MikroTik PPPoE User Management: Add, Disable, Import and Monitor Users

By Madan Kc, ISP/GPON engineer at DG Link Network · Updated 7 November 2026

Secrets, profiles and active connections

This post assumes the PPPoE server itself already runs. If not, set that up first with the MikroTik PPPoE server complete setup guide.

Step 1: Create profiles

Put the speed in the profile, not on each user. Change a plan once and every user on it follows. In rate-limit the order is upload/download from the customer’s side.

/ip pool add name=pppoe-pool ranges=10.20.0.10-10.20.15.250
/ppp profile add name=5M local-address=10.20.0.1 remote-address=pppoe-pool rate-limit=5M/5M dns-server=8.8.8.8,1.1.1.1
/ppp profile add name=10M local-address=10.20.0.1 remote-address=pppoe-pool rate-limit=10M/10M dns-server=8.8.8.8,1.1.1.1
/ppp profile add name=expired local-address=10.20.0.1 remote-address=expired-pool rate-limit=64k/64k

The expired profile is for unpaid customers: see the expiry section. It needs its own pool (expired-pool) so you can redirect those addresses. For other ways to enforce speed, read PPPoE speed limit per user.

Step 2: Add, disable and remove users

/ppp secret add name=ram.thapa password=S3cret!42 service=pppoe profile=10M comment="Ram Thapa, Pokhara, paid till 2026-12-01"
/ppp secret print where profile=10M
/ppp secret set [find name=ram.thapa] profile=5M
/ppp secret disable [find name=ram.thapa]
/ppp secret enable [find name=ram.thapa]
/ppp secret remove [find name=ram.thapa]

• Use service=pppoe so the account cannot be used for other PPP services.
• The comment field is the easiest place to keep the customer name, phone and paid-till date. You can search it with print where comment~"Pokhara".
• For a fixed IP, add remote-address=10.20.1.50 to the secret.
• Disabling a secret does not drop a user who is already online. Remove the active session too, shown below.

Bulk import many users

For dozens of users, write a script file and import it. Create users.rsc on your computer with one line per customer:

/ppp secret add name=user001 password=Pw1x9kQ2 service=pppoe profile=5M comment="Customer 001"
/ppp secret add name=user002 password=Pw7m3zT8 service=pppoe profile=10M comment="Customer 002"

Upload it to the router (WinBox: Files, drag the file in) and run:

/import file-name=users.rsc

Generate the lines from a spreadsheet with a formula so you do not type each one by hand. Back up before a big import: see MikroTik configuration backup. To export current users for a backup, use /ppp secret export file=secrets-backup and store the file safely off the router.

See who is online and kick a user

/ppp active print
/ppp active print count-only
/ppp active print where name=ram.thapa
/ppp active remove [find name=ram.thapa]

active print lists the username, address and uptime of every connected customer. Removing the active entry makes the user reconnect, which applies a changed profile or a disabled secret straight away. A user who cannot connect at all is a different problem: see MikroTik PPPoE client cannot connect.

Handle expired customers

Two common methods:

1. Disable the secret when the paid-till date passes, then remove the active session. Simple, but the customer sees a failed login.
2. Switch to an expired profile with a tiny speed or a redirect page, so the customer connects and sees a notice to pay. This needs a pool and firewall rules of its own.

A full walkthrough of the second method, including the redirect, is in block expired PPPoE customers on MikroTik. For many customers, consider a billing system such as a RADIUS-based one, because manual comments do not scale well past a few hundred users.

FAQ

Sources: my own experience running MikroTik PPPoE servers for ISP customers, and MikroTik’s published RouterOS PPP documentation. I did not run these exact commands on a router while writing, and RouterOS 6 and 7 differ slightly, so test on a non-production device first.