Frequently Asked Questions

Issue

PPPoE users do not disconnect after their subscription expires.

Possible Causes

The MikroTik router contains PPPoE usernames and passwords from an older billing system. These credentials bypass ispman session control and authenticate users directly on the router without enforcing expiry.

Required DNS restriction firewall rules are missing from the Mikrotik router. When these rules are removed, expired users may continue to have internet access.

Resolution

• Remove all legacy PPPoE secrets from the router
• Confirm PPPoE authentication is linked only to ispman
• Reconnect users to apply proper session limits
• Verify the required DNS restriction firewall rules exist on the router.
  If the DNS restriction rules are missing, add them using:
  /ip firewall filter add chain=forward action=accept src-address-list=no-internet protocol=udp dst-port=53 comment="Restricted: allow DNS UDP" /ip firewall filter add chain=forward action=accept src-address-list=no-internet protocol=tcp dst-port=53 comment="Restricted: allow DNS TCP"

Issue

Devices appear online in monitoring yet remote management tools like Winbox SSH or HTTP fail to connect.

Possible Causes

• RouterOS is outdated and lacks fixes or protocol compatibility required by newer management clients.
• Router or uplink is experiencing high latency or packet loss which breaks remote sessions.
• Firewall rules or hairpin NAT prevent management ports from being reached remotely.
• ISP or intermediate network is blocking management ports.

Resolution

• Check RouterOS version and upgrade if available. Example CLI steps: /system package update check /system package update download /system reboot
• Verify device CPU and interface load to rule out resource exhaustion.
• From the router run continuous pings toward a stable host to measure latency and packet loss. Example: /tool flood-ping 8.8.8.8
• Confirm firewall filter and NAT rules allow the management port and are not restricting source IP ranges.
• If remote access is through WAN address confirm port forwarding or remote management is enabled and not blocked by the ISP.
• As a workaround enable a secure remote tunnel such as WireGuard or an SSH reverse tunnel from the site to your management host.

Issue

Access point shows it is connected physically but its status remains at Obtaining IP and clients cannot use it.

Possible Causes

• AP is plugged into a port that is not part of the bridge used for client VLAN or management VLAN.
• Port VLAN tagging or PVID is incorrect so DHCP requests do not reach the DHCP server.
• DHCP server is down or there are no available leases.
• AP has incorrect static settings or wrong management VLAN configured.

Resolution

• Check that the AP port is assigned to the correct bridge. Example CLI checks: /interface bridge port print /interface bridge vlan print
• Verify the AP port PVID and tagging match your VLAN design.
• Confirm DHCP server status and leases: /ip dhcp-server print /ip dhcp-server lease print
• Look for the AP MAC in ARP table to confirm layer 2 connectivity: /ip arp print where mac-address~"AA:BB:CC"
• Move the AP to a known working bridge port to isolate switch config issues.
• Reboot the AP or factory reset if management settings are corrupted.
• After changes request the AP to renew DHCP or power cycle it so it gets an IP from the correct VLAN.

Issue

A PPPoE account shows as paid in ispman but the user cannot connect. MikroTik logs show messages like authentication failed for user xxx.

Possible Causes

• The PPPoE username configured on the client device does not exactly match the username in ispman.
• The PPPoE password entered on the client or CPE is incorrect.
• Old or cached credentials exist on the client device or router.
• The client is attempting to authenticate against the wrong PPPoE server or service.
• Multiple PPPoE services exist on the router and the user is hitting the wrong one.

Resolution

• Verify the PPPoE username in ispman and ensure it matches character by character on the client.
• Reset the PPPoE password in ispman and reconfigure it on the client device.
• Clear saved PPPoE credentials on the router or CPE and reconnect.
• Check MikroTik PPP logs to confirm the username being attempted: /log print where message~"pppoe"
• Confirm the correct PPPoE service is enabled and bound to the intended interface.
• Disconnect any stale sessions and allow the user to reconnect after correction.