MikroTik PPPoE Client Can't Connect: Auth Failed & MTU Fixes

Q: How do I fix a user who is already connected?

Find the stale session with /ppp active print and remove it with /ppp active remove. The customer can then reconnect.

Q: How do I see PPPoE errors on MikroTik?

Add a logging rule with /system logging add topics=pppoe,ppp,debug and watch /log print follow while the customer tries to connect.

A customer calls and says the router will not dial. The PPPoE light never comes up, or it connects and drops straight away. On a MikroTik PPPoE server the log nearly always tells you why. This guide shows how to read it and fix the common causes in order.

It assumes your server is already set up as in the MikroTik PPPoE Server Complete Setup Guide.

Step 1: Turn On PPPoE Logging

Do this first, then ask the customer to try again while you watch the log:

/system logging add topics=pppoe,ppp,debug
/log print follow where topics~"pppoe"

Remove the debug rule when you finish, because it is noisy. Find its number with /system logging print, then run /system logging remove numbers=N.

Step 2: Does the Customer Reach the Server at All?

If nothing about this customer appears in the log, the PPPoE request is not arriving. Check:

/interface pppoe-server server print

Is there a server on the interface the customer is connected to?
Is it disabled?
Does its service-name match what the customer’s router sends? If the router has a service name filled in and it differs from yours, the server ignores it. Ask the customer to leave the field empty.

Also check the physical path. If several customers on the same OLT port or VLAN are failing together, the fault is upstream of MikroTik. See our Huawei and BDCOM offline guides.

Step 3: Authentication Failed

If the log shows an authentication failure, the server saw the request but rejected the login. Look the customer up:

/ppp secret print where name="customer123"

Check each of these:

Name and password: they must match exactly, including capitals. A typo from the customer’s router setup is the most common cause.
Disabled secret: a secret marked disabled will never log in. If you disable expired customers, this is expected. See Block Expired or Unpaid PPPoE Customers on MikroTik.
Service: the secret’s service must be pppoe or any.
Profile: the profile named in the secret must exist.

To reset a password:

/ppp secret set [find name="customer123"] password="NewPass123"

Step 4: Already Connected

If a profile uses only-one=yes, a second login with the same user is refused while the first session is still listed. The first session may be stale: the customer’s router rebooted but the server has not yet noticed. Look for it:

/ppp active print where name="customer123"

If a dead session is listed, remove it so the customer can reconnect:

/ppp active remove [find name="customer123"]

If this keeps happening, the cause may be two routers using one account, or stale sessions lingering after drops. A short keepalive on the profile helps the server drop dead sessions sooner, so check /ppp profile print.

Step 5: Connects, Then No Address or No Internet

If login succeeds but the customer gets no usable connection, check how addresses are assigned:

/ppp profile print
/ip pool print
/ip firewall nat print

The profile needs a local-address and a remote-address, or a pool, for example remote-address=pppoe-pool.
Check the pool is not exhausted. More active users than addresses leaves new customers without one.
Check the NAT rule exists. A masquerade rule on your WAN interface is needed for customers on private addresses.

Step 6: Connected but Some Sites Won’t Load (MTU)

If the customer connects and small pages load but large pages, uploads or some apps hang, suspect MTU. PPPoE adds 8 bytes of overhead, so with a 1500-byte Ethernet link the largest PPPoE payload is 1492.

MikroTik tests the link and may lower the value it uses. The MikroTik community explains that RouterOS sends a test packet sized to the negotiated MTU and MRU, and lowers the actual MTU if the reply does not arrive. A network card or VLAN that cannot carry the extra bytes is a common reason. Things that help:

Set both the max MTU and the max MRU to 1492 on the PPPoE server. Setting only one is a common mistake.
If you run PPPoE over a VLAN, remember the tag adds 4 bytes, so the parent interface must allow it.
Add TCP MSS clamping so packets fit the tunnel. This usually removes the hanging pages without any loss you would notice.

/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=clamp-to-pmtu passthrough=yes

Test with a ping using a large packet and the don’t-fragment flag. For example, from the customer’s side use ping -f -l 1464 on Windows. If it fails and a smaller size works, you have an MTU limit to fix.

Quick Troubleshooting Table

What the log or customer shows	Likely cause	First action
Nothing in the log	Request not reaching the server	Check the PPPoE server, interface and service name
Authentication failed	Wrong password, or secret disabled	Check `/ppp secret`
Already connected	Stale session with only-one	Remove it from `/ppp active`
Connects, no internet	No NAT, or pool exhausted	Check profile, pool and NAT
Connects, big pages hang	MTU or MRU mismatch	Set 1492 on both, clamp MSS
Many customers fail together	Problem upstream	Check the OLT port and fiber

Prevent It Next Time

Keep a record of each customer’s user name, and reset passwords from MikroTik instead of asking the customer to retype them.
Give each customer one account. Sharing an account causes already-connected errors.
Size your pool above your customer count.
Back up the router before changes. See MikroTik PPPoE Speed Limit per User for the profile settings that go with it.

FAQ

Why does my MikroTik PPPoE say authentication failed?

The user name or password does not match the secret, or the secret is disabled. Check /ppp secret print for that customer and reset the password if needed.

How do I fix a user who is already connected?

Find the stale session with /ppp active print and remove it with /ppp active remove. The customer can then reconnect.

Why does PPPoE connect but there is no internet?

Usually there is no NAT rule, the address pool has run out, or the profile has no remote address. Check all three.

What MTU should I use for PPPoE on MikroTik?

With a standard 1500-byte Ethernet link, 1492 is the maximum because PPPoE uses 8 bytes. Set both the MTU and MRU, and use MSS clamping if pages still hang.

How do I see PPPoE errors on MikroTik?

Add a logging rule with /system logging add topics=pppoe,ppp,debug and watch /log print follow while the customer tries to connect.

Conclusion

Turn on the log, watch one connection attempt, and follow what it says. Most failures are a wrong password, a disabled secret, a stale session or an MTU problem. For the full server configuration, see the MikroTik PPPoE Server Complete Setup Guide.