When using a Mikrotik router (or any other decent home router) as your PPPoE client, it’s good to be able to keep access to the ADSL/VDSL modem in-line to allow diagnostics, additional configuration etc. To avoid a situation where the router is essentially double-NATing all the packets going across the WAN link, the ideal setup is a secondary IP address on the router’s WAN interface, that is handled separately.
Below is a crude drawing of my home setup. The Draytek Vigor 130 is acting as a VDSL modem, bridging the PPPoE connection across to the Mikrotik RB2011UAS-2HnD-IN which is ‘dialing’ the PPPoE connection back to my ISP. The ISP dishes out an IP address which lands directly on the router, passing through the Draytek. On the LAN side of the router, is a pretty boring DHCP subnet (with DNS setup as mentioned here).
To setup the router/modem to allow access to both (without unplugging the router to get back to the modem) – you can do the following:
First, add an IP address to the modem:
(On Draytek, using GUI, added 192.168.2.1 255.255.255.252)
Now, add the corresponding interface on the Mikrotik (access via SSH, note below is only 2 lines of config):
/ip address add address=192.168.2.2/30 comment="To get to VDSL modem" interface=ether1-gateway network=192.168.2.0
This will add the other end of the /30 network to the ether1-gateway (physical) interface on the Mikrotik router.
Now, all we need to do is tell the router that it’s OK to NAT on that address, on that interface:
/ip firewall nat add action=masquerade chain=srcnat out-interface=ether1-gateway
If all went to plan, you should be able to ping 192.168.2.1 from your Mikrotik:
[admin@burnett-home] > ping 192.168.2.1 HOST SIZE TTL TIME STATUS 192.168.2.1 56 255 0ms 192.168.2.1 56 255 0ms sent=2 received=2 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=0ms
All done, now you can browse to both the router IP for GUI config, and get to the VDSL modem’s config page as well.
Help on this one came from the DD-WRT wiki.