Bypass SQLIPPOOL via variable?
Hello, First off let me say, Freeradius works great! That being said I have an issue that I'm wondering if anyone has insight into. We have freeradius serving vpn servers for our internal employees using PPTP, L2TP/IPSEC, and lastly OpenVPN. The problem we are running into is with OpenVPN and the assignment of IP addresses from the IP pool. Due to a limitation in the TAP implementation, IPs given from the IP pool have to be part of a /30 and we cannot guarantee this. Since OpenVPN registers itself as a "Virtual" connection while PPTP/L2TP use "Async" is there a way to stop the sqlippool assignment based off this? i.e. by default if user is in dynamic IP pool they get a dynamic IP. If they are coming in as a "Virtual" connection, drop out of SQLIPPOOL and just let freeradius auth the connection and then let OpenVPN use it's predefined IP pool which we will in turn NAT? Any insight would be great. Thanks!
On Nov 1, 2012, at 1:02 PM, bearon@gmail.com wrote:
If they are coming in as a "Virtual" connection, drop out of SQLIPPOOL and just let freeradius auth the connection and then let OpenVPN use it's predefined IP pool which we will in turn NAT?
This should be possible with a bit of unlang. post-auth { if(NAS-Port-Type != Virtual){ sqlippool } } Or something of the sort. 'man 5 unlang' for more info. -- Blake Covarrubias
Also, not wishing to drag this too much into the OpenVPN support group, but you can make OpenVPN use "p2p mode" which will allocate IP addresses from a /24 or greater, or you can assign individual IP addresses with a script. Obviously, these are things to research in the OpenVPN configuration pages. Regards, -- Jon "The Nice Guy" Spriggs On 1 November 2012 20:28, Blake Covarrubias <blake@covarrubi.as> wrote:
On Nov 1, 2012, at 1:02 PM, bearon@gmail.com wrote:
If they are coming in as a "Virtual" connection, drop out of SQLIPPOOL and just let freeradius auth the connection and then let OpenVPN use it's predefined IP pool which we will in turn NAT?
This should be possible with a bit of unlang.
post-auth { if(NAS-Port-Type != Virtual){ sqlippool } }
Or something of the sort. 'man 5 unlang' for more info.
-- Blake Covarrubias - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
bearon＠gmail.com -
Blake Covarrubias -
Jon Spriggs