Hi, I'm trying to check if a user coming from a particular NAS, then check in that user is also a member of a GROUP associated to that NAS, else REJECT access. Authorise section.. if(NAS-Identifier == 'OpenVPN' && SQL-GROUP == 'openvpn') { update reply { Reply-Message := "OpenVPN AuthCheck OK" } reject } Wed Feb 1 00:37:59 2012 : Info: ++? if (NAS-Identifier == 'OpenVPN' && SQL-GROUP == 'openvpn') Wed Feb 1 00:37:59 2012 : Info: ? Evaluating (NAS-Identifier == 'OpenVPN' ) -> TRUE Wed Feb 1 00:37:59 2012 : Info: sql_groupcmp Wed Feb 1 00:37:59 2012 : Info: expand: %{User-Name} -> nev Wed Feb 1 00:37:59 2012 : Info: sql_set_user escaped user --> 'nev' Wed Feb 1 00:37:59 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Wed Feb 1 00:37:59 2012 : Info: expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'nev' ORDER BY priority Wed Feb 1 00:37:59 2012 : Debug: rlm_sql (sql): Released sql socket id: 1 Wed Feb 1 00:37:59 2012 : Info: sql_groupcmp finished: User is NOT a member of group openvpn As user 'nev' is not part of group 'openvpn' but is trying to access NAS 'OpenVPN' it should Reject the login and not go any further, but it does not. I know I'm missing something, so any help would be greatly appreciated. Thx Nev