Hello, first post here. I'm trying to implement dynamic access lists for 802.1X authenticated users. To do so, I'm using attribute NAS-Filter-Rule, as defined in RFC 4849 and FreeRADIUS Version 3.0.21 as the RADIUS server. To do so, I've modified users file with the following entry user1 Cleartext-Password := "pass1" Service-Type = Framed-User, Nas-filter-Rule = "permit in tcp from any to 10.2.3.4/24", Nas-filter-Rule += 0x00, Nas-filter-Rule += "permit in ip from 192.168.101.5/32 to 192.168.101.1", Nas-filter-Rule += 0x00, Nas-filter-Rule += "deny in ip from any to any", Nas-filter-Rule += 0x00 According to RFC 4849 "The String field is one or more octets. It contains filter rules in the IPFilterRule syntax defined in [RFC3588], Section 4.3, with individual filter rules separated by a NUL (0x00). A NAS-Filter- Rule attribute may contain a partial rule, one rule, or more than one rule. Filter rules may be continued across attribute boundaries, so implementations cannot assume that individual filter rules begin or end on attribute boundaries. The set of NAS-Filter-Rule attributes SHOULD be created by concatenating the individual filter rules, separated by a NUL (0x00) octet. The resulting data should be split on 253-octet boundaries to obtain a set of NAS-Filter-Rule attributes. On reception, the individual filter rules are determined by concatenating the contents of all NAS-Filter-Rule attributes, and then splitting individual filter rules with the NUL octet (0x00) as a delimiter. " In my example above, RADIUS server is sending NAS-Filter-Rule as a string, thus converting 0x00 into strings "0x00". If I remove the 0x00, then rules are not NUL separated which goes against the RFC, share/dictionary/radius/dictionary.rfc4849 defines NAS-Filter-Rule as ATTRIBUTE NAS-Filter-Rule 92 string I've been able to make it work as I think it should adding the following line to my dictionary # override NAS-Filter-Rule to convey NUL character between rules ATTRIBUTE NAS-Filter-Rule 92 octets My question is, is there any other way to force freeradius to send the entry rules as strings with NUL terminated character? Should I report this as an issue (bug) to freeradius developers so that they change the dictionary.rfc4849 entry? I hope my question is clear. Best regards Pablo