Make a small pppoe/server router with Debian 13

25 Dec 2025

This guide explains how to set up a Debian 13 system with two Ethernet interfaces acting as a PPPoE server. This setup is useful for lab testing, for example when configuring a typical PPPoE router/firewall (PPPoE client) to access the Internet.

WARNING: This page may still contain some errors. Please contact me at giodev@panozzo.it and I will fix them.

WARNING: Interface names (e.g.: enp7s0) and IP addresses refer to my setup. You must change them to match your own configuration.

• Install Debian 13 (trixie) on a PC or VM with two Ethernet interfaces.
• Do not install a desktop environment.
• Assign a static IP address or DHCP to the external (WAN) interface
• The PPPoE service will run on the internal (LAN) interface.
• Configure the internal LAN interface with a dummy IP address and, if needed, add a VLAN interface for PPPoE.

  /etc/network/interfaces
  ...
  
  # The LAN interface
  allow-hotplug enp1s0
  iface enp1s0 inet static
    address 10.78.78.65/29
  
  # The VLAN for PPPoE on the LAN interface
  auto enp1s0.835
  iface enp1s0.835 inet static
    address 10.78.78.73/29
  
  # The WAN interface
  allow-hotplug enp7s0
  iface enp7s0 inet dhcp
  
  ....
  

• Add PAP or CHAP credentials to /etc/ppp/chap-secrets or /etc/ppp/pap-secrets or both.

  /etc/ppp/chap/secrets
  
  # client server secret IP address
  _username_ * _password_ *
  

• Create a file with the IP pool for clients:
  echo "192.168.170.2-10" > /etc/ppp/ipaddress_pool
• Create the file /etc/ppp/pppoe-server-options:

  require-chap
  noipv6
  lcp-echo-interval 5
  lcp-echo-failure 3
  ms-dns 8.8.8.8
  ms-dns 8.8.4.4
  netmask 255.255.255.0
  noipdefault
  debug
  logfile /var/log/pppoe-server.log
  

• Enable ipv4 forwarding:
  echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/80-enable-ipv4-forwarding.conf
  And then run sysctl --system
• Enable NAT: edit /etc/nftables.conf and add or modify the table ip nat section to allow masquerading of outgoing traffic:

  table ip nat {
  	chain prerouting {
  		type nat hook prerouting priority filter; policy accept;
  	}
  	chaint postrouting {
  		type nat hook postrouting priority srcnat; polixy accept;
  		oifname { "enp7s0" } masquerade
  	}
  }
  

• Enable and load nftables: systemctl enable nftables and load its table systemclt restart nftables
• Now create the systemd unit to start pppoe-server: put the following content in /etc/systemd/system/pppoe-lab-server.service

  [Unit]
  Description=PPPoE Server
  After=network-online.target nftables.service
  Wants=network-online.target
  
  [Service]
  Type=simple
  ExecStart=/usr/sbin/pppoe-server \
    -F \
    -C ISP \
    -L 192.168.170.1 \
    -p /etc/ppp/ipaddress_pool \
    -I enp1s0.835 \
    -m 1412
  Restart=on-failure
  RestartSec=5
  
  # Hardening
  NoNewPrivileges=true
  PrivateTmp=true
  ProtectSystem=full
  ProtectHome=true
  
  [Install]
  WantedBy=multi-user.target
  

• Enable and start the service
  systemctl daemon-reload
  systemctl enable pppoe-lab-server
  systemctl start pppoe-lab-server
  

Contacts