Turning a MikroTik L009 into a Home Router: PPPoE, CGNAT Gotchas, and CAPsMAN WiFi

The first installment of a homelab series walks through replacing an ISP-supplied router with a MikroTik L009UiGS-RM, chosen for its Gigabit ports, PoE output, and wall-mountable form factor. The author’s goal is tighter control over home traffic and better performance by prioritizing wired links over WiFi. The most valuable part is the pre-purchase homework: you have to know how your ISP hands off the connection along two independent axes — the WAN authentication method (plain DHCP/IPoE versus PPPoE, sometimes tagged on a dedicated VLAN) and whether you receive a public or private IPv4. A private WAN address means CGNAT, and the strictest variant, DS-Lite, gives you no IPv4 at all and tunnels it inside IPv6. MikroTik can’t auto-discover the DS-Lite AFTR address, and under any CGNAT scheme port forwarding, UPnP, and inbound remote access break — so the advice is to confirm public-IP availability (often a paid add-on) before buying hardware.

The configuration section covers the author’s own setup: PPPoE over VLAN 35 with a private IPv4. Steps include initial WinBox access, immediately changing the blank default admin password, and cloning the original ISP router’s MAC onto ether1 because the service is bound to that address. From there a VLAN interface is stacked on the WAN port, a PPPoE client is created to pull a default route and the ISP’s DNS, and credentials are entered to bring the link from “linking” to “connected.”

WiFi is handled with a separate wAP access point powered over PoE from port 8, avoiding a wall adapter. Rather than manage the AP by hand, the author uses RouterOS’s CAPsMAN controller feature, defining a shared WPA2/WPA3 security profile and 2.4/5 GHz channel templates on the router so the access point downloads its config centrally. The writeup is practical and command-driven, with RouterOS CLI snippets throughout, aimed at readers building a self-hosted lab who want to escape ISP-router limitations.