on the PPPoE interface
monitor traffic interface pppoe0

# Save the capture to a file
monitor traffic interface eth0 filter "pppoe" save /tmp/pppoe-capture.pcap

Analysis in Wireshark:

PPPoE Discovery packets (0x8863)
PPPoE Session packets (0x8864)
LCP/CHAP/PAP frames
IP packets inside PPPoE

Checking DNS

# DNS servers obtained from the ISP
show interfaces pppoe pppoe0 | grep "name-server"

# DNS resolution test
nslookup google.com

Performance Monitoring

# Bandwidth monitoring
monitor bandwidth interface pppoe0

# Real-time traffic statistics
show interfaces pppoe pppoe0 statistics

# Connection uptime
show interfaces pppoe pppoe0 | grep "uptime"

Troubleshooting

Problem: PPPoE does not establish a connection

Symptoms:

The interface is in the DOWN state
No IP address

Diagnostics:

# 1. Check the source interface
show interfaces ethernet eth0

# It must be UP
# If DOWN - check the physical connection

# 2. Check the PPPoE logs
show log | match pppoe

# 3. Enable debug
debug pppoe interface pppoe0

# 4. Attempt to connect
connect interface pppoe0

# 5. Check the debug output
show log tail

Common causes:

Source interface DOWN:

# Check the link
show interfaces ethernet eth0
# Solution: check the cable and the DSL modem

Incorrect credentials:

# In the logs: "authentication failed"
# Solution: verify the username/password
set interfaces pppoe pppoe0 authentication username 'correct-user'
set interfaces pppoe pppoe0 authentication password 'correct-pass'
commit

DSL modem not in bridge mode:

# The modem establishes PPPoE itself
# Solution: switch the modem to bridge mode (router mode -> bridge mode)

VLAN required:

# The ISP requires VLAN tagging
# Solution: use a VLAN interface
set interfaces ethernet eth0 vif 100
set interfaces pppoe pppoe0 source-interface eth0.100
commit

Problem: The connection comes up, but there is no internet

Diagnostics:

# 1. Check the IP address
show interfaces pppoe pppoe0
# Should be a public IP or a carrier-grade NAT IP (100.64.0.0/10)

# 2. Check the default route
show ip route 0.0.0.0/0
# Should point to pppoe0

# 3. Ping the ISP gateway
ping 203.0.113.1 interface pppoe0

# 4. Ping a public IP
ping 8.8.8.8 interface pppoe0

# 5. Check DNS
nslookup google.com

# 6. Check NAT
show nat source statistics

Solutions:

No default route:

set interfaces pppoe pppoe0 default-route force
commit

DNS not working:

# Use DNS from the ISP
set system name-server pppoe0

# Or public DNS
set system name-server 8.8.8.8
set system name-server 8.8.4.4
commit

NAT not configured:

set nat source rule 100 outbound-interface name pppoe0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade
commit

Problem: Frequent disconnects/reconnects

Symptoms:

PPPoE keeps reconnecting
In the logs: “LCP terminated”

Diagnostics:

# 1. Check uptime
show interfaces pppoe pppoe0 | grep uptime

# 2. Check the logs
show log | match "pppoe0"

# 3. Error statistics
show interfaces pppoe pppoe0 statistics

Causes and solutions:

DSL line problems:

# Poor line quality, interference
# Solution: check the DSL modem statistics, SNR, attenuation
# Contact the provider to check the line

MTU problems:

# Packets dropping because of MTU
# Solution: reduce the MTU
set interfaces pppoe pppoe0 mtu 1480
set interfaces pppoe pppoe0 ip adjust-mss 1440
commit

ISP keepalive timeout:

# The ISP drops the connection due to lack of traffic
# If idle-timeout is enabled - disable it
delete interfaces pppoe pppoe0 idle-timeout
delete interfaces pppoe pppoe0 connect-on-demand
commit

Duplicate MAC addresses:

# Check that no other device with the same MAC exists on the source interface
show interfaces ethernet eth0

Problem: Low speed

Diagnostics:

# 1. Bandwidth test with iperf3
# On the server (public IP)
iperf3 -s

# On VyOS
iperf3 -c server-ip -i 1 -t 30

# 2. Check MTU
ping 8.8.8.8 size 1472 do-not-fragment interface pppoe0

# 3. Check CPU usage
show system resources

# 4. Interface statistics
show interfaces pppoe pppoe0 statistics

Solutions:

MTU fragmentation:

# Path MTU Discovery
# Reduce the MTU
set interfaces pppoe pppoe0 mtu 1480
set interfaces pppoe pppoe0 mru 1480
set interfaces pppoe pppoe0 ip adjust-mss 1440
commit

Hardware offloading:

# Enable offloading on the source interface
set interfaces ethernet eth0 offload gso
set interfaces ethernet eth0 offload gro
set interfaces ethernet eth0 offload tso
commit

QoS shaping (if the ISP is throttling):

# Traffic shaping to the plan speed
set traffic-policy shaper ISP-LIMIT bandwidth 100mbit
set traffic-policy shaper ISP-LIMIT default bandwidth 100%

set interfaces pppoe pppoe0 traffic-policy out ISP-LIMIT
commit

Problem: IPv6 not working

Diagnostics:

# 1. Check the IPv6 address
show ipv6 interface pppoe0

# 2. Check DHCPv6-PD
show dhcpv6 client leases

# 3. IPv6 routing
show ipv6 route

# 4. Ping IPv6
ping 2001:4860:4860::8888 interface pppoe0

Solutions:

# Enable IPv6 autoconfig
set interfaces pppoe pppoe0 ipv6 address autoconf

# Configure DHCPv6-PD
set interfaces pppoe pppoe0 dhcpv6-options pd 0 length 56
set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address 1

# Verify the ISP supports IPv6
# If not - use a tunnel broker (6in4, 6rd)

Security Best Practices

1. Protecting Credentials

# Never use plaintext-password in production
# Use password (it is hashed automatically)
set interfaces pppoe pppoe0 authentication password 'SecurePassword123!'

# Restrict access to the configuration
set system login user admin authentication plaintext-password 'AdminPassword'
set system login user admin level admin

2. Firewall on the WAN

# Create a firewall for the PPPoE interface
set firewall name WAN-IN default-action drop
set firewall name WAN-IN rule 10 action accept
set firewall name WAN-IN rule 10 state established enable
set firewall name WAN-IN rule 10 state related enable

set firewall name WAN-IN rule 20 action drop
set firewall name WAN-IN rule 20 state invalid enable

# Apply it to PPPoE
set interfaces pppoe pppoe0 firewall in name WAN-IN

commit

3. Restricting Incoming Connections

# Allow only established/related
set firewall name WAN-IN default-action drop
set firewall name WAN-IN enable-default-log

set firewall name WAN-IN rule 10 action accept
set firewall name WAN-IN rule 10 state established enable
set firewall name WAN-IN rule 10 state related enable

set firewall name WAN-IN rule 999 action drop
set firewall name WAN-IN rule 999 log enable

commit

4. Rate Limiting

# DDoS protection
set firewall name WAN-IN rule 5 action drop
set firewall name WAN-IN rule 5 protocol icmp
set firewall name WAN-IN rule 5 limit rate 10/second
set firewall name WAN-IN rule 5 limit burst 20

commit

5. Connection Monitoring

# Logging PPPoE events
set system syslog global facility all level info

# Sending logs to a syslog server
set system syslog host 192.168.1.100 facility all level warning

# Email alerts on disconnect
# (requires configuring a mail relay)

Performance Tuning

1. MTU Optimization

# Optimal MTU for PPPoE
set interfaces pppoe pppoe0 mtu 1492
set interfaces pppoe pppoe0 mru 1492

# TCP MSS clamping
set interfaces pppoe pppoe0 ip adjust-mss 1452
set interfaces pppoe pppoe0 ipv6 adjust-mss 1432

commit

2. Hardware Offloading

# Enable offloading on the source interface
set interfaces ethernet eth0 offload gso
set interfaces ethernet eth0 offload gro
set interfaces ethernet eth0 offload sg
set interfaces ethernet eth0 offload tso

commit

3. Buffer Tuning

# Increase ring buffers (if the NIC supports it)
# Check the current values
ethtool -g eth0

# Set the maximum values (via the shell)
# ethtool -G eth0 rx 4096 tx 4096

4. QoS for VoIP/Gaming

# Priority queueing for low latency
set traffic-policy shaper GAMING class 10 match VoIP ip protocol udp
set traffic-policy shaper GAMING class 10 match VoIP ip source port 5060-5090
set traffic-policy shaper GAMING class 10 bandwidth 10%
set traffic-policy shaper GAMING class 10 priority 7

set traffic-policy shaper GAMING class 20 match Gaming ip dscp cs4
set traffic-policy shaper GAMING class 20 bandwidth 30%
set traffic-policy shaper GAMING class 20 priority 5

set traffic-policy shaper GAMING default bandwidth 60%
set traffic-policy shaper GAMING default priority 1

set interfaces pppoe pppoe0 traffic-policy out GAMING
commit

Advanced Configuration

Load Balancing over Two PPPoE Links (Dual WAN)

configure

# PPPoE 1
set interfaces pppoe pppoe0 source-interface eth0
set interfaces pppoe pppoe0 authentication username 'user1@isp1.ru'
set interfaces pppoe pppoe0 authentication password 'Pass1'
set interfaces pppoe pppoe0 default-route none

# PPPoE 2
set interfaces pppoe pppoe1 source-interface eth1
set interfaces pppoe pppoe1 authentication username 'user2@isp2.ru'
set interfaces pppoe pppoe1 authentication password 'Pass2'
set interfaces pppoe pppoe1 default-route none

# Load balancing configuration
set load-balancing wan interface-health pppoe0 nexthop pppoe0
set load-balancing wan interface-health pppoe0 test 10 type ping
set load-balancing wan interface-health pppoe0 test 10 target 8.8.8.8

set load-balancing wan interface-health pppoe1 nexthop pppoe1
set load-balancing wan interface-health pppoe1 test 10 type ping
set load-balancing wan interface-health pppoe1 test 10 target 8.8.4.4

set load-balancing wan rule 1 inbound-interface eth2
set load-balancing wan rule 1 interface pppoe0 weight 1
set load-balancing wan rule 1 interface pppoe1 weight 1

commit
save

PPPoE Server on VyOS

VyOS can act as a PPPoE server:

configure

# PPPoE server
set service pppoe-server interface eth1
set service pppoe-server authentication mode local
set service pppoe-server authentication local-users username client1 password 'ClientPass1'
set service pppoe-server client-ip-pool start 10.255.0.2
set service pppoe-server client-ip-pool stop 10.255.0.254
set service pppoe-server gateway-address 10.255.0.1
set service pppoe-server name-server 8.8.8.8
set service pppoe-server name-server 8.8.4.4

commit
save

Use case: Providing PPPoE access to clients

Comparison of PPPoE vs DHCP vs Static IP

Characteristic	PPPoE	DHCP	Static IP
Authentication	Yes (username/password)	No	No
IP Assignment	Dynamic	Dynamic	Static
Session Management	Yes (connect/disconnect)	No	No
MTU	1492 (8 bytes overhead)	1500	1500
Setup Complexity	Medium	Low	Low
Typical use	DSL, FTTH	Home broadband, Cable	Business, Dedicated
Overhead	8 bytes PPPoE + 2 bytes PPP	0 bytes	0 bytes
ISP Control	High	Medium	Low

When to choose PPPoE:

The ISP requires authentication
DSL/ADSL connection
Session control is needed
Multiple users sharing a physical link

When to choose DHCP:

Cable modem
Simple home connection
No authentication requirements

When to choose Static IP:

Business connections
A permanent IP is needed
Server hosting
VPN endpoints

Best Practices

1. Naming Convention

# Use clear names
set interfaces pppoe pppoe0 description 'ISP-Rostelecom-Primary'
set interfaces pppoe pppoe1 description 'ISP-MTS-Backup'

2. MTU Configuration

# Always configure MTU and MSS
set interfaces pppoe pppoe0 mtu 1492
set interfaces pppoe pppoe0 ip adjust-mss 1452

# Test the optimal MTU
ping 8.8.8.8 size 1472 do-not-fragment interface pppoe0

3. Monitoring and Alerting

# Syslog for tracking events
set system syslog global facility all level info
set system syslog host 192.168.1.100 facility all level warning

# SNMP monitoring
set service snmp community public authorization ro
set service snmp community public network 192.168.1.0/24

4. Backup Configuration

# Regular configuration backup
show configuration commands | save /config/backup-$(date +%Y%m%d).conf

# Or automated backup
# Set it up in cron or an external script

5. Security

# A WAN firewall is mandatory
set firewall name WAN-IN default-action drop
set firewall name WAN-IN rule 10 action accept
set firewall name WAN-IN rule 10 state established enable
set firewall name WAN-IN rule 10 state related enable

set interfaces pppoe pppoe0 firewall in name WAN-IN

6. Documentation

# Document everything in the description
set interfaces pppoe pppoe0 description 'Main ISP - Contract #12345 - Support 8-800-XXX'

Migrating from VyOS 1.4 to 1.5

The PPPoE configuration is compatible across versions:

VyOS 1.4:

set interfaces pppoe pppoe0 source-interface eth0
set interfaces pppoe pppoe0 user-id 'username'
set interfaces pppoe pppoe0 password 'password'

VyOS 1.5:

set interfaces pppoe pppoe0 source-interface eth0
set interfaces pppoe pppoe0 authentication username 'username'
set interfaces pppoe pppoe0 authentication password 'password'

Migration script:

# The old configuration (1.4) is converted automatically
# It is recommended to use the new syntax (authentication username/password)

Conclusion

PPPoE remains an important protocol for connecting to internet service providers:

Advantages:

Built-in authentication
Session management
Broad provider support
IPv6 and DHCPv6-PD support

Applications:

DSL/ADSL connections
FTTH (Fiber to the Home)
Cable modems with PPPoE
ISP connections with authentication

Best practices:

Correct MTU (1492) and MSS clamping configuration
Firewall on the WAN interface
Monitoring and logging
Redundancy through dual PPPoE
Regular configuration backups

PPPoE in VyOS provides a reliable and flexible solution for connecting to internet service providers, for both home users and businesses, with full control over the network configuration and security.

Additional Resources

Reviewed by OpenNix LLC · Last updated on 29 July 2026

GENEVE - Generic Network Virtualization Encapsulation SSTP Client - Secure Socket Tunneling Protocol