619 Lessons from Running an ISP

Every expensive mistake made building and running a fibre ISP, written down so you don't have to repeat them.

A sample of what's inside

• Why two tunnels to one destination through CGNAT costs you 40–60% packet loss — and why nothing in your config will tell you
• Why a routing change per customer needs a scoped connection-tracking flush, or the customer stays on both paths for 24 hours
• Why /ppp active filters look like they work and silently don't — with the two-line proof
• Why a blackholed DNS pin looks exactly like a slow VPN
• Why the far end's autonegotiation advertisement is what limits your link speed, and why forcing the speed kills it entirely
• Why a brand-new patch cable can still be your fault
• Why "connection refused" and "connection timed out" send you to completely different problems
• Why CGNAT port exhaustion looks like a perfectly clean line — normal ping, no loss, and only new connections failing
• Why a byte counter that only ever goes up will lie after a link flap, and let a monthly allowance run out with no warning
• Why a failover must never trigger on a dead account — it swaps links every cycle and fixes nothing
• Why one TCP port can belong to two services, and every rule keyed on the port alone breaks one of them
• Why anti-bot checks fail the moment a customer's session changes public IP between two lines

Who this is for

Engineers running or building a small ISP on MikroTik and RADIUS. Every lesson came from a real outage, a real wasted afternoon, or a real invoice. Several cost weeks.

What it isn't

Not a beginner's tutorial and not vendor documentation. It assumes you know what PPPoE and a routing table are, and goes straight to the failures that documentation never mentions.

Instant download, PDF. Free updates as the list grows.