Skip to content
ISPManISPMan Docs

Expired PPPoE user still has internet

Symptoms

Section titled “Symptoms”
  • User account is expired or suspended.
  • User is still able to access the internet.

Cause

Section titled “Cause”

The DNS allow rules for restricted users (no-internet address list) are missing from the MikroTik firewall configuration.

Resolution

Section titled “Resolution”

Verify that the following rules exist:

Terminal window
/ip firewall filter add chain=forward action=accept src-address-list=no-internet protocol=udp dst-port=53 comment="Restricted: allow DNS UDP"


/ip firewall filter add chain=forward action=accept src-address-list=no-internet protocol=tcp dst-port=53 comment="Restricted: allow DNS TCP"

If these rules are missing, re-add them and test again with an expired PPPoE account.

Notes

Section titled “Notes”

These DNS rules are required for the captive portal restriction workflow. Removing them can result in expired PPPoE users retaining internet access unexpectedly.