[How to use Listen directive in inner tunnel virtual server]
Hello, We're using freeradius 2.1.6 as a proxy server. It receives authentication/accounting from Wimax NAS/ASN Gateway, (EAP/TTLS), send it to inner tunnel, and then proxy to customer home server. The server where it is located has two IP interfaces and even worse on one of the interface we're using IP aliasing :-) I've notice that freeradius always use the same IP to proxy from inner tunnel. I know that I could use the listen directive in radiusd.conf (and that's what I've done) to force freeradius to choose the correct IP to proxy. But this does not seems to work for inner-tunnel proxyfication. Do you have any ideas how I could do that ( e g use two differents sources IP to do the proxification). Thanks Thomas
Thomas Fagart wrote:
The server where it is located has two IP interfaces and even worse on one of the interface we're using IP aliasing :-)
I've notice that freeradius always use the same IP to proxy from inner tunnel.
I know that I could use the listen directive in radiusd.conf (and that's what I've done) to force freeradius to choose the correct IP to proxy.
Even better, use the latest version of the server. It supports a "src_ipaddr" for each home server. This forces the server to open a socket using a particular address.
But this does not seems to work for inner-tunnel proxyfication.
That might be true for 2.1.6. For later versions, probably not. Alan DeKok.
Thomas Fagart wrote:
The server where it is located has two IP interfaces and even worse on one of the interface we're using IP aliasing :-)
I've notice that freeradius always use the same IP to proxy from inner tunnel.
I know that I could use the listen directive in radiusd.conf (and that's what I've done) to force freeradius to choose the correct IP to proxy. Even better, use the latest version of the server. It supports a "src_ipaddr" for each home server. This forces the server to open a socket using a particular address.
That looks great, but 2.1.10 is not working properly on my environment (you've corrected something in git commit 5849d7aa69) Then I would wait for 2.1.11, or do you thing it's ok to use git "release" in Production branch.
But this does not seems to work for inner-tunnel proxyfication. That might be true for 2.1.6. For later versions, probably not.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I've tried 2.1.x. (2.1.11) Seems to work well but after an hour of working I've got the following Apr 10 22:20:50 vma-prdaut-08 radiusd[65766]: Exiting due to internal error: Failed in select: Invalid argument Apr 10 22:20:50 vma-prdaut-08 radiusd[65766]: Exiting due to internal error: Failed in select: Invalid argument Apr 10 22:20:50 vma-prdaut-08 radiusd[65766]: rlm_sql (sql): Closing sqlsocket 4 Apr 10 22:20:50 vma-prdaut-08 radiusd[65766]: rlm_sql (sql): Closing sqlsocket 3 Apr 10 22:20:50 vma-prdaut-08 radiusd[65766]: rlm_sql (sql): Closing sqlsocket 2 Apr 10 22:20:50 vma-prdaut-08 radiusd[65766]: rlm_sql (sql): Closing sqlsocket 1 Apr 10 22:20:50 vma-prdaut-08 radiusd[65766]: rlm_sql (sql): Closing sqlsocket 0 Seems to be linked to mysql ?, after that radiusd died. I'll try to provide output from radiusd -X in developper mode. Thomas On 10/04/2011 09:20, Alan DeKok wrote:
Thomas Fagart wrote:
Then I would wait for 2.1.11, or do you thing it's ok to use git "release" in Production Yes. Use the v2.1.x branch from git. It's fine.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thomas Fagart wrote:
I've tried 2.1.x. (2.1.11)
Seems to work well but after an hour of working
I've got the following
Apr 10 22:20:50 vma-prdaut-08 radiusd[65766]: Exiting due to internal error: Failed in select: Invalid argument Apr 10 22:20:50 vma-prdaut-08 radiusd[65766]: Exiting due to internal error: Failed in select: Invalid argument
My guess is you're running FreeBSD, and possibly in a VM? The issue seems to be that the system time goes up and down... FreeRADIUS expects time to increase, and when it doesn't, it passes a negative "wait time" to the select() function. This isn't nice, so select() complains. The fix is to double-check the times, and limit them at some reasonable value. Alan DeKok.
participants (2)
-
Alan DeKok -
Thomas Fagart