default gateway per user basis
Hello. I am new to this list and also to freeradius server. Can someone please help me? I have a pppoe server on freebsd. I want to setup freeradius to give different ip address block and gateway to users. I need two pools, and i have a two gateways. One gateway is more expensive than the otherone. So, users that pay less will use chiper gateway and vice versa. Is this possible? 10x in advance.
Hi all, I have the following setup: WiFi AP(10.0.0.10)-------------------(10.0.0.1)RADIUS 1--------------RADIUS 2 (public ip address) I want to proxy requests from RADIUS1 to RADIUS2 in a WPA enviroment. I've setup all the stuff and I can see that requests are proxied. If I try to authenticate with an invalid username, I can see how RADIUS1 proxies the request, RADIUS2 denies with "Login incorrect", so everything seems to work as expected. The problem is when I try to authenticate a valid user. I can see the request beeing proxied and a Access-Challenge packet beeing received, but the process stalls. Any help? -------------------------------------------------------------------------------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 10.0.0.10:2057, id=0, length=125 User-Name = "raul@8" NAS-IP-Address = 10.0.0.10 Called-Station-Id = "0014bf3c3c9f" Calling-Station-Id = "000e354b8190" NAS-Identifier = "0014bf3c3c9f" NAS-Port = 26 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0208000b017261756c4038 Message-Authenticator = 0x5010ed19e8f495cd797e557f31e46c5d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 13 modcall[authorize]: module "preprocess" returns ok for request 13 rlm_realm: Looking up realm "8" for User-Name = "raul@8" rlm_realm: Found realm "8" rlm_realm: Proxying request from user raul to realm 8 rlm_realm: Adding Realm = "8" rlm_realm: Preparing to proxy authentication request to realm "8" modcall[authorize]: module "suffix" returns updated for request 13 modcall[authorize]: module "chap" returns noop for request 13 modcall[authorize]: module "mschap" returns noop for request 13 modcall: group authorize returns updated for request 13 Sending Access-Request of id 13 to xxx.yyy.zzz.www:1812 User-Name = "raul@8" NAS-IP-Address = 10.0.0.10 Called-Station-Id = "0014bf3c3c9f" Calling-Station-Id = "000e354b8190" NAS-Identifier = "0014bf3c3c9f" NAS-Port = 26 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0208000b017261756c4038 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 --- Walking the entire request list --- Waking up in 7 seconds... rad_recv: Access-Challenge packet from host xxx.yyy.zzz.www:1812, id=13, length=102 Acct-Interim-Interval = 120 WISPr-Redirection-URL = "http://www.google.com" EAP-Message = 0x010900061920 Message-Authenticator = 0xf7471c7d0b32705947085a4651d5a38e State = 0x536aab58a9bc0788890bfc27547e1f64 Proxy-State = 0x30 Sending Access-Challenge of id 0 to 10.0.0.10:2057 Acct-Interim-Interval = 120 WISPr-Redirection-URL = "http://www.google.com" EAP-Message = 0x010900061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x536aab58a9bc0788890bfc27547e1f64 Finished request 13 Going to the next request Waking up in 7 seconds... -------------------------------------------------------------------------------------------------------------------------------------------------------- Thanks in advance!
=?ISO-8859-1?Q?Joseba_Beltr=E1n?= <joseba.beltran@gmail.com> wrote:
The problem is when I try to authenticate a valid user. I can see the request beeing proxied and a Access-Challenge packet beeing received, but the process stalls.
The supplicant is ignoring the response from the server. Find out why that's happening. Alan DeKok.
Really strange, because if I setup the ap to talk directly with the end freeradius server it works ok ¿?
The problem is when I try to authenticate a valid user. I can see the request beeing proxied and a Access-Challenge packet beeing received, but the process stalls.
The supplicant is ignoring the response from the server. Find out why that's happening.
=?ISO-8859-1?Q?Joseba_Beltr=E1n?= <joseba.beltran@gmail.com> wrote:
Really strange, because if I setup the ap to talk directly with the end freeradius server it works ok ¿?
Then look at the packets via tcpdump. For some reason the AP or the supplicant is ignoring the response from the server. Alan DeKok.
"Igor Smitran" <igor@poen.net> wrote:
I have a pppoe server on freebsd. I want to setup freeradius to give different ip address block and gateway to users. I need two pools, and i have a two gateways. One gateway is more expensive than the otherone. So, users that pay less will use chiper gateway and vice versa. Is this possible?
Yes. Alan DeKok.
"Igor Smitran" <igor@poen.net> wrote:
I have a pppoe server on freebsd. I want to setup freeradius to give different ip address block and gateway to users. I need two pools, and i have a two gateways. One gateway is more expensive than the otherone. So, users that pay less will use chiper gateway and vice versa. Is this possible?
Yes.
Alan DeKok.
Can you tell me how? :lol: Igor
"Igor Smitran" <igor@poen.net> wrote:
Can you tell me how? :lol:
Look at the packets coming from the two gateways, and see how they're different. Use those differences to write rules that match those differences, and return the different configurations. *You* have access to that data. No one else does. So no one else can give any more detailes response than that. Alan DeKok.
Alan Dekok wrote:
Look at the packets coming from the two gateways, and see how they're different. Use those differences to write rules that match those differences, and return the different configurations.
Ok, let us say that we have two users: Alan and Igor 1. when Igor logs in he needs to get IP address 192.168.1.10/24 and gateway 192.168.1.100 2. when Alan logs in he needs to get IP address 192.168.2.10/24 and gateway 192.168.2.100 different IP ranges, different C classes and different gateways accordingly. I am not sure what do i have to listen from those gateways. Computer with pppoe server and freeradius has connection to both C classes. I just want to route users differently. One user to more expensive link, one user to less expensive link. Help please?
"Igor Smitran" <igor@poen.net> wrote:
1. when Igor logs in he needs to get IP address 192.168.1.10/24 and gateway 192.168.1.100
2. when Alan logs in he needs to get IP address 192.168.2.10/24 and gateway 192.168.2.100
Read the NAS documentation to see which RADIUS attributes it expects to see, in order to configure that. Sorry if this sounds unhelpful, but configuring anything on FreeRADIUS is useless unless you know the NAS understands it. Once you know what the NAS understands, it's trivial to see how to configure FreeRADIUS. Alan DeKok.
participants (3)
-
Alan DeKok -
Igor Smitran -
Joseba Beltrán