MikroTik hEX S — Bell Canada PPPoE Setup Procedure

Table of contents

Table of contents

MikroTik hEX S Bell Canada PPPoE Setup (VLAN 40) + Safe Backup Strategy

Step-by-step RouterOS v7.21.4 long-term setup for Bell PPPoE on VLAN 40, with backup and RSC recovery best practices before and after changes.

Important Security Note

Do not publish real PPPoE credentials in a public blog post. Replace username/password with placeholders before posting.

Video

Watch the tutorial on YouTube:

Open Video

Quick Environment Details

Date: 2026-05-21

Router: MikroTik hEX S

RouterOS: v7.21.4 (long-term)

LAN Router IP: 192.168.1.254/24

WAN Method: Bell PPPoE over VLAN 40 on SFP1

Network Diagram

Internet (Bell Canada) | [ Bell Modem ] (Bridge Mode) | sfp1 (sfp1-to-internet) | [ VLAN 40: vlan40-bell ] | [ PPPoE: pppoe-bell ] | [ MikroTik hEX S ] LAN: 192.168.1.254/24 | ether1 (ether1-to-pc) | Local Network 192.168.1.0/24

Pre-Change Checklist

  • Confirm current DHCP client, VLAN, PPPoE, NAT, and firewall state.
  • Create backup files before any change: one .backup and one .rsc.
  • Confirm Bell modem is in bridge mode.
  • Use placeholders in documentation: YOUR_BELL_USERNAME and YOUR_BELL_PASSWORD.

Step-by-Step RouterOS Commands

1) Review existing config:

/ip dhcp-client print /ip address print /interface bridge print /interface pppoe-client print /interface vlan print /ip dhcp-server print /ip firewall nat print /ip firewall filter print

2) Remove old DHCP client on WAN (if present):

/ip dhcp-client remove 0

3) Remove incorrect NAT rule (if it points to raw sfp1):

/ip firewall nat remove 0

4) Create VLAN 40 on SFP1:

/interface vlan add name=vlan40-bell vlan-id=40 interface=sfp1-to-internet comment="Bell VLAN 40 on SFP1"

5) Create PPPoE client on VLAN 40:

/interface pppoe-client add name=pppoe-bell interface=vlan40-bell user="YOUR_BELL_USERNAME" password="YOUR_BELL_PASSWORD" profile=default keepalive-timeout=10 add-default-route=yes default-route-distance=1 dial-on-demand=no use-peer-dns=yes allow=pap,chap,mschap1,mschap2

6) LAN IP on ether1 (if not already set):

/ip address add address=192.168.1.254/24 interface=ether1-to-pc

7) DHCP pool + server + network:

/ip pool add name=dhcp-pool-lan ranges=192.168.1.1-192.168.1.253 /ip dhcp-server add name=dhcp-lan interface=ether1-to-pc address-pool=dhcp-pool-lan lease-time=30m disabled=no /ip dhcp-server network add address=192.168.1.0/24 gateway=192.168.1.254 dns-server=8.8.8.8,8.8.4.4

8) NAT masquerade via PPPoE interface:

/ip firewall nat add chain=srcnat action=masquerade out-interface=pppoe-bell comment="Bell PPPoE NAT"

9) Basic firewall rules:

/ip firewall filter add chain=input connection-state=established,related action=accept comment="Allow established/related to router" /ip firewall filter add chain=input connection-state=invalid action=drop comment="Drop invalid to router" /ip firewall filter add chain=input in-interface=ether1-to-pc action=accept comment="Allow LAN to router" /ip firewall filter add chain=input in-interface=pppoe-bell action=drop comment="Drop unsolicited WAN to router" /ip firewall filter add chain=forward connection-state=established,related action=accept comment="Allow established/related forward" /ip firewall filter add chain=forward connection-state=invalid action=drop comment="Drop invalid forward" /ip firewall filter add chain=forward in-interface=pppoe-bell out-interface=ether1-to-pc action=drop comment="Drop unsolicited WAN to LAN"

Verification Commands

/interface vlan print /interface pppoe-client print detail /ip address print /ip dhcp-server print /ip dhcp-server network print /ip pool print /ip firewall nat print /ip firewall filter print /interface pppoe-client monitor 0 /ping 8.8.8.8 count=4

Backup and Recovery Plan

  • Create pre-change binary backup: backup-YYYY-MM-DD.backup
  • Create pre-change export: export-YYYY-MM-DD.rsc
  • Create post-change final backup after validation.
  • Download all backup files off-router (never keep only one copy).
  • If binary backup fails, rebuild using .rsc and re-import missing sensitive items.

When to Update and When to Wait

Update when: security fixes apply, critical bugs affect your setup, or required features are needed.

Wait when: no clear benefit exists, the site is remote with weak fallback access, or stability feedback is poor.

Quick Reference

  • PPPoE status: /interface pppoe-client monitor 0
  • Public IP check: /ip address print
  • DHCP leases: /ip dhcp-server lease print
  • NAT rules: /ip firewall nat print
  • Firewall rules: /ip firewall filter print
  • Routing table: /ip route print
  • Logs: /log print

MikroTik-only network engineer and trainer, helping Canadian businesses design, deploy, and understand MikroTik networks since 2002.

Leave a comment

Related Posts