Hello. First time using this list :) Need to know if it is possible and then I will appreciate some tips/howto guides. Summary: How to configure (if it is possible) raspberry pi as freeradius server with dhcp (conditional IP range based on username) Scenario: In my shared farm we have 5 houses accessing internet through 5x LTE/4g antennas (each house has its own mobile plan and antenna, but they share local network infrastructure to access the antennas). Network: all devices are in the same LAN: 10.0.0.0 mask:255.255.240.0 Each house has its own access point House1AP - IP 10.0.2.1 - offering IPs:10.0.2.2-10.0.2.100 Gateway: 10.0.0.2 House2AP - IP 10.0.4.1 - offering IPs:10.0.4.2-10.0.4.100 Gateway: 10.0.0.4 House3AP - IP 10.0.6.1 - offering IPs:10.0.6.2-10.0.6.100 Gateway: 10.0.0.6 House4AP - IP 10.0.8.1 - offering IPs:10.0.8.2-10.0.8.100 Gateway: 10.0.0.8 House5AP - IP 10.0.10.1 - offering IPs:10.0.10.2-10.0.10.100 Gateway: 10.0.0.10 All access points are wired connected to a managed switch (IP: 10.0.1.2) This switch is connected through a fiber channel to another switch (10.0.1.1) that is wired connected to all LTE/4g routers/gateways. Raspberry pi (IP 10.0.1.4) is wired connect to the managed switch. Until now every house has its own unique ssid (wpa2 personal) and devices from one house cant access APs from other houses. I'm wondering if it is possible to change all APs to use wpa2 enterprise in a way that freeradius (based on the username -not the mac address ) set IP range and gateway that user belong. For example, if I belong to house1 (using gateway 10.0.0.2) when I go to visit house2 the House2AP should recognize me as house1 and send me the same gateway as house1. Thanks in advance Ulisses
On Oct 21, 2020, at 5:41 PM, Ulisses Buonanni <ulisses.b@gmail.com> wrote:
Need to know if it is possible and then I will appreciate some tips/howto guides.
Yes, it's possible, with some caveats. Your clear and descriptive message allows for a clear and descriptive response. Instead of the usual "please run in debug mode" complaint. In short, you don't solve this via routing. It might be possible, but it's likely going to be a pain. The best approach is to use VLANs. You can create one VLAN per network segment. Then use one SSID. And when a user connects, assign him to the correct VLAN. Then because the users are on different network segments, routing automatically works. Each VLAN has it's own set of IPs, default gateway, etc. That avoids the issue of making DHCP depend on a RADIUS user name. It also means that things like printers are site-local, and don't affect other sites. The downside is that if someone visits a different site, they won't be able to use the local printer. But that may be a good thing, because they also can't see _any_ devices on that network.
I'm wondering if it is possible to change all APs to use wpa2 enterprise in a way that freeradius (based on the username -not the mac address ) set IP range and gateway that user belong.
Just use VLANs. Then you can statically assign IPs, ranges, and gateways to each device. If you use routing, you'd have to find some way to assign IPs from range "A" at house "B", and then somehow (?) route a guest users packets from "B" to "A", and back again. It's difficult, and prone to failures. An alternative is to just have guest networks at each location. e.g. each location has a "10.0.12/24" network, which can get to the internet, but nothing else. Anyone who isn't from the local site gets assigned an IP from the guest range. That means guests can't reach their "home" network. But if they're visiting somewhere else, I suspect that accessing devices on the "home" network isn't that useful to them. It all depends on what you want to do. If you want to separate "guest" and "home" traffic, a "guest" network works. If you want each users *public* traffic to go through their own LTE/4g antenna, then VLANs are the best solution. Alan DeKok.
Thanks for your response :)
The best approach is to use VLANs. You can create one VLAN per network segment. Then use one SSID. And when a user connects, assign him to the correct VLAN. The downside is that if someone visits a different site, they won't be able to use the local printer. But that may be a good thing, because they also can't see _any_ devices on that network.
I have tested VLANs, but I need to share local resources between houses (printer and storage, for example). This is why everyone is in the same subnet. By my tests/research I just can achieve this buying a new device that has routing ip policy (so I could still have intervlan routing using interfacevlan and the default static routing set to this new device could route packages properly (but I'm trying not to spend extra $$$ with a new router).
If you want each users *public* traffic to go through their own LTE/4g antenna, then VLANs are the best solution.
Yep, this is my main goal: allow roaming wifi between houses but respecting the LTE/4g antenna each person's belong. This is why I thought that setting up pihole as freeradius+dhcpserver could let me send IPs+Gateways based on the specific house login. I would just have 5 shared users: house1, house2, house3, house4, house5 Everytime some device using house1 login try to reach one AP the freeradius+dhcpserver was going to return a valid ip from their IPpoll Ulisses
UB> Thanks for your response :)
The best approach is to use VLANs. You can create one VLAN per network segment. Then use one SSID. And when a user connects, assign him to the correct VLAN. The downside is that if someone visits a different site, they won't be able to use the local printer. But that may be a good thing, because they also can't see _any_ devices on that network.
UB> I have tested VLANs, but I need to share local resources between UB> houses (printer and storage, for example). This is why everyone is UB> in the same subnet. By my tests/research I just can achieve this UB> buying a new device that has routing ip policy (so I could still UB> have intervlan routing using interfacevlan and the default static UB> routing set to this new device could route packages properly (but UB> I'm trying not to spend extra $$$ with a new router). You know Dell Powerconnect 6248 switches (48 port GBE) which will do L3 routing are <$100 on ebay, right. (I think the last one I bought was ~$50) 6248-PoE's are like <$125. Seems like a pretty cheap way to "git er done," if it can solve your problem.
If you want each users *public* traffic to go through their own LTE/4g antenna, then VLANs are the best solution.
UB> Yep, this is my main goal: allow roaming wifi between houses but UB> respecting the LTE/4g antenna each person's belong. UB> This is why I thought that setting up pihole as UB> freeradius+dhcpserver could let me send IPs+Gateways based on the specific house login. UB> I would just have 5 shared users: house1, house2, house3, house4, house5 UB> Everytime some device using house1 login try to reach one AP the UB> freeradius+dhcpserver was going to return a valid ip from their IPpoll
You know Dell Powerconnect 6248 switches (48 port GBE) which will do L3 routing are <$100 on ebay, right. (I think the last one I bought was ~$50) Seems like a pretty cheap way to "git er done," if it can solve your problem.
Thanks for the tip Gregory. It is a good option to solve the problem without some gimmick. This switch has routing ip policy. Unfortunally I'm from a farm in Brazil and it is very expensive here (even a used one). I'm going to set a price search for it. Maybe someday I'll find a bargain opportunity. Ulisses
Hi sorry to chime in Firstly I don't think this is a radius issue. Am 22.10.2020 um 22:12 schrieb Ulisses Buonanni:
You know Dell Powerconnect 6248 switches (48 port GBE) which will do L3 routing are <$100 on ebay, right. (I think the last one I bought was ~$50) Seems like a pretty cheap way to "git er done," if it can solve your problem.
With some decent routing and firewall settings between the subnets, VLAN or physical, you should be able to achieve your goals. DHCP can be central and service multiple subnets using a DHCP proxy on each subnet and you can pass more than just the simple net parameters this way. I did set up such a net a number of years back for a net hosting roughly 500 IP addresses, split up in about 12 class C subnets. Given, I did not need to use individual gateways but it is possible to assign them using DHCP, actually option 003. cheers ET
Ulisses
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Diese E-Mail wurde von AVG auf Viren geprüft. http://www.avg.com
On Oct 22, 2020, at 5:07 PM, Erich Titl <erich.titl@think.ch> wrote:
Hi
sorry to chime in
Firstly I don't think this is a radius issue.
FreeRADIUS implements multiple network protocols, DHCPv4 amongst them. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Oct 22, 2020, at 1:15 PM, Ulisses Buonanni <ulisses.b@gmail.com> wrote:
The best approach is to use VLANs. You can create one VLAN per network segment. Then use one SSID. And when a user connects, assign him to the correct VLAN. The downside is that if someone visits a different site, they won't be able to use the local printer. But that may be a good thing, because they also can't see _any_ devices on that network.
I have tested VLANs, but I need to share local resources between houses (printer and storage, for example). This is why everyone is in the same subnet.
But if the different houses have different subnets... they're not on the same subnet. They might all be in the same "10" network. But they have different gateways, and different subnets. So you might have competing sets of requirements. Printers, etc. need to be in the same broadcast domain. You don't want printers in one house visible from another house. But each user should have their *public* traffic go out their home network. It might not be possible to do everything you want.
Yep, this is my main goal: allow roaming wifi between houses but respecting the LTE/4g antenna each person's belong. This is why I thought that setting up pihole as freeradius+dhcpserver could let me send IPs+Gateways based on the specific house login. I would just have 5 shared users: house1, house2, house3, house4, house5 Everytime some device using house1 login try to reach one AP the freeradius+dhcpserver was going to return a valid ip from their IPpoll
Then they can't see printers in the "visited" network. Alan DeKok.
But if the different houses have different subnets... they're not on the same subnet. They might all be in the same "10" network. But they have different gateways, and different subnets.
I think I explained myself poorly. All houses are in the same broadcast domain: 10.0.0.0 mask 255.255.240.0 Every house has a subset (not subnet) of this range of ips. Just because of the simplicity in using ACL rules So house1 is only allowed to assign ips from 10.0.2.1 to 10.0.2.200 but it is using mask 255.255.240.0 In this example a person from house 1 cannot use a static ip address outside this range because there is a ACL rule saying that specific port can only has a sender from "10.0.2.x" But it is allowed (and common) to a person in house1 to find a printer/sharedfolder in house2 and use it. This is very easy as they are in the same broadcast domain (they are just using different gateways to Internet access)
You don't want printers in one house visible from another house.
In my scenario it is necessary that printers from different houses can be seeing and used from other houses Ulisses
On Oct 22, 2020, at 4:33 PM, Ulisses Buonanni <ulisses.b@gmail.com> wrote:
I think I explained myself poorly. All houses are in the same broadcast domain: 10.0.0.0 mask 255.255.240.0
Ah, that helps.
Every house has a subset (not subnet) of this range of ips. Just because of the simplicity in using ACL rules
Sure.
So house1 is only allowed to assign ips from 10.0.2.1 to 10.0.2.200 but it is using mask 255.255.240.0 In this example a person from house 1 cannot use a static ip address outside this range because there is a ACL rule saying that specific port can only has a sender from "10.0.2.x"
But it is allowed (and common) to a person in house1 to find a printer/sharedfolder in house2 and use it. This is very easy as they are in the same broadcast domain (they are just using different gateways to Internet access)
OK. That makes sense.
In my scenario it is necessary that printers from different houses can be seeing and used from other houses
OK. It's possible to have multiple gateways on one network. It's a little weird, but it's OK. I think in the end it's not too difficult. Just get each user to do 802.1X. Then assign IPs through DHCP. The only magic is the following: * use SQL to track IPs in DHCP. * when assigning IPs through DHCP, check if the MAC / IP already exists in DHCP. If so, use that IP. And then assign default gateway based on the IP * otherwise, assign the IP based on a pool per "home" network. i.e. Choose a pool based on the local router / AP IP address. That gets you 99% of what you want, with minimal work. The simplest thing is to grab v3.0.x from GitHub, as it's separated out the queries. Use one query for "alloc_existing" which doesn't use the gateway to find IPs. And use a different query for "allocate_find" which does use the gateway to find IPs. I hope that makes sense. It's a very unusual setup. But interesting. :) Alan DeKok.
participants (5)
-
Alan DeKok -
Arran Cudbard-Bell -
Erich Titl -
Gregory Sloop -
Ulisses Buonanni