MikroTik VDSL / DSL Modem

MikroTik VDSL / DSL Modem

MikroTik routers do not include a built-in VDSL or ADSL modem. To use a DSL internet connection you connect an external VDSL/ADSL modem (or a third-party SFP VDSL2 module) to a RouterOS WAN port, put the modem in bridge mode so RouterOS controls the connection, and run a PPPoE client on RouterOS to authenticate with the ISP.

Overview

The recommended architecture for DSL connectivity with RouterOS is:

Phone line / DSLAM
      │
[VDSL/ADSL modem — bridge mode]
      │ Ethernet
[RouterOS WAN port (ether1)]
      │
[PPPoE client interface (pppoe-wan)]
      │
Internet

The modem acts as a transparent layer-2 bridge. RouterOS negotiates PPPoE directly with the ISP and receives the public IP address on the pppoe-wan interface. This gives RouterOS full control over the WAN connection and avoids double NAT.

ISP modem modes, from most to least preferred:

Mode	Description
Full bridge (recommended)	Modem is pure layer-2 — RouterOS dials PPPoE and gets public IP
PPPoE pass-through	Modem passes PPPoE frames to the WAN port
IP pass-through / DMZ	Modem handles PPPoE but forwards the public IP to RouterOS
NAT router mode	Modem NATs — RouterOS gets a private IP (double NAT, least preferred)

Prerequisites

• RouterOS 6.49 or 7.x
• A VDSL2 or ADSL modem with bridge mode support (or an SFP VDSL2 module — see SFP VDSL2 module)
• ISP-provided PPPoE username and password
• Ethernet cable from modem LAN/bridge port to RouterOS WAN port (typically ether1)
• (Some ISPs) VLAN ID for the PPPoE session — check with your ISP

Configuration

Part 1: Put the DSL Modem in Bridge Mode

The exact steps depend on the modem model. The general procedure is:

1. Access the modem management interface (usually 192.168.1.1 or 192.168.0.1).
2. Find the WAN or DSL connection settings.
3. Change the connection type to Bridge or RFC 1483 Bridge (ADSL) / PTM Bridge (VDSL2).
4. Disable the modem’s DHCP server and NAT.
5. Save and reboot the modem.

Note: Some ISP-supplied modems do not expose a full bridge option. In that case, use IP pass-through or DMZ to the RouterOS WAN IP, or contact your ISP for an unlocked modem.

Part 2: Configure a PPPoE Client on RouterOS

With the modem in bridge mode, create a PPPoE client on the WAN-facing interface:

/interface pppoe-client
add name=pppoe-wan \
    interface=ether1 \
    user="your_isp_username" \
    password="your_isp_password" \
    add-default-route=yes \
    use-peer-dns=yes \
    disabled=no

Verify the interface comes up:

/interface pppoe-client print

The status field should show connected and R (running) flag should appear.

Part 3: PPPoE over a VLAN (if required by ISP)

Many VDSL ISPs require PPPoE to run on a specific VLAN (common examples: VLAN 10, 35, 101). Create a VLAN interface on the WAN port first, then bind PPPoE to it:

/interface vlan
add name=wan-vlan interface=ether1 vlan-id=35

/interface pppoe-client
add name=pppoe-wan \
    interface=wan-vlan \
    user="your_isp_username" \
    password="your_isp_password" \
    add-default-route=yes \
    use-peer-dns=yes \
    disabled=no

Replace 35 with the VLAN ID your ISP requires.

Part 4: NAT and Firewall for the PPPoE Interface

Apply masquerade NAT on the PPPoE interface (not on ether1):

/ip firewall nat
add chain=srcnat out-interface=pppoe-wan action=masquerade comment="DSL WAN masquerade"

Ensure your firewall input chain protects the PPPoE interface:

/ip firewall filter
add chain=input in-interface=pppoe-wan connection-state=established,related action=accept comment="Accept established/related from WAN"
add chain=input in-interface=pppoe-wan action=drop comment="Drop everything else from WAN"

Part 5: MSS Clamping

PPPoE reduces the effective MTU by 8 bytes. Without MSS clamping, large TCP segments (e.g., web pages with large responses) may be silently dropped by intermediate routers that cannot fragment them. Add a mangle rule to clamp TCP MSS on the PPPoE interface:

/ip firewall mangle
add chain=forward protocol=tcp tcp-flags=syn \
    in-interface=pppoe-wan action=change-mss \
    new-mss=clamp-to-pmtu comment="Clamp MSS to PMTU on PPPoE WAN (inbound)"
add chain=forward protocol=tcp tcp-flags=syn \
    out-interface=pppoe-wan action=change-mss \
    new-mss=clamp-to-pmtu comment="Clamp MSS to PMTU on PPPoE WAN (outbound)"

clamp-to-pmtu automatically sets the MSS to the correct value based on the path MTU. This rule is strongly recommended for all PPPoE WAN connections.

For IPv6, add equivalent rules under /ipv6 firewall mangle — the IPv4 mangle rules do not affect IPv6 traffic:

/ipv6 firewall mangle
add chain=forward protocol=tcp tcp-flags=syn \
    in-interface=pppoe-wan action=change-mss \
    new-mss=clamp-to-pmtu comment="Clamp MSS to PMTU on PPPoE WAN (IPv6 inbound)"
add chain=forward protocol=tcp tcp-flags=syn \
    out-interface=pppoe-wan action=change-mss \
    new-mss=clamp-to-pmtu comment="Clamp MSS to PMTU on PPPoE WAN (IPv6 outbound)"

SFP VDSL2 Module (Optional)

Some MikroTik devices with SFP slots can use a third-party SFP VDSL2 module (such as modules available from specialist vendors) to connect directly to a DSLAM without a separate modem. When inserted, the module presents as a standard Ethernet interface in RouterOS. Configuration is identical to the bridge-mode modem setup above — create the PPPoE client (and VLAN if required) on the SFP interface.

Compatibility note: SFP VDSL2 modules are produced by third-party vendors, not MikroTik. Compatibility with specific DSLAM profiles (vectoring, G.INP, VDSL2 profiles 17a/35b) depends on the module vendor. Verify compatibility with your ISP line type before purchasing.

Verification

Check the PPPoE interface status and assigned IP:

/interface pppoe-client print detail
/ip address print where interface=pppoe-wan

Check the default route via PPPoE:

/ip route print where gateway=pppoe-wan

Test internet connectivity:

/ping 8.8.8.8 count=4

Expected output: 4 replies with low round-trip times (typically under 20 ms for VDSL2).

Check PPPoE uptime and traffic counters:

/interface pppoe-client monitor pppoe-wan once

The uptime field shows how long the session has been connected. rx-bytes and tx-bytes confirm data is flowing.

Troubleshooting

PPPoE client stays in disconnected or authenticating state

• Verify the modem is in bridge mode — if it is still in router mode, it will intercept the PPPoE frames.
• Check username and password (case-sensitive — include the full user@domain if the ISP requires it).
• Confirm the correct interface: ether1 if using the modem directly, or wan-vlan if VLAN is required.
• Run a packet sniffer to verify PPPoE discovery packets reach the WAN port:

  /tool sniffer quick interface=ether1 mac-protocol=pppoe-discovery duration=10

PPPoE connects but no internet traffic

• Confirm the masquerade NAT rule targets pppoe-wan not ether1.
• Check the default route is pointing to pppoe-wan:

  /ip route print where dst-address=0.0.0.0/0

• If the route is missing, re-add the PPPoE client with add-default-route=yes.

Slow speed or high latency

• Check MTU. PPPoE reduces effective MTU by 8 bytes; the default RouterOS PPPoE MTU of 1480 handles this. If the ISP expects 1492, adjust:

  /interface pppoe-client set pppoe-wan max-mtu=1492 max-mru=1492

• Verify MSS clamping rules are in place (see Part 5). Missing MSS clamping causes PMTU blackholes where large TCP transfers stall while small requests work fine.
• Enable hardware offload on the bridge if applicable.
• Check for packet loss on the DSL line by pinging the ISP gateway.

PPPoE disconnects frequently

• Check DSL sync stability in the modem’s statistics (SNR margin, attenuation).
• Verify the phone cable is securely connected and filtered (ADSL requires a DSL splitter/filter on all phone sockets).
• Set keepalive-timeout on the PPPoE client if the ISP drops idle sessions:

  /interface pppoe-client set pppoe-wan keepalive-timeout=60

No IP assigned after PPPoE connects

• Some ISPs require a specific service name or AC name. Set whichever is known:

  /interface pppoe-client set pppoe-wan service-name="ISP_SERVICE_NAME"
  /interface pppoe-client set pppoe-wan ac-name="ISP_AC_NAME"

  Leave unset if unknown — an empty value matches any concentrator/service on the link.

See Also

• RouterOS PPPoE Client
• RouterOS VLAN
• RouterOS Firewall Filter
• RouterOS Firewall Mangle
• RouterOS NAT
• First Time Configuration (PPPoE)