Projects

ISP PPPoE Platform on MikroTik

Production MikroTikPPPoEQoSDNS

PPPoE baseline for an FTTH ISP: package profiles, queue tuning, PPPoE logs to the server, and forced DNS for content filtering.

Problem

Profiles had drifted: many old packages, rate limits that did not match what was sold, and queues that added latency under load. PPPoE disconnects were only in a small router log that rolled over in minutes. Content filtering could be bypassed by setting a public DNS server.

My role

Designed and applied the router changes, measured before and after, and kept rollback steps for each change.

Scale

  • 1,000+ PPPoE sessions on the main router
  • Hundreds of DNS queries per second redirected
  • 2 package tiers on the cleaned-up POP group

What I built

  • Package clean-up at one POP group: two packages only (100 Mbps and 200 Mbps) with matching rate limits; old profiles removed; billing prices updated without touching paid invoices.
  • Queue tuning: interface queues switched to multi-queue (TX queue drops went to zero); per-customer queues moved from SFQ to fq_codel on a trial profile first.
  • Router clock fixed (NTP) so logs and app data line up.
  • PPPoE logs (connect, disconnect, auth errors) sent by syslog to the billing server, with a firewall rule limiting who can send.
  • Forced DNS: customer port-53 traffic redirected to the ISP resolver, with an exception list and a netwatch rule that turns the redirect off if the resolver goes down.
  • Tried blocking DoT/DoH too; rolled that part back after Android "Private DNS" users started flapping, and documented the trade-off.
  • Every rule carries a comment tag so the whole change can be disabled in one command.

Architecture

  1. Customer

    • ONU / home router

  2. POP router

    • PPPoE server
    • Profiles + fq_codel queues

  3. Policy

    • NAT: DNS redirect
    • Netwatch failover

  4. Servers

    • ISP DNS resolver
    • Syslog → billing server

Outcome

  • Packages, router profiles and invoices match.
  • No TX queue drops on uplink and OLT ports after the queue change.
  • PPPoE events are stored and searchable instead of lost after minutes.
  • Content filtering works even when customers set a public DNS, with no single point of failure.

Stack

MikroTik RouterOS 7PPPoESimple queuesfq_codelFirewall NAT/filterNetwatchSyslogNTP

Next project

Dual-Upstream Load Balancing & Failover (PCC + Recursive)