Block Expired or Unpaid PPPoE Customers on MikroTik
Every ISP has customers whose package expires and who haven’t paid yet. You need a simple, reliable way to restrict them and a quick way to restore them after payment. On MikroTik PPPoE you have three practical options, from the simplest to the most customer-friendly.
This guide assumes your PPPoE server and speed profiles already work. If not, read the MikroTik PPPoE Server Complete Setup Guide and MikroTik PPPoE Speed Limit per User first.
Choose a Method
| Method | What the customer sees | Effort |
|---|---|---|
| 1. Disable the secret | Can’t connect at all | Easiest |
| 2. Expired profile with a tiny speed | Connects, but very slow | Easy |
| 3. Expired profile + address list + redirect | Connects, sees your payment page | Most work |
Method 1: Disable the Secret
This is the quickest. The customer can no longer log in.
/ppp secret disable [find name=customer1]
/ppp active remove [find name=customer1]The second line disconnects them if they are online right now. After payment, restore them:
/ppp secret enable [find name=customer1]The downside is that the customer sees “no internet” and doesn’t know why, so they call you. Methods 2 and 3 avoid that.
Method 2: An “Expired” Profile
Create a profile with a very low speed. The customer stays connected but can barely use the internet, which usually prompts them to pay.
/ppp profile add name=expired local-address=10.10.0.1 remote-address=pppoe-pool rate-limit=64k/64kMove the customer to it, then reconnect them:
/ppp secret set [find name=customer1] profile=expired
/ppp active remove [find name=customer1]After payment, put them back on their real package (here 10M) and reconnect:
/ppp secret set [find name=customer1] profile=10M
/ppp active remove [find name=customer1]Method 3: Redirect to a Payment Page
This is the best experience. Expired customers can still connect, but when they open a website they land on your page that says “Your package has expired, please pay”. It has three parts.
Part A: Put Expired Customers in an Address List
A PPP profile can add each connected customer’s address to a list automatically. Update your expired profile:
/ppp profile set expired address-list=expiredNow whenever a customer on the expired profile connects, their IP is added to the expired list. When they disconnect, the entry is removed.
Part B: Redirect Their Web Traffic
Send their HTTP traffic to a web page you control. Replace 192.168.50.10 with the IP of your payment or notice page:
/ip firewall nat add chain=dst-nat src-address-list=expired protocol=tcp dst-port=80 dst-address=!192.168.50.10 action=dst-nat to-addresses=192.168.50.10 to-ports=80 comment="expired redirect"Part C: Block Everything Else
Allow only what they need, then drop the rest. Order matters, so the accept rules must sit above the drop rule:
/ip firewall filter
add chain=forward src-address-list=expired protocol=udp dst-port=53 action=accept comment="expired: allow DNS"
add chain=forward src-address-list=expired dst-address=192.168.50.10 action=accept comment="expired: allow payment page"
add chain=forward src-address-list=expired action=drop comment="expired: drop rest"DNS must be allowed, or the customer’s browser can’t resolve any website name and the redirect never triggers. Make sure these rules are above your general accept rules. Use place-before=0 when adding them, or drag them up in Winbox.
The HTTPS Limitation
Almost all websites use HTTPS now. A redirect only works for plain HTTP, so on an HTTPS site the browser shows a certificate or connection error instead of your page. Phones and computers usually test for connectivity using plain HTTP pages, so many devices still show the “sign in to network” prompt. For best results, tell customers in your SMS and social media that expired accounts see a notice page, and give them your payment number.
Testing
- Create a test customer and move it to the
expiredprofile. - Reconnect it with
/ppp active remove. - Check the list:
/ip firewall address-list print where list=expired. - Open a plain HTTP page, such as
http://neverssl.com, from the test connection. You should see your notice page. - Check the hit counters on your NAT and filter rules to confirm they match.
Common Problems
| Problem | Cause | Fix |
|---|---|---|
| Customer isn’t in the address list | Still connected on the old profile | Disconnect so they reconnect |
| Redirect never triggers | DNS blocked | Add the DNS accept rule above the drop |
| Expired customer still browses | A broader accept rule is above your drop | Move the expired rules to the top |
| Paid customer still restricted | Profile not changed back, or no reconnect | Set the profile and remove from active |
Doing It at Scale
Moving customers one by one gets tiring past a few dozen. At that point ISPs use a billing system with RADIUS, or a scheduled script, so that expiry and renewal happen automatically. Keep a backup of your MikroTik configuration before you add firewall rules.
FAQ
How do I block an expired PPPoE customer on MikroTik?
Either disable their PPP secret, or move them to an “expired” profile with a very low speed or an address-list restriction, then remove them from the active connections so they reconnect.
Can I show expired customers a payment page?
Yes. Put them on an expired profile that adds them to an address list, redirect their HTTP traffic with a dst-nat rule, and allow only DNS and your page.
Why doesn’t the redirect work on HTTPS websites?
A redirect can’t safely rewrite encrypted HTTPS traffic, so browsers show an error. It works for plain HTTP pages and the device’s connectivity checks.
How do I restore a customer after payment?
Set their secret back to their normal profile, or enable the secret if you disabled it, then remove them from /ppp active.
Conclusion
Start with disabling the secret or an expired profile. Add the address list and redirect once you have a payment page ready. Whichever you pick, always remember the last step: remove the customer from the active list so the change takes effect.