freeradius with pptp
Hi everyone, I have installed freeradius(mysql module) vpn(pptp) servers. The vpn users are authenticated by username and password in radcheck table, but not specified a IP address. In my servers, there are multiple IP address. When use vpn, my computer shows a constant IP with all vpn accounts. How can i specify IP for vpn accounts? What i want is that different vpn users use different IP address. Could anyone help me? -- Best regards,
Xu Tingting wrote:
I have installed freeradius(mysql module) vpn(pptp) servers. The vpn users are authenticated by username and password in radcheck table, but not specified a IP address. In my servers, there are multiple IP address.
What does that mean?
When use vpn, my computer shows a constant IP with all vpn accounts.
What part of your computer? Be specific.
How can i specify IP for vpn accounts? What i want is that different vpn users use different IP address.
You need to explain *exactly* what you're seeing. So far, your question is too vague for me to give an answer. Alan DeKok.
Hi Alan, In my freeradius server, i setup up pptp with freeradius authentication. It works ok, i can create accounts and the vpn users login in ok. But when you connect to any vpn users, it assignes the same remote ip address and public ip . I want to specify IP for a paritcular vpn account, so different users with different public ip and remote ip, but i dont know what to do. Please help me, thanks. 2014-08-26 20:47 GMT+08:00 Alan DeKok <aland@deployingradius.com>:
Xu Tingting wrote:
I have installed freeradius(mysql module) vpn(pptp) servers. The vpn users are authenticated by username and password in radcheck table, but not specified a IP address. In my servers, there are multiple IP address.
What does that mean?
When use vpn, my computer shows a constant IP with all vpn accounts.
What part of your computer? Be specific.
How can i specify IP for vpn accounts? What i want is that different vpn users use different IP address.
You need to explain *exactly* what you're seeing. So far, your question is too vague for me to give an answer.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Best regards, 徐婷婷 Tingting Xu
Xu Tingting wrote:
In my freeradius server, i setup up pptp with freeradius authentication. It works ok, i can create accounts and the vpn users login in ok. But when you connect to any vpn users, it assignes the same remote ip address and public ip .
Well, the default configuration doesn't assign IPs. So it's something you changed locally. Find it, and fix it.
I want to specify IP for a paritcular vpn account, so different users with different public ip and remote ip, but i dont know what to do.
Run the server in debugging mode, as suggested in the FAQ, "man" page, web pages, and daily on this list. Alan DeKok.
Hi, 1.What's the difference between radgroupcheck and radgroupreply table? 2.I have set Idle-Timeout attribute to users in the radreply table, but it seems not work. how can i make it works? 3.If there are same attribute in radgroupreply and radreply, which one works? 4.I have installed freeradius(mysql moudule) with pptp vpn in different servers,they work fine,but in my vpn server( radiusclient server) , the log file shows that "pppd[3359]: rc_avpair_gen: received unknown attribute 85 of length 4: 0x0000003C". and the "radiusd -X" show nothing wrong. Does it matter? Thanks.
Xu Tingting wrote:
1.What's the difference between radgroupcheck and radgroupreply table?
http://wiki.freeradius.org/modules/Rlm_sql
2.I have set Idle-Timeout attribute to users in the radreply table, but it seems not work. how can i make it works?
Fix the NAS so that it pays attention to Idle-Timeout.
3.If there are same attribute in radgroupreply and radreply, which one works?
It depends on the operator: http://wiki.freeradius.org/config/Operators
4.I have installed freeradius(mysql moudule) with pptp vpn in different servers,they work fine,but in my vpn server( radiusclient server) , the log file shows that "pppd[3359]: rc_avpair_gen: received unknown attribute 85 of length 4: 0x0000003C". and the "radiusd -X" show nothing wrong. Does it matter?
You're sending an attribute that the client doesn't understand. It generally doesn't cause any problems. Alan DeKok.
Hi Alan, Thank you so much. when i set one client server to my radius server ,the vpn users work fine. but while there are two client servers ,the second client cant connect the radius server. radius server : client.conf -------------- client [vpn1-IP]{ secret = secret1 nastype = other } client [vpn2-IP]{ secret = secret2 nastype = other } ------------- radius.log ------------- Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Connected new DB handle, #0 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Wed Sep 17 04:07:16 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Connected new DB handle, #1 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Wed Sep 17 04:07:16 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Connected new DB handle, #2 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Wed Sep 17 04:07:16 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Connected new DB handle, #3 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Wed Sep 17 04:07:16 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Connected new DB handle, #4 Wed Sep 17 04:07:16 2014 : Info: Loaded virtual server <default> Wed Sep 17 04:07:16 2014 : Info: Loaded virtual server inner-tunnel Wed Sep 17 04:07:16 2014 : Info: ... adding new socket proxy address * port 54648 Wed Sep 17 04:07:16 2014 : Info: Ready to process requests. Wed Sep 17 04:18:23 2014 : Error: Ignoring request to authentication address * port 1812 from unknown client [IP address] port 47118 Wed Sep 17 04:18:33 2014 : Error: Ignoring request to authentication address * port 1812 from unknown client [IP address] port 47118 Wed Sep 17 04:18:43 2014 : Error: Ignoring request to authentication address * port 1812 from unknown client [IP address] port 47118 ------------- the second client server log ----------- Sep 17 04:18:19 vpn2 pppd[8096]: pppd 2.4.5 started by root, uid 0 Sep 17 04:18:19 vpn2 pppd[8096]: Using interface ppp0 Sep 17 04:18:19 vpn2 pppd[8096]: Connect: ppp0 <--> /dev/pts/1 Sep 17 04:18:53 vpn2 pppd[8096]: rc_ip_hostname: couldn't look up host by addr: %lX Sep 17 04:18:53 vpn2 pppd[8096]: rc_send_server: no reply from RADIUS server unknown:1812 Sep 17 04:18:53 vpn2 pppd[8096]: Peer vpn2test01 failed CHAP authentication Sep 17 04:18:53 vpn2 pppd[8096]: Modem hangup Sep 17 04:18:53 vpn2 pppd[8096]: Connection terminated. Sep 17 04:18:53 vpn2 pppd[8096]: Exit. ------------------ If there is only vpn1 client, the client server and radius all ok ,while two , the vpn1 still wor fine, but the vpn2 is not. Why the radius server cant make response to the vpn2 client server? Thanks.
what's more ,i found that whichever vpn user to radius server, all shows the same nasipadress, so i set different nas-ip-address in the radreply table for users in different client server, but sitll show the same nasipadrees. In my radcheck, i created vpn1user and vpn2user for different client servers, but it seems that it cant distinguish users for different clients. For example, the vpn2user with vpn1 server IP can also connect to the radius server. How can i sove this? Thanks. 2014-09-17 17:44 GMT+08:00 Xu Tingting <t.t.xu@outsideheaven.com>:
Hi Alan, Thank you so much.
when i set one client server to my radius server ,the vpn users work fine. but while there are two client servers ,the second client cant connect the radius server. radius server : client.conf -------------- client [vpn1-IP]{ secret = secret1 nastype = other } client [vpn2-IP]{ secret = secret2 nastype = other } ------------- radius.log ------------- Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Connected new DB handle, #0 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Wed Sep 17 04:07:16 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Connected new DB handle, #1 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Wed Sep 17 04:07:16 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Connected new DB handle, #2 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Wed Sep 17 04:07:16 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Connected new DB handle, #3 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Wed Sep 17 04:07:16 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Sep 17 04:07:16 2014 : Info: rlm_sql (sql): Connected new DB handle, #4 Wed Sep 17 04:07:16 2014 : Info: Loaded virtual server <default> Wed Sep 17 04:07:16 2014 : Info: Loaded virtual server inner-tunnel Wed Sep 17 04:07:16 2014 : Info: ... adding new socket proxy address * port 54648 Wed Sep 17 04:07:16 2014 : Info: Ready to process requests. Wed Sep 17 04:18:23 2014 : Error: Ignoring request to authentication address * port 1812 from unknown client [IP address] port 47118 Wed Sep 17 04:18:33 2014 : Error: Ignoring request to authentication address * port 1812 from unknown client [IP address] port 47118 Wed Sep 17 04:18:43 2014 : Error: Ignoring request to authentication address * port 1812 from unknown client [IP address] port 47118 -------------
the second client server log ----------- Sep 17 04:18:19 vpn2 pppd[8096]: pppd 2.4.5 started by root, uid 0 Sep 17 04:18:19 vpn2 pppd[8096]: Using interface ppp0 Sep 17 04:18:19 vpn2 pppd[8096]: Connect: ppp0 <--> /dev/pts/1 Sep 17 04:18:53 vpn2 pppd[8096]: rc_ip_hostname: couldn't look up host by addr: %lX Sep 17 04:18:53 vpn2 pppd[8096]: rc_send_server: no reply from RADIUS server unknown:1812 Sep 17 04:18:53 vpn2 pppd[8096]: Peer vpn2test01 failed CHAP authentication Sep 17 04:18:53 vpn2 pppd[8096]: Modem hangup Sep 17 04:18:53 vpn2 pppd[8096]: Connection terminated. Sep 17 04:18:53 vpn2 pppd[8096]: Exit. ------------------
If there is only vpn1 client, the client server and radius all ok ,while two , the vpn1 still wor fine, but the vpn2 is not. Why the radius server cant make response to the vpn2 client server?
Thanks.
-- Best regards,
Xu Tingting wrote:
what's more ,i found that whichever vpn user to radius server, all shows the same nasipadress,
Then fix the VPN server to send different NAS-IP-Addres attributes.
so i set different nas-ip-address in the radreply table for users in different client server, but sitll show the same nasipadrees.
The VPN server will ignore NAS-IP-Address in Access-Accept.
In my radcheck, i created vpn1user and vpn2user for different client servers, but it seems that it cant distinguish users for different clients. For example, the vpn2user with vpn1 server IP can also connect to the radius server.
How can i sove this?
Add a check for source *IP* address: Packet-Src-IP-Address == 1.2.3.4 Alan DeKok.
Xu Tingting wrote:
Hi Alan, Thank you so much.
when i set one client server to my radius server ,the vpn users work fine. but while there are two client servers ,the second client cant connect the radius server.
Because the client isn't listed in clients.conf.
Wed Sep 17 04:07:16 2014 : Info: Ready to process requests. Wed Sep 17 04:18:23 2014 : Error: Ignoring request to authentication address * port 1812 from unknown client [IP address] port 47118
There is no magic in the IP address. There's no need to delete it. Read the debug output. It will print out all of the client it's loading, including IP addresses. Alan DeKok.
participants (2)
-
Alan DeKok -
Xu Tingting