Freeradius not receiving packets
I have disabled iptables: [3:26 PM, 4/18/2019] Abed Abd Elhai: iptables --list Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination And also the firewalld service firewalld status Redirecting to /bin/systemctl status firewalld.service ● firewalld.service Loaded: masked (/dev/null; bad) Active: inactive (dead) I don’t have access to the vcenter, is there anything that I can check within the server? When the server receives a accounting message I see it in tcpdump and also in radsniff but not in the radiusd -X terminal. However when I run a test with radtest or radwho I do see the message in the radiusd terminal. BR Liran can you show the networking that you have done for making the vm network reachable to outside network ? On Thu, Apr 18, 2019 at 5:23 PM Matthew Newton <mcn at freeradius.org <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote:
On Thu, 2019-04-18 at 14:47 +0300, liran kessel wrote:
I am thinking it might be something to do with the fact that this is a VM and maybe packets aren’t forwarded from the Kernel to the socket that the Freeradius has opened.
VMs work in the same way as "real" machines.
However I wanted to ask if radsniff listens like tcpdump or to the actual socket?
Like tcpdump
If it is listening to the socket than I guess I have a problem in the server configuration rather than the Kernel.
iptables?
-- Matthew
- List info/subscribe/unsubscribe? See
On Apr 24, 2019, at 8:06 AM, liran kessel <lirankessel@gmail.com> wrote:
I don’t have access to the vcenter, is there anything that I can check within the server? When the server receives a accounting message I see it in tcpdump and also in radsniff but not in the radiusd -X terminal.
Then it's likely selinux. If the packets are getting to the VM but not to the application, then then problem is the kernel. It's blocking the packets.
However when I run a test with radtest or radwho I do see the message in the radiusd terminal.
What addresses are you using? If you're using localhost, then that's a different address (and different test) than using the public IP. Alan DeKok.
The selinux is also disabled [root@xxxxxx]# sestatus SELinux status: disabled The server is listening on all ips: [root@xxxxxx]# netstat -an | grep 1813 udp 0 0 0.0.0.0:1813 0.0.0.0:* udp6 0 0 :::1813 :::* When I test with radtest I am sending to the destination ip adress radwho -ZRN 10.140.101.250 |radclient -f - 10.140.101.250 acct testing123
On 24 Apr 2019, at 15:17, Alan DeKok <aland@deployingradius.com> wrote:
On Apr 24, 2019, at 8:06 AM, liran kessel <lirankessel@gmail.com> wrote:
I don’t have access to the vcenter, is there anything that I can check within the server? When the server receives a accounting message I see it in tcpdump and also in radsniff but not in the radiusd -X terminal.
Then it's likely selinux. If the packets are getting to the VM but not to the application, then then problem is the kernel. It's blocking the packets.
However when I run a test with radtest or radwho I do see the message in the radiusd terminal.
What addresses are you using? If you're using localhost, then that's a different address (and different test) than using the public IP.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Apr 24, 2019, at 8:28 AM, liran kessel <lirankessel@gmail.com> wrote:
The selinux is also disabled [root@xxxxxx]# sestatus SELinux status: disabled
The server is listening on all ips:
[root@xxxxxx]# netstat -an | grep 1813 udp 0 0 0.0.0.0:1813 0.0.0.0:* udp6 0 0 :::1813 :::*
When I test with radtest I am sending to the destination ip adress
radwho -ZRN 10.140.101.250 |radclient -f - 10.140.101.250 acct testing123
Well, it's not a FreeRADIUS problem. FreeRADIUS asks the OS for packets. If the OS never sends packets to FreeRADIUS, then the problem is the OS. Alan DeKok.
participants (2)
-
Alan DeKok -
liran kessel