<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7652.24">
<TITLE>Proxy with two interfaces configuration</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">Hello all,</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">I am using freeradius 2.1.0 on two ubuntu machines, one of which is configured as server and one as proxy.</FONT>
<BR><FONT SIZE=2 FACE="Arial">The network is configured in ipv6 but that's not the problem here (everything regarding ipv6 works well now)</FONT>
<BR><FONT SIZE=2 FACE="Arial">I am trying to create a testbed where there is three machines:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">-one server, which listens to an interface</FONT>
<BR><FONT SIZE=2 FACE="Arial">-one client (for testing I am just using radclient) that sends auth requests to a proxy</FONT>
<BR><FONT SIZE=2 FACE="Arial">-one proxy, in the middle of the two other machines, that proxies auth requests to the server. This proxy has two interfaces, one connected to the client and one to the server.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">All following ipv6 addresses are to be read with global scope (but as I said, if they were ipv4 it would be the same I think)</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Server address : 2001::400 </FONT>
<BR><FONT SIZE=2 FACE="Arial">Proxy (interface to the server) 2001::300</FONT>
<BR><FONT SIZE=2 FACE="Arial">Proxy (interface to the client) 2000::300</FONT>
<BR><FONT SIZE=2 FACE="Arial">Client 2000:200 </FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Now when I try to run the test what it happens is that the client sends the auth request, the proxy correctly forwards it to the server, and the server correctly authenticate the client. The problem is that the proxy sends the proxied message with the address 2000::300, not 2001::300. When the server tries to reply to the proxy, it tries to send the packet to 2000::300 but since it is a different network there is no route for it.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">I have been searching for a while in the users / radiusd.conf / clients.conf / proxy.conf for a option to set the proxy ip address when proxying messages. It seemed to me that I saw something like that , but if I did I just can't find it again.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">If it exists it would be sufficient to tell me where to find it and I will hopefully solve this issue on my own.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">I attach some config files:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Server:</FONT>
<BR><FONT SIZE=2 FACE="Arial">Clients.conf</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"># IPv6 Client</FONT>
<BR><FONT SIZE=2 FACE="Arial">client 2000::300 {</FONT>
<BR> <FONT SIZE=2 FACE="Arial">nastype = other</FONT>
<BR> <FONT SIZE=2 FACE="Arial">secret = testing123</FONT>
<BR> <FONT SIZE=2 FACE="Arial">shortname = relay</FONT>
<BR><FONT SIZE=2 FACE="Arial">}</FONT>
<BR><FONT SIZE=2 FACE="Arial">(if I set 2001::300 it tells me that it receives a packet from the unknown host 2000::300 and discards it)</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Radiusd.conf</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">listen {</FONT>
<BR><FONT SIZE=2 FACE="Arial"># ipaddr = *</FONT>
<BR> <FONT SIZE=2 FACE="Arial">ipv6addr = 2001::400</FONT>
<BR> <FONT SIZE=2 FACE="Arial">port = 0</FONT>
<BR> <FONT SIZE=2 FACE="Arial">type = auth</FONT>
<BR><FONT SIZE=2 FACE="Arial">}</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Proxy</FONT>
<BR><FONT SIZE=2 FACE="Arial">Clients.conf</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"># IPv6 Client</FONT>
<BR><FONT SIZE=2 FACE="Arial">client 2000::200 {</FONT>
<BR> <FONT SIZE=2 FACE="Arial">secret = testing123</FONT>
<BR> <FONT SIZE=2 FACE="Arial">shortname = mobile</FONT>
<BR><FONT SIZE=2 FACE="Arial">}</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Proxy.conf</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">home_server rad_server {</FONT>
<BR> <FONT SIZE=2 FACE="Arial">type = auth</FONT>
<BR> <FONT SIZE=2 FACE="Arial">ipv6addr = 2001::400</FONT>
<BR> <FONT SIZE=2 FACE="Arial">port = 1812</FONT>
<BR> <FONT SIZE=2 FACE="Arial">secret =testing123</FONT>
<BR><FONT SIZE=2 FACE="Arial">}</FONT>
<BR><FONT SIZE=2 FACE="Arial">home_server_pool my_auth {</FONT>
<BR> <FONT SIZE=2 FACE="Arial">type = fail-over</FONT>
<BR> <FONT SIZE=2 FACE="Arial"> home_server = rad_server</FONT>
<BR><FONT SIZE=2 FACE="Arial">}</FONT>
<BR><FONT SIZE=2 FACE="Arial">realm example.com {</FONT>
<BR> <FONT SIZE=2 FACE="Arial">auth_pool = my_auth</FONT>
<BR><FONT SIZE=2 FACE="Arial">}</FONT>
<BR><FONT SIZE=2 FACE="Arial">(example.com is the realm I use in the test)</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">P.S: another quick question. It is possible with some logging option (or in other ways) to save the attributes that the server adds to the auth accept message locally in a file in the proxy machine? I saw that there is some options to add/modify the attributes in the reply, but it is possible to save them in a file?</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Thanks in advance for the help and sorry if I am missing out something obvious.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Best Regards,</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">--</FONT>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">D'Avella Stefano</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Bell Labs</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Alcatel-Lucent</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Centre de Villarceaux</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Route de Villejust</FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">91625 NOZAY</FONT></SPAN><SPAN LANG="fr"></SPAN>
</P>
</BODY>
</HTML>