I have been trying to get this to work for a few days now with no success. I have set up poptop (PPTP) and it uses the /etc/ppp/options.pptp file which has a plugin for radius. plugin radius.so Radius will authenticate with my users fine, but I can't seem to get the Framed-Route option to do anything. I am trying to set a route for a mask and not just the single IP to device ppp connection. Does ppp just ignore the route and this option just doesn't work with ppp or pptp? Is there a workaround? Thank you, Arthur I am also using a SQL connection so the information will be left in that format. radius=# select * from radgroupcheck; id | groupname | attribute | op | value ----+-----------+-----------+----+--------- 1 | static | Auth-Type | := | MS-CHAP radius=# select * from radgroupreply; id | groupname | attribute | op | value ----+-----------+--------------------+----+--------------------- 1 | static | Framed-Protocol | := | PPP 2 | static | Service-Type | := | Framed-user 3 | static | Framed-Compression | := | Van-Jacobsen-TCP-IP id | username | attribute | op | value ----+----------+-------------------+----+----------------------- 1 | arthur | Framed-IP-Address | := | 10.0.0.4 3 | arthur | Framed-Routing | := | None 2 | arthur | Framed-IP-Netmask | := | 255.255.255.0 4 | arthur | Framed-Route | := | 10.0.0.0/24 0.0.0.0 1 The options file contains: plugin radius.so lock mtu 1490 mru 1490 multilink #proxyarp auth ipcp-accept-remote lcp-echo-failure 30 lcp-echo-interval 5 deflate 0 +mschap-v2 mppe required nopcomp noaccomp pptpd.conf localip 191.168.4.1 ----------------------------- VERSIONS OF THINGS pptpd-1.2.3 pppd version 2.4.3 FreeRadius 1.05 RADIUS output snippet Framed-IP-Address := 10.0.0.4 Framed-IP-Netmask := 255.255.255.0 Framed-Routing := None Framed-Route := "10.0.0.0/24 0.0.0.0 1" Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP MS-CHAP2-Success = ***** MS-MPPE-Recv-Key = ***** MS-MPPE-Send-Key = ***** MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 rad_recv: Accounting-Request packet from host 127.0.0.1:32798, id=114, length=112 Acct-Session-Id = "439E72E33A2C00" User-Name = "arthur" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "**.**.**.**" Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 10.0.0.4 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 Routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.0.4 * 255.255.255.255 UH 0 0 0 ppp0 192.168.3.0 * 255.255.255.0 U 0 0 0 eth2 192.168.2.0 * 255.255.255.0 U 0 0 0 eth0 192.168.1.0 * 255.255.255.0 U 0 0 0 eth1 loopback * 255.0.0.0 U 0 0 0 lo default 192.168.2.1 0.0.0.0 UG 0 0 0 eth0
Arthur Sigel wrote:
I have been trying to get this to work for a few days now with no success. I have set up poptop (PPTP) and it uses the /etc/ppp/options.pptp file which has a plugin for radius. plugin radius.so
This isn't a FreeRadius question, so it would be better to ask on the pppd mailing list, but that said:
Radius will authenticate with my users fine, but I can’t seem to get the Framed-Route option to do anything.
I am trying to set a route for a mask and not just the single IP to device ppp connection.
Does ppp just ignore the route and this option just doesn’t work with ppp or pptp? Is there a workaround?
Yes, ppp ignores this option. You would have to patch pppd to do what you want directly. However, there is also a "radattr" plugin, which puts the AVPs in /var/run/radattr.pppN in the following format: Framed-Route 10.0.0.0/24 0.0.0.0 1 ...so you could use the "ip-up" script to do this: #!/bin/sh # ip-up script knows about framed-route IFNAME=$1 PEERIP=$5 AVP_PATH=/var/run/radattr egrep -i '^Framed-Route ' $AVP_PATH.$IFNAME | while read attr val1 valN do route add -net $val1 gw $PEERIP done ...or something similar. You just need to have: plugin radius.so plugin radattr.so ...in your options file. Hope that helps.
Thank you very much. I will make one alteration for any future viewers. ip-up requires the full path of any executables. So, route should be /sbin/route or the path to route. Thank you even though it is clearly a pppd issue as I understand now. Arthur -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Tuesday, December 13, 2005 2:10 PM To: FreeRadius users mailing list Subject: Re: Framed-Route ignored Arthur wrote:
I have been trying to get this to work for a few days now with no success. I have set up poptop (PPTP) and it uses the /etc/ppp/options.pptp file which has a plugin for radius. plugin radius.so
This isn't a FreeRadius question, so it would be better to ask on the pppd mailing list, but that said:
Radius will authenticate with my users fine, but I can't seem to get the Framed-Route option to do anything.
I am trying to set a route for a mask and not just the single IP to device ppp connection.
Does ppp just ignore the route and this option just doesn't work with ppp or pptp? Is there a workaround?
Yes, ppp ignores this option. You would have to patch pppd to do what you want directly. However, there is also a "radattr" plugin, which puts the AVPs in /var/run/radattr.pppN in the following format: Framed-Route 10.0.0.0/24 0.0.0.0 1 ...so you could use the "ip-up" script to do this: #!/bin/sh # ip-up script knows about framed-route IFNAME=$1 PEERIP=$5 AVP_PATH=/var/run/radattr egrep -i '^Framed-Route ' $AVP_PATH.$IFNAME | while read attr val1 valN do route add -net $val1 gw $PEERIP done ...or something similar. You just need to have: plugin radius.so plugin radattr.so ...in your options file. Hope that helps. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Arthur Sigel -
Phil Mayers