- Freeradius-Users - lists.freeradius.org

Fast BNG failover and FreeRadius
by David Lake 06 Nov '26

06 Nov '26

Hello I have 16,000 CPEs (PPPoE) connected across two BNGs - 8,000 homed on each. The issue I have is that we only have 16,000 IP addresses, 8,000 on each BNG and one IP pool. I advertise /32 routes. I know this is not ideal but needs must. I have a total of 59 "spare" addresses and everything is in the same prefix. My question is: If I loose a BNG and the CPEs rehome to the other BNG, how can I be sure that the previous sessions are immediately cleared and the addresses previously on the first BNG become available on the second? Thanks David Sent from Outlook for iOS<https://aka.ms/o0ukef>

2 1

Promises become reality!
by Alan DeKok 04 Nov '26

04 Nov '26

We're not releasing v4 yet. But there have been some interesting developments: https://github.com/FreeRADIUS/freeradius-server/commit/dc870475c1b63c587348… "support DTLS in rlm_radius" v4 now supports outbound RadSec, for both TLS and DTLS. We're working on inbound RadSec too. That will support both TLS and DTLS. Alan DeKok.

1 0

How to unit test 802.1X WiFi connection with eapol_test ?
by Olivier 30 Oct '26

30 Oct '26

Hello, I've got a Freeradius instance on a debian 13 host. It is used as a backend with a (rather old) Unifi WPA2 Entreprise. WiFi rely on PEAP/MSCHAPv2. My goal is to unit test connections from an Android device. I'm using the followiing script on the debian 13: cat > ${TMP_CFG} << EOF network={ ssid="${SSID}" key_mgmt=WPA-EAP eap=PEAP identity="${CLIENT_ID2}" password="${CLIENT_PWD}" phase2="autheap=MSCHAPV2" ca_cert="${SYSTEM_CA_CERT}" domain_match="${DOMAIN}" } EOF eapol_test -v -c ${TMP_CFG} -a ${SERVER_IP} -A ${SERVER_IP} -s ${RADIUS_SECRET} >> ${LOG_FILE} Last line returns 0 as exit code. Now with my smartphone, I must disable CA Certificate validation to successfully connect to WiFi. 1. What do you think of the above script ? Can I use it reliably to test WiFi connections from Android, Windows, iOS and MacOS devices ? 2. What could explain difference between live testing with a real Android device and the above script ? Best regards

4 9

Tabulate Open Source Billing systems that uses FreeRadius
by Douglas Fischer 29 Oct '26

29 Oct '26

P.S.1: Please excuse this "semi" off-topic post. Perhaps I am trying to reinvent the wheel... Where I live, there is a great deal of ambiguity regarding the definitions of ERP, CRM, Payment Gateway, Invoice, Billing, OSS, BSS, ACS, and so on. Companies intentionally blur the lines between these "things" as a form of vendor lock-in strategy. This bothers me A LOT! I am looking for one or more open-source options to propose to my small-to-medium-sized ISP network consulting customers, specifically to serve as a RADIUS solution. Furthermore, I want to steer clear of the tempting idea of building a tool in-house. While it often seems like the shortest path, my extensive experience has shown that it almost always ends up being the most convoluted one. The primary use case I have in mind involves providing internet connectivity via BNGs (Broadband Network Gateways) using PPPoE or IPoE, supporting multiple BNG vendors. I am looking for a list of billing tools that: 1. Are open source. 2. Use FreeRADIUS as the RADIUS AAA engine. 3. Are not inseparable monoliths, and instead allow for high availability and scalability within the RADIUS layer. 4. Adhere, at least to some extent, to OSS/BSS concepts and TM Forum standards. P.S. 2: I have genuine doubts as to whether "billing" is the correct term to use, but for lack of anything better, I’ll stick with "billing." I can think of a few tools off the top of my head that partially meet these requirements, but I’d prefer not to name them—I don’t want to steer the discussion toward any specific software. My MAIN goal is to expand the list of available options. -- Douglas Fernando Fischer Engº de Controle e Automação

4 4

FreeRadius Proxy Status-Server with require_message_authenticator = yes
by Jakob Mellberg 28 Oct '26

28 Oct '26

I am having issues when proxy servers are marked as down and freeradius send Status-Server and the remote server returns an Access-Accept without a Message-Authenticator. Debug: Ignoring invalid packet - Insecure packet from host xxx.xxx.xxx.xxx: Packet does not contain required Message-Authenticator attribute. You may need to set "require_message_authenticator = no" in the configuration. Then my home-servers are never marked as up again due to this behavior that the Access-Accept response does not contain a Message-Authenticator. I find it confusing that in the RFC for Status-Server in the Access-Accept response the Message-Authenticator is optional. https://www.freeradius.org/rfc/rfc5997.html Ideally I want to have require_message_authenticator = yes for all other requests to the home-servers and ignore it for Status-Server. Anyone else have experienced this issue and resolved it without setting require_message_authenticator = no? Sincerely, Jakob

2 2

Release 3.2.11 and security fixes
by Alan DeKok 22 Oct '26

22 Oct '26

We're going to be releasing 3.2.11 shortly. It contains a number of fixes for RadSec, and other situations with lost packets. Again, much thanks to Paul Dekkers for valuable assistance with testing. The release will also include security fixes for TEAP and FAST. If you're not using those methods, then you're not affected. Alan DeKok.

1 0

Issue with SQL-Group
by David Lake 13 Oct '26

13 Oct '26

Hello FreeRadius 3.2.10 with sqlippool and split read/write to a backend Galera cluster. I have an issue where SQL-Group is not populating the group since I’ve moved from a single module (sql) to two (sql_read and sql_write). This is what I see with a single module named sql: (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: --> SELECT groupname FROM radusergroup WHERE username = '100061702368(a)boxbb.uk' ORDER BY priority (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = '100061702368(a)boxbb.uk' ORDER BY priority (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: User found in the group table (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '1g' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '1g' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Group "1g": Conditional check items matched (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Group "1g": Merging assignment check items (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '1g' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '1g' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Group "1g": Merging reply items (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: ERX-CoS-Shaping-Pmt-Type = "T06 1g” This is what I see when I change the module to be sql_read: (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: --> SELECT groupname FROM radusergroup WHERE username = '10091055046(a)boxbb.uk' ORDER BY priority (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Executing select query: SELECT groupname FROM radusergroup WHERE username = '10091055046(a)boxbb.uk' ORDER BY priority (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: User found in the group table (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Group "1g": Conditional check items matched (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Group "1g": Merging assignment check items (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Group "1g": Merging reply items The difference is in the bold line - the response from sql_read no longer has the groupname set. Nothing has changed in the database. What have I missed please? Thanks David David Lake Visiting Professor 5G Innovation Centre (5GIC and 6GIC) Tel: +44 (0)7711 736784 Email: d.lake(a)surrey.ac.uk<mailto:%20d.lake@surrey.ac.uk> Web: surrey.ac.uk<http://www.surrey.ac.uk/?utm_medium=internal&utm_source=emailsignature&utm_…> [A blue text on a black background Description automatically generated]<http://www.surrey.ac.uk/?utm_source=emailsignature&utm_medium=internal&utm_…> James Clerk Maxwell Building, University of Surrey, Guildford, Surrey, GU2 7XH, UK

2 2

3.2.x: clients read from SQL still ignore require_message_authenticator / limit_proxy_state (#5378)
by Kushal Gupta 09 Oct '26

09 Oct '26

Hi, I'm running FreeRADIUS 3.2.5 (Ubuntu 24.04 package) with clients loaded from the nas table (rlm_sql, read_clients = yes, stock client_query). The NASes are MikroTik routers. In radiusd.conf: security { require_message_authenticator = yes limit_proxy_state = auto } These settings don't apply to clients read from SQL. They do apply to clients from clients.conf. Hand-built Access-Requests (radclient always adds Message-Authenticator, so I built the packets myself), sent from the same IP, defined either as a nas row or as a clients.conf client: Client defined as a nas row (SQL): - no Message-Authenticator: answered - no Message-Authenticator, with Proxy-State: answered - with Message-Authenticator: answered Client defined in clients.conf with require_message_authenticator = yes: - no Message-Authenticator: dropped - no Message-Authenticator, with Proxy-State: dropped - with Message-Authenticator: answered Client defined in clients.conf with require_message_authenticator = auto: - no Message-Authenticator: answered - no Message-Authenticator, with Proxy-State: dropped - with Message-Authenticator: answered This is GitHub issue #5378 ("Blast parameters does not work for SQL clients"). It was closed after ef5e6560 ("inherit from the main dynamic client definition"), and the last comment there says SQL clients inherit the global settings. As far as I can tell from the current v3.2.x branch, that commit only changed client_afrom_request() (dynamic clients). SQL clients still go through: - rlm_sql.c, generate_sql_clients(): client_afrom_query(..., server, false); so require_ma is always false; - client.c, client_afrom_query(): require_ma comes from that argument, and limit_proxy_state is never set, so it stays at its talloc_zero value. So even on 3.2.6 to 3.2.8, an SQL client seems to get neither setting. Questions: 1. Am I reading this right? If so, would a patch that makes client_afrom_query() start from main_config.require_ma and main_config.limit_proxy_state (the way client_afrom_cs() does) be accepted? Optional per-client columns in client_query could come on top of that. I can open a new issue or a PR. 2. Until then, I'm planning to enforce it in unlang, first thing in authorize, with a per-NAS flag in the nas table (set for NASes whose firmware sends Message-Authenticator): authorize { if (&Proxy-State && !&Message-Authenticator) { do_not_respond } if (!&Message-Authenticator && "%{sql:SELECT require_message_auth FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" == "1") { do_not_respond } ... } Is that a sound workaround, or does it miss something? For example, is a reply ever sent before authorize runs, or are there other packet types I should cover the same way? I know moving the clients to clients.conf would work. I'd like to keep them in SQL because a web panel manages the NAS list. Thanks, Kushal Gupta

2 1

Radius accounting/sqlippool question
by David Lake 09 Oct '26

09 Oct '26

After much work, I have now upgraded my FreeRadius, HAProxy and MariaDB and appear to have a MUCH more performant system - thank you for everyone’s help and ideas. I do have a question because I think I must have missed something. In my ‘default’ I have this: post-auth { ... if(!&reply:Framed-IP-Address) { update reply { control:Pool-Name = "Pool" } sqlippool } if (noop) { reject } -sql_write ... } This allocates an address from the pool ‘Pool. In sqlippool I have this: sqlippool { sql_module_instance = "sql" dialect = "mysql" pool_name = "Pool-Name" ippool_table = "radippool" lease_duration = 3600 allocate_clear_timeout = 1 attribute_name = Framed-IP-Address req_attribute_name = Framed-IP-Address pool_key = "%{Calling-Station-Id}" messages { exists = "Existing IP: %{reply:${..attribute_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IP: %{reply:${..attribute_name}} from %{control:${..pool_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" clear = "Released IP %{request:${..attribute_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" failed = "IP Allocation FAILED from %{control:${..pool_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" nopool = "No ${..pool_name} defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" } $INCLUDE ${modconfdir}/sql/ippool/${dialect}/queries.conf } Also in default there is a statement that I should uncomment sqlippool in the accounting section: accounting { detail # # Return an address to the IP Pool when we see a stop record. # # Ensure that &control:Pool-Name is set to determine which # pool of IPs are used. # sqlippool -sql_write exec attr_filter.accounting_response } I’m getting a bit confused here. I can see that ‘control:Pool-Name’ works for authentication because addresses are being allocated from that pool But do I need to uncomment sqlippool and then how to I tell it to use the pool name ‘Pool’? Is pool_name=‘Pool-Name’ referencing the Pool-Name above or is that the actual name of the pool it will use? Thanks David

2 2

FreeRadius 3.0.3 and Galera Cluster
by David Lake 28 Sep '26

28 Sep '26

Hi Need some design advice here please. I have two FR 3.0.3 servers and a 3-node Galera cluster for HA. I’m seeing issues with Deadlocks when under stress - mostly if there is a storm of reconnects. I’m running HAProxy on the FR nodes but there are a couple of things I don’t quite understand: 1. Should I run the ’Skip Locked’ on FreeRadius or not? Some documentation says that I shouldn’t as MariaDB doesn’t support it, but other say newer versions do support it 1. What is the optimal way of configuring HAProxy? 1. How do I separate out writes from reads - I have two sites, each with one FR server and one Galera node. There is a high-speed network between the two, but ideally, I want to keep cross-site traffic to a minimum. (I have another IP allocation question which I’ll ask in another three). Thank you David David Lake Visiting Professor 5G Innovation Centre (5GIC and 6GIC) Tel: +44 (0)7711 736784 Email: d.lake(a)surrey.ac.uk<mailto:%20d.lake@surrey.ac.uk> Web: surrey.ac.uk<http://www.surrey.ac.uk/?utm_medium=internal&utm_source=emailsignature&utm_…> [A blue text on a black background Description automatically generated]<http://www.surrey.ac.uk/?utm_source=emailsignature&utm_medium=internal&utm_…> James Clerk Maxwell Building, University of Surrey, Guildford, Surrey, GU2 7XH, UK

5 10