Discriminating request between internal and external of the tunnel

Hi, I am using radius for authorize/authenticate wireless users using PEAP and TTLS. I want to autenticate the users using the information in the tunneled request to a MySQL server. The problem is that freeradius try to authorize also the request outside of the tunnel, that contains an anonymous identity. I am now using the check "Freeradius-Proxied-To == 127.0.0.1" in the file users for determining when a request is inside the tunnel (this attribute is present) and when is outside (the attribute is not present). Is this the right way to do this or there is a better way? Thanks.