Hello Sorry if this is a FAQ, but I have not found the answer, so here I am: I use freeradius-1.1.6. The server do authorization and authentication for a few NAS. Some users have logins in the local realm and others have logins in proxied realms. When a user passes authorization, the server returns a Framed-IP-Address to the NAS. The address depends of the NAS and is selected using huntgroups. I have a problem with users in proxied realms: after proxy authentication is successful, radiusd sends a packet to the NAS with no Framed-IP-Address, or with a Framed-IP-Address taken from the proxy RADIUS server. I want my radius server to choose the Framed-IP-Address and ignore what proxied servers send. This can be acheived uwing the attr_filter module, but that module will only allow selection the address based on the realm. I cannot select through huntgroups, which is what I'm looking for. The workaround I found is to add post_proxy_authorize = yes in the server secion of proxy.conf. That causes the proxied reply to go to the authorization stage again and to have a correct Framed-IP-Address added. That post_proxy_authorize option is documented as depreacted and scheduled for future removal. How can I acheive my setup without it? I'm pretty confident there is a way of doing it, but I have not been able to find it. -- Emmanuel Dreyfus manu@netbsd.org