Summary
▎ With the PPPoE server on a VPP interface and NAT44 configured with that interface as inside, no subscriber traffic is translated. Subscribers get an IP and can reach the BNG, but have no internet. show nat44 sessions stays empty.
▎
▎ Version
▎ 2026.10.16-0024-rolling (VPP 25.10.0-58~vyos). The same happens on 1.5.0 (VPP 25.10.0-48).
▎
▎ Config (relevant part)
▎ set vpp settings interface eth0
▎ set vpp settings interface eth2
▎ set vpp nat nat44 interface inside 'eth0'
▎ set vpp nat nat44 interface outside 'eth2'
▎ set vpp nat nat44 address-pool translation interface 'eth2'
▎ set service pppoe-server interface eth0
▎ set service pppoe-server gateway-address '100.127.0.0'
▎ set service pppoe-server client-ip-pool Con-Pool range '100.64.0.0/21'
▎ set service pppoe-server authentication mode 'radius'
▎
▎ Steps to reproduce
▎ 1. Configure as above, connect a PPPoE client (MikroTik CPE in my lab).
▎ 2. From the client: ping 1.1.1.1 -> no reply.
▎ 3. sudo vppctl show nat44 interfaces -> eth0 in, eth2 out.
▎ 4. sudo vppctl show nat44 sessions -> no sessions. show errors counts nat44-ed-out2in-slowpath: no translation.
▎
▎ Why (as far as I can tell)
▎ Subscriber packets arrive on eth0 PPPoE-encapsulated. After pppoe-input decapsulation they continue with the RX sw_if_index of the session interface (pppoe_sessionN), not eth0. The NAT44 in2out feature is enabled only on eth0, so it never sees these packets. Each session interface is created dynamically by accel-ppp, so it cannot be listed as inside in the config.
▎
▎ Workaround (works, but not persistent)
▎ sudo vppctl set interface nat44 out eth2 del
▎ sudo vppctl set interface nat44 out eth2 output-feature
▎ With this, subscribers have internet (tested up to 2,000 sessions, ~1.3 Gbit/s). The setting is lost on every VPP restart and on every vpp commit, so I re-apply it from a commit post-hook and the boot script (script attached).
▎
▎ I know output-feature was removed in T7264 because it translates everything that leaves the outside interface. For a BNG that is usually what you want (all subscribers behind CGNAT), but not when some subscribers have public IPs. So I am not asking to bring it back unconditionally.
▎
▎ Expected
▎ A supported way to NAT PPPoE subscribers, for example one of:
▎ 1. When the PPPoE server interface is a NAT44 inside interface, mark every pppoe_sessionN as inside when the session is created (and remove it before the session is deleted).
▎ 2. An opt-in option, e.g. set vpp nat nat44 interface outside eth2 output-feature, documented with the T7264 trade-off.
▎ 3. Possibility to exclude source prefixes (public subscriber ranges) from translation when output-feature is used.
▎
▎ Related observation
▎ With the output-feature workaround, I saw one VPP worker crash on PPPoE session deletion (CoA + Disconnect of one user, traffic running): SIGSEGV fib_path_list_get_resolving_interface <- nat_pre_in2out_output <- nat44_ed_in2out_slowpath. I don't have a clean reproduction yet and will open a separate task if I get one.