Putting every subscriber on the same bridged segment with DHCP is simple to set up, but it gives you no real control per customer: no individual authentication, no easy way to cut off one non-paying subscriber without touching everyone else's connection, and no clean session boundary when a customer moves or changes equipment. PPPoE solves this at the protocol level — each subscriber gets their own authenticated session, independent of everyone else's.
Create the IP pool for subscribers
This is the range of addresses that get handed out to subscribers as they connect:
/ip pool add name=pppoe-pool ranges=10.20.0.10-10.20.0.250Create a PPP profile
The profile defines what a session looks like once connected — the router's own address inside that session, and which pool assigns the subscriber's address:
/ppp profile add name=subscriber-profile local-address=10.20.0.1 remote-address=pppoe-poolEnable the PPPoE server on the subscriber-facing interface
/interface pppoe-server server add interface=ether2 service-name=isp-pppoe disabled=noThis is the interface subscriber equipment (their router or ONU) connects to — not your WAN uplink.
Add a secret for each subscriber
Each subscriber gets their own username and password, tied to the profile you created:
/ppp secret add name=customer1 password=xxx service=pppoe profile=subscriber-profileRepeat per subscriber, or provision this automatically from your billing/OSS system if you're running more than a handful.
Why do it this way
A shared DHCP segment treats every subscriber as an anonymous device on the same broadcast domain — there's no protocol-level identity attached to a connection, just a MAC address that anyone can spoof and an IP that stays assigned whether or not the bill got paid. PPPoE makes each connection an authenticated session tied to a specific subscriber: disable one secret and that customer's session drops immediately, with zero effect on anyone else's. That's the difference between "manage a network" and "manage individual subscriber accounts on a network" — and it's the second one that an ISP actually needs.
How MoniTik helps
MoniTik is built with exactly this kind of deployment in mind — visibility into every device and, where applicable, every subscriber connection, from a single dashboard instead of jumping between routers. If you're running PPPoE at scale, having connection history and alerts per access concentrator is the difference between finding out about an outage from your monitoring versus from a support call.
Mateo supports wireless ISPs running MikroTik gear, from first install to day-two troubleshooting.