PPPoE interface

Create PPPoE connection for ADSL modem connection

Last adaption: 07.2026

New:

Create default route updated

notempty

This article refers to a Beta version

PPPoE 12.7.0 PPPoE 12.6.0 PPPoE 12.5.1 VLAN v12.2 PPPoE 12.2 PPPoE 11.7

Please refer to the separate Error Analysis article

Requirements

Network configuration with free interface A0

Required are:

an unused Ethernet interface to connect to a modem
or
one free SFP interface for direct connection to a fiber optic line
corresponding zones

access data of the Internet provider

notempty

Please make sure that the person with the login credentials is available at the time of installation.

Create PPPoE interface

The wizard is called up with the PPPoE/VDSL button, both for connection to a modem and for connection to a fiber optic connection.

Name and Interface Step 1 - Name and Interface
Caption	Value	Description	Add interface UTMuser@firewall.name.fqdn Network Network configuration Step 1 PPPoE wizard step 1
Name:	wan0	The prefix wanx should be kept at all costs. The prefix wan is used to identify this interface as a WAN interface and, possibly, displayed or hidden in selection menus.
Interface:	A0	The physical interface to which the PPPoE interface is to be bound.
PPPoE for VDSL/fiber:	Off	On Must be enabled to specify a VLAN ID for VDSL or fiber connections.
VLAN ID: Only with VDSL/fiber optics	7	The VLAN ID is usually specified by the network operator
Next

Login Details Step 2 - Login Details
User name:	abcde	Access data issued by the provider	Step 2 PPPoE wizard step 2
Password:	•••••••••	Access data issued by the provider
Password:		Displays the password in plain text
Next

Zones Step 3 - Zones
Zones:	»external »firewall-external »external_v6 etc.	The wizard automatically takes over all zones of the physical interface. The zones are no longer needed there. The physical interface (here: A0) is only used for communication between the firewall and the modem. However, it is possible to manually select previously created zones in the click box and remove existing ones.	Step 3 Zones PPPoE wizard step 3 (zones)
Add new zone	No	Automatically adds a new zone and associates it with the WAN interface. The associated zone for the interface itself (firewall-) is automatically generated and does not need to be specified.
Add new zone	dmz3	if necessary: Name for the new zone
Generate rules:	No	Creates autogenerated rules to facilitate commissioning. These rules cannot be changed and must be replaced by individual rules in any case.
Update associated network objects:	on	If an existing zone has been selected, all network objects that are already in this zone and have an interface as a target are moved to the new interface.
Complete the wizard with Finish

As soon as the status in the network overview changes to green and a public IP address is output in the IP addresses field of the PPPoE interface, the connection to the provider has been successfully established.			Network configuration UTMuser@firewall.name.fqdn Network Network Network interfaces with PPPoE

Create default route

A default route must be created for this connection: Network Network Configuration Area Routing button Add Default Route
Gateway Type Interface Gateway Type: Interface
Caption	Value	Description	Add Default-Route UTMuser@firewall.name.fqdn Network Network configuration Create default route
Gateway:	wan0	Select the desired interface.
Dialog Save and close

Default route for IPv4. If necessary, another default route for IPv6 must be created.			Network configuration UTMuser@firewall.name.fqdn Network Routing with PPPoE

Gateway Type IP Gateway Type: IP
Caption	Value	Description	Add Default-Route UTMuser@firewall.name.fqdn Network Network configuration Create default route
Gateway:	fe80:1234::1/---	IP address of the gateway. If a Link Local IPv6 is recognised, the "Interface" button is displayed and an interface must be selected.
Interface: Only for link local IPv6	LAN1	Interface via which the IP address can be accessed.
Dialog Save and close

Default route for IPv6. If necessary, another default route for IPv4 must be created.			Network configuration UTMuser@firewall.name.fqdn Network Routing with PPPoE

notempty v07.2026
Caption	Value	Description
\|\| wan0 \|\| The prefix wanx should be kept at all costs. The prefix wan is used to identify this interface as a WAN interface and, possibly, displayed or hidden in selection menus.
Interface:	wan0	The physical interface to which the PPPoE interface is to be bound.
\|\| 1492 \|\|
\|\| Off \|\|
\|\| On \|\|
\|\| 5 Seconds \|\|
\|\| 3 \|\|
\|\| Seconds \|\|
IPv6:	Off
\|\| Off \|\|

notempty v07.2026
User name:	abcde	Access data issued by the provider
Password:	•••••••••	Access data issued by the provider
Password:		Displays the password in plain text

Zones Zones
Zones:	»external »firewall-external »external_v6 etc.	The wizard automatically takes over all zones of the physical interface. The zones are no longer needed there. The physical interface (here: A0) is only used for communication between the firewall and the modem. However, it is possible to manually select previously created zones in the click box and remove existing ones.
Update associated network objects:	On	If an existing zone has been selected, all network objects that are already in this zone and have an interface as a target are moved to the new interface.

DynDNS DynDNS notempty v07.2026
Enabled:	Yes	Enables or disables (default) the DynDNS function	DynDNS settings
Hostname:	hostname.spdns.de	Desired Hostname
User:	hostname.spdns.de	The corresponding user name must be entered here If linked to a reseller account, the corresponding host name must be entered here
Password:		The password must be entered here If linked to a reseller account, the update token must be entered here
Server:	update.spdyn.de	The securepoint update server
MX:
Webresolver:	On	Must be activated if the NAT router is located before the DNS (i.e.: UTM → Fritzbox/Speedport → internet)
Protocol:		The DNS service can be activated for IPv4 or IPv6 addresses only, or both IPv4 and IPv6.


Fallback Fallback notempty v07.2026
Fallback interface:	wan1	Interface that stands in for the main interface in the case of a malfunction. The absence of malfunctions is verified by ping-checking an IP. Further notes on the configuration of a fallback can be found in a separate Wiki article.	Fallback settings
Ping-check IP:	»203.0.2.203 »192.0.2.192	Host(s) to which the ping check is to be performed. This can also be a host in the internal network if necessary. This may also be a host in the internal network. If a ping check host does not respond, the subsequent IP address is tried immediately. If none of the ping check hosts responds, this is considered a failed attempt and checked again after the ping check interval.
Ping-check Intervall:	5 Seconds	Period between ping attempts
Ping-check Threshold:	4	Number of failed ping attempts before switching to the fallback interface.