Hi there, I'm looking for a way to force certain users through a proxy. I *think* Framed-Routes are the way to go. Can someone help me out a little? Our users either dial in via a Patton RAS unit, or a Redback SMS-500. Any help would be appreciated. Thanks! -- Jason 'XenoPhage' Frisvold XenoPhage0@gmail.com
Jason Frisvold wrote:
Hi there,
I'm looking for a way to force certain users through a proxy. I *think* Framed-Routes are the way to go. Can someone help me out a little?
Framed-Route instructs the NAS to install a route as described by the value, to the dialed up user. (at least that what my nas's do) So in and of itself, I do not think it will accomplish any sort of forced proxying. When you say force do you mean * does not work unless they are configured to use proxy X This would generally be a function of ACL which can be configured in different ways. Using Framed-Route or Framed-IP-Address may be usefull to you for that. * transparent proxying If you combine Framed-Route and/or Framed-IP-Address with policy routing (or natting) or "vrf" tables, you will probably achieve your goal. But your use of Framed-Route may not be required at all.
Our users either dial in via a Patton RAS unit, or a Redback SMS-500.
Any help would be appreciated.
Thanks!
-- Jason 'XenoPhage' Frisvold XenoPhage0@gmail.com
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 11/8/05, Joe Maimon <jmaimon@ttec.com> wrote:
Framed-Route instructs the NAS to install a route as described by the value, to the dialed up user. (at least that what my nas's do)
So in and of itself, I do not think it will accomplish any sort of forced proxying.
Right.. the framed route itself doesnt, but you can use this to force a new default route on the user, cant you?
When you say force do you mean
* does not work unless they are configured to use proxy X
This would generally be a function of ACL which can be configured in different ways. Using Framed-Route or Framed-IP-Address may be usefull to you for that.
No, I don't care what proxy the do or do not have set up on their machine...
* transparent proxying
If you combine Framed-Route and/or Framed-IP-Address with policy routing (or natting) or "vrf" tables, you will probably achieve your goal. But your use of Framed-Route may not be required at all.
I *think* that's more what I'm looking for.. The idea is to put a user in a suspended group that will only allow them to go to the payment server. By using a proxy, I can intercept all port 80 traffic and redirect them to the proper location. Does that make more sense? -- Jason 'XenoPhage' Frisvold XenoPhage0@gmail.com
Jason Frisvold <xenophage0@gmail.com> wrote:
I *think* that's more what I'm looking for.. The idea is to put a user in a suspended group that will only allow them to go to the payment server. By using a proxy, I can intercept all port 80 traffic and redirect them to the proper location.
That's more of a NAS-specific filter rule. See your NAS documentation for how to do it. Alan DeKok.
Jason Frisvold wrote:
I *think* that's more what I'm looking for.. The idea is to put a user in a suspended group that will only allow them to go to the payment server. By using a proxy, I can intercept all port 80 traffic and redirect them to the proper location.
Does that make more sense?
Lets say you used cisco gear (where I use this concept in different ways fairly often) You would do something like this, without any loss of performance. Default Hint == "Suspended" Cisco-Avpair += "lcp:interface-config=ip vrf forwarding suspended", Cisco-Avpair += "lcp:interface-config=ip unnumbered l10", Cisco-Avpair += "ip:addr-pool=suspended" On the cisco you would config it like this, aside from the normal aaa config and whatnot ip vrf suspended rd 1:1 int l10 ip vrf forwarding suspended ip address 10.1.1.1 255.255.255.255 int fa0.10 description proxy server encapsulation dot1q 10 ip vrf forwardin suspended ip address 10.2.2.1 255.255.255.0 ip local pool suspended 10.10.0.1 10.10.10.255 ip route vrf suspended 0.0.0.0 0.0.0.0 10.2.2.1
-- Jason 'XenoPhage' Frisvold XenoPhage0@gmail.com
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Jason Frisvold -
Joe Maimon