MikroTik PPPoE Speed Limit per User: Profiles & Burst

Q: How do I limit speed per user on MikroTik PPPoE?

Create a PPP profile with rate-limit, for example rate-limit=10M/10M, and assign that profile to each customer's PPP secret.

Every ISP package needs a speed limit: 5 Mbps for one customer, 10 or 20 for another. On a MikroTik PPPoE server the cleanest way to do this is the PPP profile. You set the speed once per package, and every customer on that profile gets it automatically.

This guide shows how to create speed profiles, attach them to customers, add burst, change a customer’s speed later, and fix the most common reason limits don’t work. If you haven’t built the PPPoE server yet, start with our MikroTik PPPoE Server Complete Setup Guide.

How the Limit Works

When a customer connects, MikroTik reads their profile and creates a dynamic simple queue for that connection. The queue applies the speed you set. When the customer disconnects, the queue disappears. You never create queues by hand.

The setting is called rate-limit, and its order trips up many people:

rate-limit=rx-rate/tx-rate

rx is what the router receives from the customer, so it is the customer’s upload.
tx is what the router sends to the customer, so it is the customer’s download.

So 5M/10M means 5 Mbps upload and 10 Mbps download.

Step 1: Create a Profile for Each Package

Open a terminal in Winbox (or use PPP → Profiles) and add one profile per package:

/ppp profile
add name=5M local-address=10.10.0.1 remote-address=pppoe-pool rate-limit=5M/5M
add name=10M local-address=10.10.0.1 remote-address=pppoe-pool rate-limit=10M/10M
add name=20M local-address=10.10.0.1 remote-address=pppoe-pool rate-limit=20M/20M

Use your own gateway address for local-address and your own pool name for remote-address. In RouterOS, M means megabits per second and k means kilobits per second.

Step 2: Attach the Profile to Each Customer

Each customer is a PPP secret. Choose the profile when you create it:

/ppp secret add name=customer1 password=ChangeMe123 service=pppoe profile=10M

To move an existing customer to a different package, change the profile:

/ppp secret set [find name=customer1] profile=20M

Step 3: Make the New Speed Take Effect

A profile change doesn’t affect a customer who is already connected. Their queue was created at connect time. Disconnect them so they reconnect with the new profile:

/ppp active remove [find name=customer1]

The customer’s router reconnects within seconds and picks up the new speed.

Step 4: Check That It Works

List the connected customers:

/ppp active print

Then look at the queues MikroTik created:

/queue simple print

You should see a dynamic entry such as <pppoe-customer1> with your limit in the max-limit column. Run a speed test from the customer’s connection to confirm the real speed.

Add Burst for a Faster Feel

Burst lets a customer go above their limit for a few seconds. It makes web pages load faster without raising the average speed. The full format is:

rate-limit=rx-rate/tx-rate rx-burst-rate/tx-burst-rate rx-burst-threshold/tx-burst-threshold rx-burst-time/tx-burst-time

A 10 Mbps package that can burst to 15 Mbps:

/ppp profile add name=10M-burst local-address=10.10.0.1 remote-address=pppoe-pool rate-limit=10M/10M 15M/15M 8M/8M 8s/8s

Here the customer can reach 15M while their average over the last few seconds stays under the 8M threshold. Once they use more than the threshold for the burst time, they drop back to 10M. Keep the threshold below the normal limit.

Common Mistakes

Problem	Cause	Fix
Speed isn’t limited at all	FastTrack is bypassing the queues	Remove or narrow your FastTrack rule (see below)
Upload and download are swapped	rx and tx order reversed	Write it as upload/download
New speed doesn’t apply	Customer still connected on old profile	Remove from `/ppp active`
No queue appears	Customer has no profile with rate-limit	Check the secret’s profile name
Speed is below the limit	CPU or uplink is the bottleneck	Check `/system resource` and your uplink

Why FastTrack Breaks Limits

FastTrack sends established connections around the normal packet path to save CPU. Traffic that is fast-tracked skips queues, so your limits do nothing for it. If you run a default firewall with a FastTrack rule, check it:

/ip firewall filter print where action=fasttrack-connection

If this rule exists and your customers are not being limited, disable it and test again:

/ip firewall filter disable [find action=fasttrack-connection]

Expect higher CPU load once it is off, so watch your router’s resources on busy networks.

When You Have Many Customers

Dynamic simple queues work well up to a few hundred customers on a decent router. Beyond that, queue processing costs CPU, and ISPs often move to PCQ queue types or to RADIUS-based limits. Before you scale up, keep a backup of your MikroTik configuration and plan your uplink capacity with the free ISP tools.

FAQ

How do I limit speed per user on MikroTik PPPoE?

Create a PPP profile with rate-limit, set on a profile like rate-limit=10M/10M, and assign that profile to each customer’s PPP secret.

Which number in rate-limit is upload?

The first number is upload and the second is download, from the customer’s point of view. 5M/10M means 5 Mbps up and 10 Mbps down.

Why isn’t my PPPoE speed limit working?

The most common cause is a FastTrack firewall rule. Fast-tracked connections skip queues, so the limit is never applied.

How do I change a customer’s speed?

Change the profile on their PPP secret, then remove them from /ppp active so they reconnect with the new profile.

Do I need to create queues manually?

No. MikroTik creates a dynamic simple queue for each connected PPPoE customer based on the profile’s rate-limit.

Conclusion

One profile per package, one secret per customer, and a reconnect after every change is all it takes. If limits don’t apply, check FastTrack first. Next, learn how to handle customers who haven’t paid: Block Expired PPPoE Customers on MikroTik.