Documentation
VyOS Documentation
VyOS Services
PPPoE Server

PPPoE Server

The PPPoE (Point-to-Point Protocol over Ethernet) server on VyOS uses accel-ppp to provide broadband Internet access. The solution is ideal for ISPs (Internet service providers), WISPs, and enterprise networks.

Overview

The VyOS PPPoE server provides:

  • Centralized subscriber authentication (local and RADIUS)
  • IP address management through pools
  • Bandwidth shaping
  • IPv6 and Prefix Delegation support
  • VLAN per client (automatic VLAN creation)
  • Session control and monitoring
  • Integration with billing systems via RADIUS

PPPoE is widely used by ISPs to deliver xDSL, FTTB (Fiber to the Building), and GPON services.

Basic Configuration

Minimal Setup

The simplest PPPoE server configuration:

# Access concentrator name
set service pppoe-server access-concentrator 'ISP-AC-01'

# Interface for receiving PPPoE requests
set service pppoe-server interface eth1

# Gateway address (handed to clients as the default route)
set service pppoe-server gateway-address '10.1.1.1'

# IP address pool for clients
set service pppoe-server client-ip-pool CLIENTS range '10.1.1.100-10.1.1.254'
set service pppoe-server default-pool 'CLIENTS'

# Local authentication
set service pppoe-server authentication mode 'local'
set service pppoe-server authentication local-users username 'client1' password 'password123'

commit

Configuration Structure

service pppoe-server
  ├── access-concentrator <name>
  ├── interface <interface>
  ├── gateway-address <ip>
  ├── authentication
  │   ├── mode [local|radius]
  │   ├── local-users
  │   │   └── username <name>
  │   │       ├── password <password>
  │   │       ├── static-ip <ip>
  │   │       ├── rate-limit <download>/<upload>
  │   │       └── disable
  │   └── radius
  │       ├── server <ip>
  │       │   ├── key <secret>
  │       │   ├── port <port>
  │       │   └── acct-port <port>
  │       └── nas-identifier <id>
  ├── client-ip-pool <name>
  │   └── range <start-stop>
  ├── default-pool <pool-name>
  ├── client-ipv6-pool <name>
  │   ├── prefix <prefix>
  │   └── mask <bits>
  ├── name-server <dns-ip>
  ├── ppp-options
  │   ├── mtu <size>
  │   ├── mru <size>
  │   ├── lcp-echo-interval <seconds>
  │   ├── lcp-echo-failure <count>
  │   ├── ipv4 <mode>
  │   └── ipv6 [allow|deny|require]
  └── limits
      ├── burst <count>
      └── timeout <seconds>

Authentication

Local Authentication

Create users directly in the VyOS configuration.

Basic User

set service pppoe-server authentication mode 'local'
set service pppoe-server authentication local-users username 'user1' password 'SecurePass123'

User with a Static IP

set service pppoe-server authentication local-users username 'server1' password 'Pass456'
set service pppoe-server authentication local-users username 'server1' static-ip '10.1.1.50'

User with a Speed Limit

set service pppoe-server authentication local-users username 'user2' password 'Pass789'
set service pppoe-server authentication local-users username 'user2' rate-limit download '100000'
set service pppoe-server authentication local-users username 'user2' rate-limit upload '50000'

Speed is specified in Kbps (kilobits per second).

Disabling a User

Temporary disabling without deletion:

set service pppoe-server authentication local-users username 'user1' disable

RADIUS Authentication

Integration with external RADIUS servers for centralized subscriber management.

Basic RADIUS Setup

# Authentication mode
set service pppoe-server authentication mode 'radius'

# Primary RADIUS server
set service pppoe-server authentication radius server 192.168.10.10 key 'RadiusSecret123'

# Secondary RADIUS server (backup)
set service pppoe-server authentication radius server 192.168.10.11 key 'RadiusSecret123'

# NAS Identifier (to identify the server to RADIUS)
set service pppoe-server authentication radius nas-identifier 'PPPoE-Server-01'

Non-Standard RADIUS Ports

set service pppoe-server authentication radius server 192.168.10.10 key 'Secret'
set service pppoe-server authentication radius server 192.168.10.10 port 1812
set service pppoe-server authentication radius server 192.168.10.10 acct-port 1813

Default ports:

  • Authentication: 1812
  • Accounting: 1813

RADIUS Source

NAS IP address for RADIUS requests:

set service pppoe-server authentication radius source-address '192.168.10.1'

RADIUS Attributes

The RADIUS server can return attributes to control the session:

Vendor-Specific Attributes (VSA):

  • Filter-Id - bandwidth shaping profile name
  • Framed-IP-Address - static IP for the client
  • Framed-Route - static route
  • Rate-Limit - speed limit (format: download/upload)
  • Session-Timeout - maximum session duration

Example RADIUS response:

Framed-IP-Address = 10.1.1.100
Framed-Route = "192.168.50.0/24 10.1.1.100"
Filter-Id = "100M"
Session-Timeout = 86400

Authentication Protocols

PPPoE supports several authentication protocols.

PAP (Password Authentication Protocol)

The simplest protocol; the password is sent in cleartext (not recommended):

set service pppoe-server authentication protocols pap

CHAP (Challenge Handshake Authentication Protocol)

A more secure challenge-response protocol:

set service pppoe-server authentication protocols chap

MS-CHAP and MS-CHAPv2

Microsoft variants of CHAP:

set service pppoe-server authentication protocols mschap
set service pppoe-server authentication protocols mschap-v2

Recommended Configuration

# Allow CHAP and MS-CHAPv2, deny PAP
set service pppoe-server authentication protocols chap
set service pppoe-server authentication protocols mschap-v2

IP Address Management

IPv4 Pools

Single Pool

set service pppoe-server client-ip-pool POOL1 range '10.1.1.100-10.1.1.254'
set service pppoe-server default-pool 'POOL1'

Multiple Pools

For different subscriber groups or plans:

# Basic plan
set service pppoe-server client-ip-pool BASIC range '10.1.1.0-10.1.1.127'

# Premium plan
set service pppoe-server client-ip-pool PREMIUM range '10.1.2.0-10.1.2.255'

# Corporate clients
set service pppoe-server client-ip-pool CORPORATE range '10.1.10.0-10.1.10.127'

# Default pool
set service pppoe-server default-pool 'BASIC'

RADIUS can assign a specific pool through the Framed-Pool attribute.

Static IP Addresses

Via local authentication:

set service pppoe-server authentication local-users username 'static-user' static-ip '10.1.1.50'

Via RADIUS (attribute in the response):

Framed-IP-Address = 10.1.1.50

IPv6 Configuration

Enabling IPv6

set service pppoe-server ppp-options ipv6 'allow'

IPv6 modes:

  • allow - allow IPv6 if the client requests it
  • deny - deny IPv6
  • require - require IPv6 (mandatory)

IPv6 Address Pool

Handing out individual IPv6 addresses:

set service pppoe-server client-ipv6-pool IPv6-POOL prefix '2001:db8:1000::/48'
set service pppoe-server client-ipv6-pool IPv6-POOL mask '64'

Each client is assigned a /64 prefix from the specified pool.

IPv6 Prefix Delegation

Delegating prefixes to clients (for routers):

set service pppoe-server client-ipv6-pool IPv6-POOL-PD prefix '2001:db8:2000::/40'
set service pppoe-server client-ipv6-pool IPv6-POOL-PD delegate '2001:db8:2000::/48'

The client receives a /48 prefix for use in its own network.

DNS Servers

Specifying DNS servers for clients:

set service pppoe-server name-server '8.8.8.8'
set service pppoe-server name-server '8.8.4.4'

For IPv6:

set service pppoe-server name-server '2001:4860:4860::8888'
set service pppoe-server name-server '2001:4860:4860::8844'

VLAN Configuration

VLAN per Client

Automatic creation of VLAN interfaces for each client.

Basic VLAN Configuration

# Allow reception on VLAN interfaces
set service pppoe-server interface eth1 vlan '100-200'

The PPPoE server will accept requests on eth1.100, eth1.101, … eth1.200.

Specific VLANs

set service pppoe-server interface eth1 vlan '10'
set service pppoe-server interface eth1 vlan '20'
set service pppoe-server interface eth1 vlan '30'

Multiple Interfaces with VLANs

# DSL aggregation on eth1
set service pppoe-server interface eth1 vlan '100-200'

# Ethernet subscribers on eth2
set service pppoe-server interface eth2 vlan '500-600'

Dynamic VLAN Creation

The PPPoE server automatically creates VLAN interfaces when clients connect:

set service pppoe-server interface eth1 vlan '1-4094'

Important: Make sure the switch is configured to pass the corresponding VLAN tags (trunk/tagged port).

VLAN + IP Pool Mapping

Different pools for different VLANs (through external logic in RADIUS):

The RADIUS server can analyze the NAS-Port-Id (which contains the VLAN ID) and return the appropriate Framed-Pool attribute.

Bandwidth Shaping

Local Speed Limiting

For users with local authentication:

set service pppoe-server authentication local-users username 'user1' rate-limit download '50000'
set service pppoe-server authentication local-users username 'user1' rate-limit upload '25000'

Speed in Kbps:

  • 50000 = 50 Mbps download
  • 25000 = 25 Mbps upload

RADIUS-Based Shaping

RADIUS can control speed through attributes:

FreeRADIUS response example:

# In the users file
user1 Cleartext-Password := "password"
    Filter-Id := "rate-limit=100000/50000"

Format: rate-limit=download/upload (in Kbps)

Alternative via VSA:

user1 Cleartext-Password := "password"
    WISPr-Bandwidth-Max-Down := 100000000,
    WISPr-Bandwidth-Max-Up := 50000000

Speed in bps (bits per second).

Burst Configuration

Allowing a brief overshoot of the limit:

set service pppoe-server shaper fwmark '10'

For more advanced shaping, use accel-ppp’s built-in capabilities through extended scripting.

PPP Options

MTU and MRU

Maximum packet size:

set service pppoe-server ppp-options mtu '1492'
set service pppoe-server ppp-options mru '1492'

Standard values:

  • PPPoE MTU: 1492 (1500 - 8 bytes PPPoE header)
  • For tunnels (PPPoE + L2TP): 1460 or lower

LCP Echo

Keep-alive mechanism for detecting disconnected sessions:

set service pppoe-server ppp-options lcp-echo-interval '30'
set service pppoe-server ppp-options lcp-echo-failure '3'
  • lcp-echo-interval - interval for sending LCP Echo-Request (seconds)
  • lcp-echo-failure - number of failed attempts before the connection is torn down

Example: An interval of 30 seconds and 3 attempts means the session is torn down after 90 seconds without a response.

IPv4 Modes

set service pppoe-server ppp-options ipv4 'allow'

Modes:

  • allow - allow IPv4
  • deny - deny IPv4
  • require - require IPv4

MPPE Encryption

Microsoft Point-to-Point Encryption:

set service pppoe-server ppp-options mppe 'prefer'

Modes:

  • require - require MPPE
  • prefer - prefer MPPE
  • deny - deny MPPE

Note: MPPE requires MS-CHAPv2 authentication.

IPCP Options

IP Control Protocol settings:

set service pppoe-server ppp-options ipv4-peer-dns

Send DNS servers to the client via IPCP.

Session Control

Maximum Number of Sessions

Limit on the number of simultaneous connections for a single user:

set service pppoe-server session-control max-sessions '1'

Prevents multiple connections from a single account.

Timeouts

Session Timeout

Maximum session duration (after it expires, the session is disconnected automatically):

set service pppoe-server limits timeout '86400'

Value in seconds (86400 = 24 hours).

Can also be controlled through the RADIUS Session-Timeout attribute.

Idle Timeout

Disconnection when there is no traffic:

set service pppoe-server limits idle-timeout '600'

The session is torn down if there is no traffic for 600 seconds (10 minutes).

Burst Parameters

Limit on simultaneous new connections (protection against flooding):

set service pppoe-server limits burst '10'

At most 10 new sessions can be established simultaneously.

Interface Renaming

Custom naming of PPP interfaces:

set service pppoe-server ppp-options interface-name 'pppoe-{username}'

Interfaces will be named pppoe-user1, pppoe-user2, and so on.

Extended Scripting

Accel-ppp supports running scripts on various events.

Available Events

set service pppoe-server extended-scripts on-pre-up '/config/scripts/pppoe-pre-up.sh'
set service pppoe-server extended-scripts on-up '/config/scripts/pppoe-up.sh'
set service pppoe-server extended-scripts on-down '/config/scripts/pppoe-down.sh'
set service pppoe-server extended-scripts on-change '/config/scripts/pppoe-change.sh'

Events:

  • on-pre-up - before the session is established
  • on-up - after the session is successfully established
  • on-down - after the session is torn down
  • on-change - when session parameters change

Example Script

File /config/scripts/pppoe-up.sh:

#!/bin/bash
# Environment variables available in the script:
# $IFNAME - interface name (ppp0, ppp1, ...)
# $PEERNAME - username
# $CALLING_SID - client MAC address
# $CALLED_SID - server MAC address
# $IP - client IP address
# $IP6 - client IPv6 address (if any)

echo "$(date): User $PEERNAME connected on $IFNAME with IP $IP" >> /var/log/pppoe-sessions.log

# For example, sending a notification
curl -X POST "https://billing.example.ru/api/session-start" \
  -d "username=$PEERNAME&ip=$IP&interface=$IFNAME"

Make the script executable:

sudo chmod +x /config/scripts/pppoe-up.sh

Billing Integration

Scripts can call the billing system’s API for:

  • Session start/stop notifications
  • Statistics updates
  • Balance management
  • Event logging

Configuration Examples

Home ISP (Basic Configuration)

# Core parameters
set service pppoe-server access-concentrator 'HomeISP-AC'
set service pppoe-server interface eth1

# Gateway and DNS
set service pppoe-server gateway-address '10.10.1.1'
set service pppoe-server name-server '8.8.8.8'
set service pppoe-server name-server '8.8.4.4'

# IP pool
set service pppoe-server client-ip-pool HOME range '10.10.1.100-10.10.1.254'
set service pppoe-server default-pool 'HOME'

# Local authentication
set service pppoe-server authentication mode 'local'
set service pppoe-server authentication protocols chap
set service pppoe-server authentication protocols mschap-v2

# Users
set service pppoe-server authentication local-users username 'client1' password 'Pass123'
set service pppoe-server authentication local-users username 'client1' rate-limit download '100000'
set service pppoe-server authentication local-users username 'client1' rate-limit upload '100000'

# PPP options
set service pppoe-server ppp-options mtu '1492'
set service pppoe-server ppp-options lcp-echo-interval '30'
set service pppoe-server ppp-options lcp-echo-failure '3'

# Session control
set service pppoe-server session-control max-sessions '1'
set service pppoe-server limits burst '5'

commit

ISP with RADIUS and VLANs (Advanced Configuration)

# Core parameters
set service pppoe-server access-concentrator 'ISP-Metro-AC-01'

# Interfaces with VLANs
set service pppoe-server interface eth1 vlan '100-199'
set service pppoe-server interface eth2 vlan '200-299'

# Gateway
set service pppoe-server gateway-address '10.0.0.1'

# DNS servers
set service pppoe-server name-server '10.0.0.53'
set service pppoe-server name-server '8.8.8.8'

# IP pools
set service pppoe-server client-ip-pool RESIDENTIAL range '10.100.0.0-10.100.255.254'
set service pppoe-server client-ip-pool BUSINESS range '10.200.0.0-10.200.127.254'
set service pppoe-server client-ip-pool PREMIUM range '10.250.0.0-10.250.63.254'
set service pppoe-server default-pool 'RESIDENTIAL'

# RADIUS authentication
set service pppoe-server authentication mode 'radius'
set service pppoe-server authentication protocols chap
set service pppoe-server authentication protocols mschap-v2

# Primary RADIUS
set service pppoe-server authentication radius server 10.0.10.10 key 'SuperSecretKey123'
set service pppoe-server authentication radius server 10.0.10.10 port 1812
set service pppoe-server authentication radius server 10.0.10.10 acct-port 1813

# Backup RADIUS
set service pppoe-server authentication radius server 10.0.10.11 key 'SuperSecretKey123'

# RADIUS settings
set service pppoe-server authentication radius nas-identifier 'PPPoE-AC-01'
set service pppoe-server authentication radius source-address '10.0.10.1'

# PPP options
set service pppoe-server ppp-options mtu '1492'
set service pppoe-server ppp-options mru '1492'
set service pppoe-server ppp-options lcp-echo-interval '30'
set service pppoe-server ppp-options lcp-echo-failure '4'
set service pppoe-server ppp-options ipv4 'allow'

# IPv6
set service pppoe-server ppp-options ipv6 'allow'
set service pppoe-server client-ipv6-pool IPv6-POOL prefix '2001:db8::/32'
set service pppoe-server client-ipv6-pool IPv6-POOL mask '64'

# Session control
set service pppoe-server session-control max-sessions '1'
set service pppoe-server limits burst '20'
set service pppoe-server limits timeout '86400'

# Extended scripts
set service pppoe-server extended-scripts on-up '/config/scripts/billing-session-start.sh'
set service pppoe-server extended-scripts on-down '/config/scripts/billing-session-stop.sh'

commit

FTTB ISP with Dual-Stack IPv4/IPv6

# Core parameters
set service pppoe-server access-concentrator 'FTTB-ISP'
set service pppoe-server interface eth1

# Gateway addresses
set service pppoe-server gateway-address '10.20.0.1'

# DNS servers (dual-stack)
set service pppoe-server name-server '10.20.0.53'
set service pppoe-server name-server '2001:db8:20::53'
set service pppoe-server name-server '8.8.8.8'
set service pppoe-server name-server '2001:4860:4860::8888'

# IPv4 pools
set service pppoe-server client-ip-pool POOL-v4 range '10.20.1.0-10.20.254.254'
set service pppoe-server default-pool 'POOL-v4'

# IPv6 pools
set service pppoe-server ppp-options ipv6 'require'
set service pppoe-server client-ipv6-pool POOL-v6 prefix '2001:db8:1000::/36'
set service pppoe-server client-ipv6-pool POOL-v6 mask '56'

# Prefix Delegation for client routers
set service pppoe-server client-ipv6-pool POOL-v6-PD prefix '2001:db8:2000::/36'
set service pppoe-server client-ipv6-pool POOL-v6-PD delegate '2001:db8:2000::/48'

# RADIUS
set service pppoe-server authentication mode 'radius'
set service pppoe-server authentication protocols chap
set service pppoe-server authentication protocols mschap-v2
set service pppoe-server authentication radius server 10.20.0.10 key 'RadiusKey'
set service pppoe-server authentication radius nas-identifier 'FTTB-PPPoE'

# PPP options
set service pppoe-server ppp-options mtu '1492'
set service pppoe-server ppp-options mru '1492'
set service pppoe-server ppp-options lcp-echo-interval '30'
set service pppoe-server ppp-options lcp-echo-failure '3'
set service pppoe-server ppp-options ipv4 'require'

# Session control
set service pppoe-server session-control max-sessions '1'

commit

ISP with Tariff Plans

# Core parameters
set service pppoe-server access-concentrator 'RU-ISP-Moscow'
set service pppoe-server interface eth1 vlan '10-20'
set service pppoe-server gateway-address '10.77.0.1'

# DNS servers (Yandex DNS)
set service pppoe-server name-server '77.88.8.8'
set service pppoe-server name-server '77.88.8.1'

# Pools by tariff
# "Basic" plan - 50 Mbps
set service pppoe-server client-ip-pool BASIC range '10.77.10.0-10.77.10.255'

# "Optimal" plan - 100 Mbps
set service pppoe-server client-ip-pool OPTIMAL range '10.77.20.0-10.77.20.255'

# "Maximum" plan - 200 Mbps
set service pppoe-server client-ip-pool MAXIMUM range '10.77.30.0-10.77.30.255'

set service pppoe-server default-pool 'BASIC'

# RADIUS (billing)
set service pppoe-server authentication mode 'radius'
set service pppoe-server authentication protocols mschap-v2
set service pppoe-server authentication radius server 10.77.0.100 key 'BillingSecret'
set service pppoe-server authentication radius nas-identifier 'Moscow-PPPoE-1'

# PPP options
set service pppoe-server ppp-options mtu '1492'
set service pppoe-server ppp-options lcp-echo-interval '20'
set service pppoe-server ppp-options lcp-echo-failure '3'

# Session control
set service pppoe-server session-control max-sessions '1'
set service pppoe-server limits idle-timeout '1800'

commit

FreeRADIUS configuration for the tariffs (users file):

# Basic plan - 50 Mbps
user-basic Cleartext-Password := "password"
    Framed-Pool := "BASIC",
    Filter-Id := "rate-limit=51200/25600"

# Optimal plan - 100 Mbps
user-optimal Cleartext-Password := "password"
    Framed-Pool := "OPTIMAL",
    Filter-Id := "rate-limit=102400/51200"

# Maximum plan - 200 Mbps
user-maximum Cleartext-Password := "password"
    Framed-Pool := "MAXIMUM",
    Filter-Id := "rate-limit=204800/102400"

# Static IP for a business client
business-client Cleartext-Password := "password"
    Framed-IP-Address := "10.77.100.50",
    Filter-Id := "rate-limit=204800/102400"

Operational Commands

Viewing Active Sessions

All sessions:

show pppoe-server sessions

Output:

Interface  Username     IP Address       Calling-SID         Uptime
---------  ------------ ---------------  ------------------  --------
ppp0       client1      10.10.1.100      00:11:22:33:44:55   00:15:32
ppp1       client2      10.10.1.101      aa:bb:cc:dd:ee:ff   01:23:45

Detailed information for an interface:

show pppoe-server sessions ifname ppp0

By user:

show pppoe-server sessions username client1

Statistics

Server statistics:

show pppoe-server statistics

Disconnecting a Client

Forcibly disconnecting a session:

disconnect pppoe-server username client1

By interface:

disconnect pppoe-server interface ppp0

Restarting the Server

restart pppoe-server

Warning: Restarting will tear down all active sessions!

Logs

Viewing PPPoE logs:

show log pppoe

Real-time monitoring:

monitor log | match pppoe

Detailed accel-ppp logs:

tail -f /var/log/accel-ppp/accel-ppp.log

Monitoring and Debugging

Debug Mode

Enabling detailed logging:

set service pppoe-server log level debug
commit

Log levels:

  • error - errors only
  • warn - warnings and errors
  • info - informational messages (default)
  • debug - detailed debugging

SNMP Monitoring

PPPoE statistics are available through SNMP (when an SNMP agent is configured).

OIDs for accel-ppp:

  • Number of active sessions: .1.3.6.1.4.1.8072.1.3.2.4.1.2.9.97.99.99.101.108.45.112.112.112.1

Collecting Statistics

Monitoring script (/config/scripts/pppoe-stats.sh):

#!/bin/bash
SESSIONS=$(run show pppoe-server sessions | grep ppp | wc -l)
echo "Active PPPoE sessions: $SESSIONS"

# Sending to the monitoring system
curl -X POST "http://monitoring.example.ru/api/metrics" \
  -d "metric=pppoe.sessions&value=$SESSIONS"

Running it on a schedule via cron:

set system task-scheduler task pppoe-stats executable path '/config/scripts/pppoe-stats.sh'
set system task-scheduler task pppoe-stats interval '5m'

Packet Capture

Capturing PPPoE traffic for debugging:

sudo tcpdump -i eth1 -n pppoe

With detailed output:

sudo tcpdump -i eth1 -vvv -n pppoe

Saving to a file:

sudo tcpdump -i eth1 -w /tmp/pppoe.pcap pppoe

Troubleshooting

Clients Cannot Connect

Check the Server Status

show service pppoe-server

The server must be running and listening on the correct interface.

Check the Interface

show interfaces ethernet eth1

The interface must be UP. For VLANs, check the trunk configuration on the switch.

Check VLANs

If VLANs are used, make sure the tags are passing through:

sudo tcpdump -i eth1 -n vlan

Check Authentication

Local authentication:

show service pppoe-server authentication local-users

RADIUS:

show service pppoe-server authentication radius

Testing RADIUS with radtest:

sudo radtest username password 192.168.10.10 0 secret

Logs

show log pppoe | tail 50

Common errors:

  • Authentication failed - incorrect password
  • No free IP address - IP pool exhausted
  • Maximum sessions reached - session limit exceeded

Running Out of IP Addresses

Check pool usage:

show pppoe-server sessions | grep ppp | wc -l

Increase the range:

set service pppoe-server client-ip-pool POOL range '10.1.1.0-10.1.2.254'
commit

Or clear stale sessions:

restart pppoe-server

RADIUS Not Responding

Check reachability:

ping 192.168.10.10

Test RADIUS:

sudo apt install freeradius-utils
radtest username password 192.168.10.10:1812 0 secret

Check the firewall on the RADIUS server (UDP ports 1812, 1813).

Verify the shared secret in both the VyOS and RADIUS configurations.

Speed Limited Incorrectly

Check rate-limit in the configuration:

show service pppoe-server authentication local-users username user1

For RADIUS, check the attributes in the response:

radtest -t pap user1 password 192.168.10.10 0 secret

Make sure RADIUS returns Filter-Id in the correct format:

Filter-Id = "rate-limit=102400/51200"

Sessions Dropping

Check the LCP echo parameters:

show service pppoe-server ppp-options

Increase the timeouts:

set service pppoe-server ppp-options lcp-echo-interval '60'
set service pppoe-server ppp-options lcp-echo-failure '5'
commit

Check the idle timeout:

set service pppoe-server limits idle-timeout '0'

A value of 0 disables the idle timeout.

MTU Problems

Clients report issues with certain sites (usually HTTPS).

Reduce the MTU:

set service pppoe-server ppp-options mtu '1480'
set service pppoe-server ppp-options mru '1480'
commit

On the client side, MSS clamping may also be required:

set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 protocol tcp
set firewall ipv4 forward filter rule 100 tcp flags syn
set firewall ipv4 forward filter rule 100 tcp mss 1400-1460

IPv6 Not Working

Check that IPv6 is allowed:

show service pppoe-server ppp-options ipv6

Check the IPv6 pools:

show service pppoe-server client-ipv6-pool

Make sure the client is requesting IPv6 (support in the PPPoE client).

Billing Integration

FreeRADIUS Integration

VyOS configuration:

set service pppoe-server authentication mode 'radius'
set service pppoe-server authentication radius server 192.168.1.10 key 'secret123'
set service pppoe-server authentication radius nas-identifier 'PPPoE-Server-1'

FreeRADIUS /etc/freeradius/3.0/clients.conf:

client vyos-pppoe {
    ipaddr = 192.168.1.1
    secret = secret123
    nastype = other
}

FreeRADIUS /etc/freeradius/3.0/mods-config/files/authorize:

# User with a 100 Mbps plan
user1 Cleartext-Password := "password123"
    Framed-IP-Address := "10.1.1.100",
    Filter-Id := "rate-limit=102400/51200",
    Reply-Message := "Welcome to ISP Network"

UTM/Billing Systems

Popular billing systems for ISPs:

  • UTM5 - integration via RADIUS
  • NetUP - RADIUS + API
  • ISPsystem BILLmanager - RADIUS + webhooks
  • Asterisk - RADIUS accounting

Example integration via an API (extended scripts):

/config/scripts/billing-session-start.sh:

#!/bin/bash
# Sending a session-start event to the billing system
curl -X POST "https://billing.isp.ru/api/v1/session/start" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"username\": \"$PEERNAME\",
    \"ip\": \"$IP\",
    \"mac\": \"$CALLING_SID\",
    \"interface\": \"$IFNAME\",
    \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
  }"

/config/scripts/billing-session-stop.sh:

#!/bin/bash
# Sending a session-stop event
curl -X POST "https://billing.isp.ru/api/v1/session/stop" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"username\": \"$PEERNAME\",
    \"interface\": \"$IFNAME\",
    \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
  }"

Configuring it in VyOS:

set service pppoe-server extended-scripts on-up '/config/scripts/billing-session-start.sh'
set service pppoe-server extended-scripts on-down '/config/scripts/billing-session-stop.sh'

RADIUS Accounting

For detailed accounting of traffic and session time, RADIUS accounting works automatically when RADIUS is configured.

RADIUS attributes in Accounting packets:

  • Acct-Session-Id - unique session ID
  • Acct-Input-Octets - inbound traffic (bytes)
  • Acct-Output-Octets - outbound traffic (bytes)
  • Acct-Session-Time - session duration (seconds)
  • Acct-Terminate-Cause - termination reason

Accounting Update interval (interim updates):

set service pppoe-server authentication radius acct-interim-interval '600'

The billing system will receive updates every 600 seconds (10 minutes).

Security and Best Practices

1. Use Secure Authentication Protocols

Avoid PAP; use CHAP or MS-CHAPv2:

set service pppoe-server authentication protocols chap
set service pppoe-server authentication protocols mschap-v2

2. Limit the Number of Sessions

One session per user:

set service pppoe-server session-control max-sessions '1'

3. DoS Protection

Limit the burst of connections:

set service pppoe-server limits burst '10'

4. Use RADIUS for Scalability

For more than 50 users, switch to RADIUS instead of local authentication.

5. Monitoring and Alerts

Set up notifications for IP pool exhaustion or RADIUS unavailability.

6. RADIUS Redundancy

Always configure a backup RADIUS server:

set service pppoe-server authentication radius server 10.0.10.10 key 'secret'
set service pppoe-server authentication radius server 10.0.10.11 key 'secret'

7. Logging

Keep logs for auditing and incident investigation:

set service pppoe-server log level info

8. Firewall for Management

Restrict access to the VyOS SSH/API to trusted networks only:

set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 destination port 22
set firewall ipv4 input filter rule 10 protocol tcp
set firewall ipv4 input filter rule 10 source address 192.168.100.0/24

9. Regular Updates

Update VyOS to receive security fixes.

10. Backups

Automate configuration backups:

save /config/backups/config-$(date +%Y%m%d).boot

Performance and Scaling

Performance Optimization

Kernel Parameters

For high-load systems (1000+ sessions), tune the kernel:

set system sysctl parameter net.core.rmem_max value '134217728'
set system sysctl parameter net.core.wmem_max value '134217728'
set system sysctl parameter net.core.netdev_max_backlog value '5000'
set system sysctl parameter net.ipv4.tcp_rmem value '4096 87380 67108864'
set system sysctl parameter net.ipv4.tcp_wmem value '4096 65536 67108864'

CPU Affinity

For multiprocessor systems, distribute the load:

  • Use separate RX/TX queues on the network card
  • Configure IRQ affinity for the network interfaces

Scaling

Up to 500 sessions:

  • 2 CPU cores
  • 4 GB RAM
  • 1 Gbps network

Up to 2000 sessions:

  • 4 CPU cores
  • 8 GB RAM
  • 10 Gbps network

More than 5000 sessions:

  • 8+ CPU cores
  • 16+ GB RAM
  • 10+ Gbps network
  • Consider clustering (multiple PPPoE servers)

Load Balancing

For very large installations, use multiple PPPoE servers:

Method 1: PADO Delay

set service pppoe-server pado-delay sessions '100'
set service pppoe-server pado-delay delay '500'

If a server has more than 100 sessions, it adds a 500 ms delay before sending PADO, giving other servers a chance to respond first.

Method 2: L2TP LNS pool

Use an L2TP LAC/LNS architecture for centralized PPPoE termination.

Next Steps

Reviewed by OpenNix LLC · Last updated on
DHCP RelayVPN on VyOS