# PPPoE Server

> PPPoE server on VyOS - ISP access service with RADIUS and local authentication, IP pools, VLAN per client, and bandwidth shaping

Source: https://opennix.org/en/docs/vyos/services/vyos-pppoe-server/


The PPPoE (Point-to-Point Protocol over Ethernet) server on VyOS uses accel-ppp to provide broadband Internet access. The solution is ideal for ISPs (Internet service providers), WISPs, and enterprise networks.

## Overview

The VyOS PPPoE server provides:
- Centralized subscriber authentication (local and RADIUS)
- IP address management through pools
- Bandwidth shaping
- IPv6 and Prefix Delegation support
- VLAN per client (automatic VLAN creation)
- Session control and monitoring
- Integration with billing systems via RADIUS

PPPoE is widely used by ISPs to deliver xDSL, FTTB (Fiber to the Building), and GPON services.

## Basic Configuration

### Minimal Setup

The simplest PPPoE server configuration:

```
# Access concentrator name
set service pppoe-server access-concentrator 'ISP-AC-01'

# Interface for receiving PPPoE requests
set service pppoe-server interface eth1

# Gateway address (handed to clients as the default route)
set service pppoe-server gateway-address '10.1.1.1'

# IP address pool for clients
set service pppoe-server client-ip-pool CLIENTS range '10.1.1.100-10.1.1.254'
set service pppoe-server default-pool 'CLIENTS'

# Local authentication
set service pppoe-server authentication mode 'local'
set service pppoe-server authentication local-users username 'client1' password 'password123'

commit
```

### Configuration Structure

```
service pppoe-server
  ├── access-concentrator <name>
  ├── interface <interface>
  ├── gateway-address <ip>
  ├── authentication
  │   ├── mode [local|radius]
  │   ├── local-users
  │   │   └── username <name>
  │   │       ├── password <password>
  │   │       ├── static-ip <ip>
  │   │       ├── rate-limit <download>/<upload>
  │   │       └── disable
  │   └── radius
  │       ├── server <ip>
  │       │   ├── key <secret>
  │       │   ├── port <port>
  │       │   └── acct-port <port>
  │       └── nas-identifier <id>
  ├── client-ip-pool <name>
  │   └── range <start-stop>
  ├── default-pool <pool-name>
  ├── client-ipv6-pool <name>
  │   ├── prefix <prefix>
  │   └── mask <bits>
  ├── name-server <dns-ip>
  ├── ppp-options
  │   ├── mtu <size>
  │   ├── mru <size>
  │   ├── lcp-echo-interval <seconds>
  │   ├── lcp-echo-failure <count>
  │   ├── ipv4 <mode>
  │   └── ipv6 [allow|deny|require]
  └── limits
      ├── burst <count>
      └── timeout <seconds>
```

## Authentication

### Local Authentication

Create users directly in the VyOS configuration.

#### Basic User

```
set service pppoe-server authentication mode 'local'
set service pppoe-server authentication local-users username 'user1' password 'SecurePass123'
```

#### User with a Static IP

```
set service pppoe-server authentication local-users username 'server1' password 'Pass456'
set service pppoe-server authentication local-users username 'server1' static-ip '10.1.1.50'
```

#### User with a Speed Limit

```
set service pppoe-server authentication local-users username 'user2' password 'Pass789'
set service pppoe-server authentication local-users username 'user2' rate-limit download '100000'
set service pppoe-server authentication local-users username 'user2' rate-limit upload '50000'
```

Speed is specified in Kbps (kilobits per second).

#### Disabling a User

Temporary disabling without deletion:

```
set service pppoe-server authentication local-users username 'user1' disable
```

### RADIUS Authentication

Integration with external RADIUS servers for centralized subscriber management.

#### Basic RADIUS Setup

```
# Authentication mode
set service pppoe-server authentication mode 'radius'

# Primary RADIUS server
set service pppoe-server authentication radius server 192.168.10.10 key 'RadiusSecret123'

# Secondary RADIUS server (backup)
set service pppoe-server authentication radius server 192.168.10.11 key 'RadiusSecret123'

# NAS Identifier (to identify the server to RADIUS)
set service pppoe-server authentication radius nas-identifier 'PPPoE-Server-01'
```

#### Non-Standard RADIUS Ports

```
set service pppoe-server authentication radius server 192.168.10.10 key 'Secret'
set service pppoe-server authentication radius server 192.168.10.10 port 1812
set service pppoe-server authentication radius server 192.168.10.10 acct-port 1813
```

Default ports:
- Authentication: 1812
- Accounting: 1813

#### RADIUS Source

NAS IP address for RADIUS requests:

```
set service pppoe-server authentication radius source-address '192.168.10.1'
```

#### RADIUS Attributes

The RADIUS server can return attributes to control the session:

**Vendor-Specific Attributes (VSA):**
- `Filter-Id` - bandwidth shaping profile name
- `Framed-IP-Address` - static IP for the client
- `Framed-Route` - static route
- `Rate-Limit` - speed limit (format: `download/upload`)
- `Session-Timeout` - maximum session duration

**Example RADIUS response:**
```
Framed-IP-Address = 10.1.1.100
Framed-Route = "192.168.50.0/24 10.1.1.100"
Filter-Id = "100M"
Session-Timeout = 86400
```

### Authentication Protocols

PPPoE supports several authentication protocols.

#### PAP (Password Authentication Protocol)

The simplest protocol; the password is sent in cleartext (not recommended):

```
set service pppoe-server authentication protocols pap
```

#### CHAP (Challenge Handshake Authentication Protocol)

A more secure challenge-response protocol:

```
set service pppoe-server authentication protocols chap
```

#### MS-CHAP and MS-CHAPv2

Microsoft variants of CHAP:

```
set service pppoe-server authentication protocols mschap
set service pppoe-server authentication protocols mschap-v2
```

#### Recommended Configuration

```
# Allow CHAP and MS-CHAPv2, deny PAP
set service pppoe-server authentication protocols chap
set service pppoe-server authentication protocols mschap-v2
```

## IP Address Management

### IPv4 Pools

#### Single Pool

```
set service pppoe-server client-ip-pool POOL1 range '10.1.1.100-10.1.1.254'
set service pppoe-server default-pool 'POOL1'
```

#### Multiple Pools

For different subscriber groups or plans:

```
# Basic plan
set service pppoe-server client-ip-pool BASIC range '10.1.1.0-10.1.1.127'

# Premium plan
set service pppoe-server client-ip-pool PREMIUM range '10.1.2.0-10.1.2.255'

# Corporate clients
set service pppoe-server client-ip-pool CORPORATE range '10.1.10.0-10.1.10.127'

# Default pool
set service pppoe-server default-pool 'BASIC'
```

RADIUS can assign a specific pool through the `Framed-Pool` attribute.

#### Static IP Addresses

Via local authentication:

```
set service pppoe-server authentication local-users username 'static-user' static-ip '10.1.1.50'
```

Via RADIUS (attribute in the response):
```
Framed-IP-Address = 10.1.1.50
```

### IPv6 Configuration

#### Enabling IPv6

```
set service pppoe-server ppp-options ipv6 'allow'
```

IPv6 modes:
- `allow` - allow IPv6 if the client requests it
- `deny` - deny IPv6
- `require` - require IPv6 (mandatory)

#### IPv6 Address Pool

Handing out individual IPv6 addresses:

```
set service pppoe-server client-ipv6-pool IPv6-POOL prefix '2001:db8:1000::/48'
set service pppoe-server client-ipv6-pool IPv6-POOL mask '64'
```

Each client is assigned a /64 prefix from the specified pool.

#### IPv6 Prefix Delegation

Delegating prefixes to clients (for routers):

```
set service pppoe-server client-ipv6-pool IPv6-POOL-PD prefix '2001:db8:2000::/40'
set service pppoe-server client-ipv6-pool IPv6-POOL-PD delegate '2001:db8:2000::/48'
```

The client receives a /48 prefix for use in its own network.

### DNS Servers

Specifying DNS servers for clients:

```
set service pppoe-server name-server '8.8.8.8'
set service pppoe-server name-server '8.8.4.4'
```

For IPv6:

```
set service pppoe-server name-server '2001:4860:4860::8888'
set service pppoe-server name-server '2001:4860:4860::8844'
```

## VLAN Configuration

### VLAN per Client

Automatic creation of VLAN interfaces for each client.

#### Basic VLAN Configuration

```
# Allow reception on VLAN interfaces
set service pppoe-server interface eth1 vlan '100-200'
```

The PPPoE server will accept requests on eth1.100, eth1.101, ... eth1.200.

#### Specific VLANs

```
set service pppoe-server interface eth1 vlan '10'
set service pppoe-server interface eth1 vlan '20'
set service pppoe-server interface eth1 vlan '30'
```

#### Multiple Interfaces with VLANs

```
# DSL aggregation on eth1
set service pppoe-server interface eth1 vlan '100-200'

# Ethernet subscribers on eth2
set service pppoe-server interface eth2 vlan '500-600'
```

### Dynamic VLAN Creation

The PPPoE server automatically creates VLAN interfaces when clients connect:

```
set service pppoe-server interface eth1 vlan '1-4094'
```

**Important**: Make sure the switch is configured to pass the corresponding VLAN tags (trunk/tagged port).

### VLAN + IP Pool Mapping

Different pools for different VLANs (through external logic in RADIUS):

The **RADIUS server** can analyze the NAS-Port-Id (which contains the VLAN ID) and return the appropriate Framed-Pool attribute.

## Bandwidth Shaping

### Local Speed Limiting

For users with local authentication:

```
set service pppoe-server authentication local-users username 'user1' rate-limit download '50000'
set service pppoe-server authentication local-users username 'user1' rate-limit upload '25000'
```

Speed in Kbps:
- `50000` = 50 Mbps download
- `25000` = 25 Mbps upload

### RADIUS-Based Shaping

RADIUS can control speed through attributes:

**FreeRADIUS response example:**
```
# In the users file
user1 Cleartext-Password := "password"
    Filter-Id := "rate-limit=100000/50000"
```

Format: `rate-limit=download/upload` (in Kbps)

**Alternative via VSA:**
```
user1 Cleartext-Password := "password"
    WISPr-Bandwidth-Max-Down := 100000000,
    WISPr-Bandwidth-Max-Up := 50000000
```

Speed in bps (bits per second).

### Burst Configuration

Allowing a brief overshoot of the limit:

```
set service pppoe-server shaper fwmark '10'
```

For more advanced shaping, use accel-ppp's built-in capabilities through extended scripting.

## PPP Options

### MTU and MRU

Maximum packet size:

```
set service pppoe-server ppp-options mtu '1492'
set service pppoe-server ppp-options mru '1492'
```

Standard values:
- PPPoE MTU: 1492 (1500 - 8 bytes PPPoE header)
- For tunnels (PPPoE + L2TP): 1460 or lower

### LCP Echo

Keep-alive mechanism for detecting disconnected sessions:

```
set service pppoe-server ppp-options lcp-echo-interval '30'
set service pppoe-server ppp-options lcp-echo-failure '3'
```

- `lcp-echo-interval` - interval for sending LCP Echo-Request (seconds)
- `lcp-echo-failure` - number of failed attempts before the connection is torn down

**Example**: An interval of 30 seconds and 3 attempts means the session is torn down after 90 seconds without a response.

### IPv4 Modes

```
set service pppoe-server ppp-options ipv4 'allow'
```

Modes:
- `allow` - allow IPv4
- `deny` - deny IPv4
- `require` - require IPv4

### MPPE Encryption

Microsoft Point-to-Point Encryption:

```
set service pppoe-server ppp-options mppe 'prefer'
```

Modes:
- `require` - require MPPE
- `prefer` - prefer MPPE
- `deny` - deny MPPE

**Note**: MPPE requires MS-CHAPv2 authentication.

### IPCP Options

IP Control Protocol settings:

```
set service pppoe-server ppp-options ipv4-peer-dns
```

Send DNS servers to the client via IPCP.

## Session Control

### Maximum Number of Sessions

Limit on the number of simultaneous connections for a single user:

```
set service pppoe-server session-control max-sessions '1'
```

Prevents multiple connections from a single account.

### Timeouts

#### Session Timeout

Maximum session duration (after it expires, the session is disconnected automatically):

```
set service pppoe-server limits timeout '86400'
```

Value in seconds (86400 = 24 hours).

Can also be controlled through the RADIUS `Session-Timeout` attribute.

#### Idle Timeout

Disconnection when there is no traffic:

```
set service pppoe-server limits idle-timeout '600'
```

The session is torn down if there is no traffic for 600 seconds (10 minutes).

### Burst Parameters

Limit on simultaneous new connections (protection against flooding):

```
set service pppoe-server limits burst '10'
```

At most 10 new sessions can be established simultaneously.

### Interface Renaming

Custom naming of PPP interfaces:

```
set service pppoe-server ppp-options interface-name 'pppoe-{username}'
```

Interfaces will be named `pppoe-user1`, `pppoe-user2`, and so on.

## Extended Scripting

Accel-ppp supports running scripts on various events.

### Available Events

```
set service pppoe-server extended-scripts on-pre-up '/config/scripts/pppoe-pre-up.sh'
set service pppoe-server extended-scripts on-up '/config/scripts/pppoe-up.sh'
set service pppoe-server extended-scripts on-down '/config/scripts/pppoe-down.sh'
set service pppoe-server extended-scripts on-change '/config/scripts/pppoe-change.sh'
```

Events:
- `on-pre-up` - before the session is established
- `on-up` - after the session is successfully established
- `on-down` - after the session is torn down
- `on-change` - when session parameters change

### Example Script

**File `/config/scripts/pppoe-up.sh`:**

```bash
#!/bin/bash
# Environment variables available in the script:
# $IFNAME - interface name (ppp0, ppp1, ...)
# $PEERNAME - username
# $CALLING_SID - client MAC address
# $CALLED_SID - server MAC address
# $IP - client IP address
# $IP6 - client IPv6 address (if any)

echo "$(date): User $PEERNAME connected on $IFNAME with IP $IP" >> /var/log/pppoe-sessions.log

# For example, sending a notification
curl -X POST "https://billing.example.ru/api/session-start" \
  -d "username=$PEERNAME&ip=$IP&interface=$IFNAME"
```

Make the script executable:
```
sudo chmod +x /config/scripts/pppoe-up.sh
```

### Billing Integration

Scripts can call the billing system's API for:
- Session start/stop notifications
- Statistics updates
- Balance management
- Event logging

## Configuration Examples

### Home ISP (Basic Configuration)

```
# Core parameters
set service pppoe-server access-concentrator 'HomeISP-AC'
set service pppoe-server interface eth1

# Gateway and DNS
set service pppoe-server gateway-address '10.10.1.1'
set service pppoe-server name-server '8.8.8.8'
set service pppoe-server name-server '8.8.4.4'

# IP pool
set service pppoe-server client-ip-pool HOME range '10.10.1.100-10.10.1.254'
set service pppoe-server default-pool 'HOME'

# Local authentication
set service pppoe-server authentication mode 'local'
set service pppoe-server authentication protocols chap
set service pppoe-server authentication protocols mschap-v2

# Users
set service pppoe-server authentication local-users username 'client1' password 'Pass123'
set service pppoe-server authentication local-users username 'client1' rate-limit download '100000'
set service pppoe-server authentication local-users username 'client1' rate-limit upload '100000'

# PPP options
set service pppoe-server ppp-options mtu '1492'
set service pppoe-server ppp-options lcp-echo-interval '30'
set service pppoe-server ppp-options lcp-echo-failure '3'

# Session control
set service pppoe-server session-control max-sessions '1'
set service pppoe-server limits burst '5'

commit
```

### ISP with RADIUS and VLANs (Advanced Configuration)

```
# Core parameters
set service pppoe-server access-concentrator 'ISP-Metro-AC-01'

# Interfaces with VLANs
set service pppoe-server interface eth1 vlan '100-199'
set service pppoe-server interface eth2 vlan '200-299'

# Gateway
set service pppoe-server gateway-address '10.0.0.1'

# DNS servers
set service pppoe-server name-server '10.0.0.53'
set service pppoe-server name-server '8.8.8.8'

# IP pools
set service pppoe-server client-ip-pool RESIDENTIAL range '10.100.0.0-10.100.255.254'
set service pppoe-server client-ip-pool BUSINESS range '10.200.0.0-10.200.127.254'
set service pppoe-server client-ip-pool PREMIUM range '10.250.0.0-10.250.63.254'
set service pppoe-server default-pool 'RESIDENTIAL'

# RADIUS authentication
set service pppoe-server authentication mode 'radius'
set service pppoe-server authentication protocols chap
set service pppoe-server authentication protocols mschap-v2

# Primary RADIUS
set service pppoe-server authentication radius server 10.0.10.10 key 'SuperSecretKey123'
set service pppoe-server authentication radius server 10.0.10.10 port 1812
set service pppoe-server authentication radius server 10.0.10.10 acct-port 1813

# Backup RADIUS
set service pppoe-server authentication radius server 10.0.10.11 key 'SuperSecretKey123'

# RADIUS settings
set service pppoe-server authentication radius nas-identifier 'PPPoE-AC-01'
set service pppoe-server authentication radius source-address '10.0.10.1'

# PPP options
set service pppoe-server ppp-options mtu '1492'
set service pppoe-server ppp-options mru '1492'
set service pppoe-server ppp-options lcp-echo-interval '30'
set service pppoe-server ppp-options lcp-echo-failure '4'
set service pppoe-server ppp-options ipv4 'allow'

# IPv6
set service pppoe-server ppp-options ipv6 'allow'
set service pppoe-server client-ipv6-pool IPv6-POOL prefix '2001:db8::/32'
set service pppoe-server client-ipv6-pool IPv6-POOL mask '64'

# Session control
set service pppoe-server session-control max-sessions '1'
set service pppoe-server limits burst '20'
set service pppoe-server limits timeout '86400'

# Extended scripts
set service pppoe-server extended-scripts on-up '/config/scripts/billing-session-start.sh'
set service pppoe-server extended-scripts on-down '/config/scripts/billing-session-stop.sh'

commit
```

### FTTB ISP with Dual-Stack IPv4/IPv6

```
# Core parameters
set service pppoe-server access-concentrator 'FTTB-ISP'
set service pppoe-server interface eth1

# Gateway addresses
set service pppoe-server gateway-address '10.20.0.1'

# DNS servers (dual-stack)
set service pppoe-server name-server '10.20.0.53'
set service pppoe-server name-server '2001:db8:20::53'
set service pppoe-server name-server '8.8.8.8'
set service pppoe-server name-server '2001:4860:4860::8888'

# IPv4 pools
set service pppoe-server client-ip-pool POOL-v4 range '10.20.1.0-10.20.254.254'
set service pppoe-server default-pool 'POOL-v4'

# IPv6 pools
set service pppoe-server ppp-options ipv6 'require'
set service pppoe-server client-ipv6-pool POOL-v6 prefix '2001:db8:1000::/36'
set service pppoe-server client-ipv6-pool POOL-v6 mask '56'

# Prefix Delegation for client routers
set service pppoe-server client-ipv6-pool POOL-v6-PD prefix '2001:db8:2000::/36'
set service pppoe-server client-ipv6-pool POOL-v6-PD delegate '2001:db8:2000::/48'

# RADIUS
set service pppoe-server authentication mode 'radius'
set service pppoe-server authentication protocols chap
set service pppoe-server authentication protocols mschap-v2
set service pppoe-server authentication radius server 10.20.0.10 key 'RadiusKey'
set service pppoe-server authentication radius nas-identifier 'FTTB-PPPoE'

# PPP options
set service pppoe-server ppp-options mtu '1492'
set service pppoe-server ppp-options mru '1492'
set service pppoe-server ppp-options lcp-echo-interval '30'
set service pppoe-server ppp-options lcp-echo-failure '3'
set service pppoe-server ppp-options ipv4 'require'

# Session control
set service pppoe-server session-control max-sessions '1'

commit
```

### ISP with Tariff Plans

```
# Core parameters
set service pppoe-server access-concentrator 'RU-ISP-Moscow'
set service pppoe-server interface eth1 vlan '10-20'
set service pppoe-server gateway-address '10.77.0.1'

# DNS servers (Yandex DNS)
set service pppoe-server name-server '77.88.8.8'
set service pppoe-server name-server '77.88.8.1'

# Pools by tariff
# "Basic" plan - 50 Mbps
set service pppoe-server client-ip-pool BASIC range '10.77.10.0-10.77.10.255'

# "Optimal" plan - 100 Mbps
set service pppoe-server client-ip-pool OPTIMAL range '10.77.20.0-10.77.20.255'

# "Maximum" plan - 200 Mbps
set service pppoe-server client-ip-pool MAXIMUM range '10.77.30.0-10.77.30.255'

set service pppoe-server default-pool 'BASIC'

# RADIUS (billing)
set service pppoe-server authentication mode 'radius'
set service pppoe-server authentication protocols mschap-v2
set service pppoe-server authentication radius server 10.77.0.100 key 'BillingSecret'
set service pppoe-server authentication radius nas-identifier 'Moscow-PPPoE-1'

# PPP options
set service pppoe-server ppp-options mtu '1492'
set service pppoe-server ppp-options lcp-echo-interval '20'
set service pppoe-server ppp-options lcp-echo-failure '3'

# Session control
set service pppoe-server session-control max-sessions '1'
set service pppoe-server limits idle-timeout '1800'

commit
```

**FreeRADIUS configuration for the tariffs** (`users` file):

```
# Basic plan - 50 Mbps
user-basic Cleartext-Password := "password"
    Framed-Pool := "BASIC",
    Filter-Id := "rate-limit=51200/25600"

# Optimal plan - 100 Mbps
user-optimal Cleartext-Password := "password"
    Framed-Pool := "OPTIMAL",
    Filter-Id := "rate-limit=102400/51200"

# Maximum plan - 200 Mbps
user-maximum Cleartext-Password := "password"
    Framed-Pool := "MAXIMUM",
    Filter-Id := "rate-limit=204800/102400"

# Static IP for a business client
business-client Cleartext-Password := "password"
    Framed-IP-Address := "10.77.100.50",
    Filter-Id := "rate-limit=204800/102400"
```

## Operational Commands

### Viewing Active Sessions

All sessions:
```
show pppoe-server sessions
```

Output:
```
Interface  Username     IP Address       Calling-SID         Uptime
---------  ------------ ---------------  ------------------  --------
ppp0       client1      10.10.1.100      00:11:22:33:44:55   00:15:32
ppp1       client2      10.10.1.101      aa:bb:cc:dd:ee:ff   01:23:45
```

Detailed information for an interface:
```
show pppoe-server sessions ifname ppp0
```

By user:
```
show pppoe-server sessions username client1
```

### Statistics

Server statistics:
```
show pppoe-server statistics
```

### Disconnecting a Client

Forcibly disconnecting a session:

```
disconnect pppoe-server username client1
```

By interface:
```
disconnect pppoe-server interface ppp0
```

### Restarting the Server

```
restart pppoe-server
```

**Warning**: Restarting will tear down all active sessions!

### Logs

Viewing PPPoE logs:
```
show log pppoe
```

Real-time monitoring:
```
monitor log | match pppoe
```

Detailed accel-ppp logs:
```
tail -f /var/log/accel-ppp/accel-ppp.log
```

## Monitoring and Debugging

### Debug Mode

Enabling detailed logging:

```
set service pppoe-server log level debug
commit
```

Log levels:
- `error` - errors only
- `warn` - warnings and errors
- `info` - informational messages (default)
- `debug` - detailed debugging

### SNMP Monitoring

PPPoE statistics are available through SNMP (when an SNMP agent is configured).

OIDs for accel-ppp:
- Number of active sessions: `.1.3.6.1.4.1.8072.1.3.2.4.1.2.9.97.99.99.101.108.45.112.112.112.1`

### Collecting Statistics

**Monitoring script** (`/config/scripts/pppoe-stats.sh`):

```bash
#!/bin/bash
SESSIONS=$(run show pppoe-server sessions | grep ppp | wc -l)
echo "Active PPPoE sessions: $SESSIONS"

# Sending to the monitoring system
curl -X POST "http://monitoring.example.ru/api/metrics" \
  -d "metric=pppoe.sessions&value=$SESSIONS"
```

Running it on a schedule via cron:
```
set system task-scheduler task pppoe-stats executable path '/config/scripts/pppoe-stats.sh'
set system task-scheduler task pppoe-stats interval '5m'
```

### Packet Capture

Capturing PPPoE traffic for debugging:

```
sudo tcpdump -i eth1 -n pppoe
```

With detailed output:
```
sudo tcpdump -i eth1 -vvv -n pppoe
```

Saving to a file:
```
sudo tcpdump -i eth1 -w /tmp/pppoe.pcap pppoe
```

## Troubleshooting

### Clients Cannot Connect

#### Check the Server Status

```
show service pppoe-server
```

The server must be running and listening on the correct interface.

#### Check the Interface

```
show interfaces ethernet eth1
```

The interface must be UP. For VLANs, check the trunk configuration on the switch.

#### Check VLANs

If VLANs are used, make sure the tags are passing through:

```
sudo tcpdump -i eth1 -n vlan
```

#### Check Authentication

Local authentication:
```
show service pppoe-server authentication local-users
```

RADIUS:
```
show service pppoe-server authentication radius
```

Testing RADIUS with radtest:
```
sudo radtest username password 192.168.10.10 0 secret
```

#### Logs

```
show log pppoe | tail 50
```

Common errors:
- `Authentication failed` - incorrect password
- `No free IP address` - IP pool exhausted
- `Maximum sessions reached` - session limit exceeded

### Running Out of IP Addresses

Check pool usage:

```
show pppoe-server sessions | grep ppp | wc -l
```

Increase the range:
```
set service pppoe-server client-ip-pool POOL range '10.1.1.0-10.1.2.254'
commit
```

Or clear stale sessions:
```
restart pppoe-server
```

### RADIUS Not Responding

Check reachability:
```
ping 192.168.10.10
```

Test RADIUS:
```
sudo apt install freeradius-utils
radtest username password 192.168.10.10:1812 0 secret
```

Check the firewall on the RADIUS server (UDP ports 1812, 1813).

Verify the shared secret in both the VyOS and RADIUS configurations.

### Speed Limited Incorrectly

Check rate-limit in the configuration:
```
show service pppoe-server authentication local-users username user1
```

For RADIUS, check the attributes in the response:
```
radtest -t pap user1 password 192.168.10.10 0 secret
```

Make sure RADIUS returns `Filter-Id` in the correct format:
```
Filter-Id = "rate-limit=102400/51200"
```

### Sessions Dropping

Check the LCP echo parameters:
```
show service pppoe-server ppp-options
```

Increase the timeouts:
```
set service pppoe-server ppp-options lcp-echo-interval '60'
set service pppoe-server ppp-options lcp-echo-failure '5'
commit
```

Check the idle timeout:
```
set service pppoe-server limits idle-timeout '0'
```

A value of `0` disables the idle timeout.

### MTU Problems

Clients report issues with certain sites (usually HTTPS).

Reduce the MTU:
```
set service pppoe-server ppp-options mtu '1480'
set service pppoe-server ppp-options mru '1480'
commit
```

On the client side, MSS clamping may also be required:
```
set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 protocol tcp
set firewall ipv4 forward filter rule 100 tcp flags syn
set firewall ipv4 forward filter rule 100 tcp mss 1400-1460
```

### IPv6 Not Working

Check that IPv6 is allowed:
```
show service pppoe-server ppp-options ipv6
```

Check the IPv6 pools:
```
show service pppoe-server client-ipv6-pool
```

Make sure the client is requesting IPv6 (support in the PPPoE client).

## Billing Integration

### FreeRADIUS Integration

**VyOS configuration:**
```
set service pppoe-server authentication mode 'radius'
set service pppoe-server authentication radius server 192.168.1.10 key 'secret123'
set service pppoe-server authentication radius nas-identifier 'PPPoE-Server-1'
```

**FreeRADIUS `/etc/freeradius/3.0/clients.conf`:**
```
client vyos-pppoe {
    ipaddr = 192.168.1.1
    secret = secret123
    nastype = other
}
```

**FreeRADIUS `/etc/freeradius/3.0/mods-config/files/authorize`:**
```
# User with a 100 Mbps plan
user1 Cleartext-Password := "password123"
    Framed-IP-Address := "10.1.1.100",
    Filter-Id := "rate-limit=102400/51200",
    Reply-Message := "Welcome to ISP Network"
```

### UTM/Billing Systems

Popular billing systems for ISPs:
- **UTM5** - integration via RADIUS
- **NetUP** - RADIUS + API
- **ISPsystem BILLmanager** - RADIUS + webhooks
- **Asterisk** - RADIUS accounting

**Example integration via an API (extended scripts):**

`/config/scripts/billing-session-start.sh`:
```bash
#!/bin/bash
# Sending a session-start event to the billing system
curl -X POST "https://billing.isp.ru/api/v1/session/start" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"username\": \"$PEERNAME\",
    \"ip\": \"$IP\",
    \"mac\": \"$CALLING_SID\",
    \"interface\": \"$IFNAME\",
    \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
  }"
```

`/config/scripts/billing-session-stop.sh`:
```bash
#!/bin/bash
# Sending a session-stop event
curl -X POST "https://billing.isp.ru/api/v1/session/stop" \
  -H "Authorization: Bearer API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"username\": \"$PEERNAME\",
    \"interface\": \"$IFNAME\",
    \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
  }"
```

Configuring it in VyOS:
```
set service pppoe-server extended-scripts on-up '/config/scripts/billing-session-start.sh'
set service pppoe-server extended-scripts on-down '/config/scripts/billing-session-stop.sh'
```

### RADIUS Accounting

For detailed accounting of traffic and session time, RADIUS accounting works automatically when RADIUS is configured.

**RADIUS attributes in Accounting packets:**
- `Acct-Session-Id` - unique session ID
- `Acct-Input-Octets` - inbound traffic (bytes)
- `Acct-Output-Octets` - outbound traffic (bytes)
- `Acct-Session-Time` - session duration (seconds)
- `Acct-Terminate-Cause` - termination reason

Accounting Update interval (interim updates):
```
set service pppoe-server authentication radius acct-interim-interval '600'
```

The billing system will receive updates every 600 seconds (10 minutes).

## Security and Best Practices

### 1. Use Secure Authentication Protocols

Avoid PAP; use CHAP or MS-CHAPv2:
```
set service pppoe-server authentication protocols chap
set service pppoe-server authentication protocols mschap-v2
```

### 2. Limit the Number of Sessions

One session per user:
```
set service pppoe-server session-control max-sessions '1'
```

### 3. DoS Protection

Limit the burst of connections:
```
set service pppoe-server limits burst '10'
```

### 4. Use RADIUS for Scalability

For more than 50 users, switch to RADIUS instead of local authentication.

### 5. Monitoring and Alerts

Set up notifications for IP pool exhaustion or RADIUS unavailability.

### 6. RADIUS Redundancy

Always configure a backup RADIUS server:
```
set service pppoe-server authentication radius server 10.0.10.10 key 'secret'
set service pppoe-server authentication radius server 10.0.10.11 key 'secret'
```

### 7. Logging

Keep logs for auditing and incident investigation:
```
set service pppoe-server log level info
```

### 8. Firewall for Management

Restrict access to the VyOS SSH/API to trusted networks only:
```
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 destination port 22
set firewall ipv4 input filter rule 10 protocol tcp
set firewall ipv4 input filter rule 10 source address 192.168.100.0/24
```

### 9. Regular Updates

Update VyOS to receive security fixes.

### 10. Backups

Automate configuration backups:
```
save /config/backups/config-$(date +%Y%m%d).boot
```

## Performance and Scaling

### Performance Optimization

#### Kernel Parameters

For high-load systems (1000+ sessions), tune the kernel:

```
set system sysctl parameter net.core.rmem_max value '134217728'
set system sysctl parameter net.core.wmem_max value '134217728'
set system sysctl parameter net.core.netdev_max_backlog value '5000'
set system sysctl parameter net.ipv4.tcp_rmem value '4096 87380 67108864'
set system sysctl parameter net.ipv4.tcp_wmem value '4096 65536 67108864'
```

#### CPU Affinity

For multiprocessor systems, distribute the load:
- Use separate RX/TX queues on the network card
- Configure IRQ affinity for the network interfaces

### Scaling

**Up to 500 sessions:**
- 2 CPU cores
- 4 GB RAM
- 1 Gbps network

**Up to 2000 sessions:**
- 4 CPU cores
- 8 GB RAM
- 10 Gbps network

**More than 5000 sessions:**
- 8+ CPU cores
- 16+ GB RAM
- 10+ Gbps network
- Consider clustering (multiple PPPoE servers)

### Load Balancing

For very large installations, use multiple PPPoE servers:

**Method 1: PADO Delay**
```
set service pppoe-server pado-delay sessions '100'
set service pppoe-server pado-delay delay '500'
```

If a server has more than 100 sessions, it adds a 500 ms delay before sending PADO, giving other servers a chance to respond first.

**Method 2: L2TP LNS pool**

Use an L2TP LAC/LNS architecture for centralized PPPoE termination.

## Next Steps

- [VPN (L2TP, IPsec)](/docs/vyos/vpn/) - VPN services
- [RADIUS Server](/docs/vyos/services/) - a self-hosted RADIUS server on VyOS
- [NAT](/docs/vyos/nat/) - NAT for client traffic
- [Firewall](/docs/vyos/firewall/) - network protection
- [QoS](/docs/vyos/qos/) - bandwidth management