Hi Need some design advice here please. I have two FR 3.0.3 servers and a 3-node Galera cluster for HA. I’m seeing issues with Deadlocks when under stress - mostly if there is a storm of reconnects. I’m running HAProxy on the FR nodes but there are a couple of things I don’t quite understand: 1. Should I run the ’Skip Locked’ on FreeRadius or not? Some documentation says that I shouldn’t as MariaDB doesn’t support it, but other say newer versions do support it 1. What is the optimal way of configuring HAProxy? 1. How do I separate out writes from reads - I have two sites, each with one FR server and one Galera node. There is a high-speed network between the two, but ideally, I want to keep cross-site traffic to a minimum. (I have another IP allocation question which I’ll ask in another three). Thank you David David Lake Visiting Professor 5G Innovation Centre (5GIC and 6GIC) Tel: +44 (0)7711 736784 Email: d.lake@surrey.ac.uk<mailto:%20d.lake@surrey.ac.uk> Web: surrey.ac.uk<http://www.surrey.ac.uk/?utm_medium=internal&utm_source=emailsignature&utm_campaign=reputation+50th+brand> [A blue text on a black background Description automatically generated]<http://www.surrey.ac.uk/?utm_source=emailsignature&utm_medium=internal&utm_campaign=emailsignature_1819&utm_content=emailsignature_homepage> James Clerk Maxwell Building, University of Surrey, Guildford, Surrey, GU2 7XH, UK
On 17/09/2026 12:43, David Lake via Freeradius-Users wrote:
I have two FR 3.0.3 servers and a 3-node Galera cluster for HA. ... 1. Should I run the ’Skip Locked’ on FreeRadius or not? Some documentation says that I shouldn’t as MariaDB doesn’t support it, but other say newer versions do support it
Unsure on the database side, but it sounds like your whole system needs an upgrade. Then new features will become available to you.
1. What is the optimal way of configuring HAProxy?
For what? In front of FreeRADIUS? In front of the database? Maybe ask the HAproxy people.
1. How do I separate out writes from reads - I have two sites, each with one FR server and one Galera node. There is a high-speed network between the two, but ideally, I want to keep cross-site traffic to a minimum.
For this sort of thing you'd normally use a "redundant" type section (see instantiate in radiusd.conf) with two sql module instances, one that you point to the database server you use for RW, and the other pointing to the DB server for RO. e.g. from the example in radiusd.conf, maybe something like redundant redundant_sql { sql_local sql_remote } then call 'redundant_sql' instead of 'sql'. sql_local/remote would of course be the other way around at the other site. If 'sql_local' is unavailable, FR will fall back to using 'sql_remote'. Or, alternatively, define them as 'sql_ro' and 'sql_rw' and call each one as appropriate if you want to just read, or write. I seem to remember there may have been some bugs fixed with this in the last couple of versions or so; another reason to upgrade before trying it. -- Matthew
Thanks. In terms of HAProxy, I have this running between the FreeRadius servers and the Galera cluster. I’ve seen some recommendations that I direct all write to one node and then allow read from all so I will ask HAProxy. Noted on the upgrade - work now in progress. Thanks David From: Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> Date: Thursday, 17 September 2026 at 13:23 To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Cc: Matthew Newton <mcn@freeradius.org> Subject: Re: FreeRadius 3.0.3 and Galera Cluster On 17/09/2026 12:43, David Lake via Freeradius-Users wrote:
I have two FR 3.0.3 servers and a 3-node Galera cluster for HA. ... 1. Should I run the ’Skip Locked’ on FreeRadius or not? Some documentation says that I shouldn’t as MariaDB doesn’t support it, but other say newer versions do support it
Unsure on the database side, but it sounds like your whole system needs an upgrade. Then new features will become available to you.
1. What is the optimal way of configuring HAProxy?
For what? In front of FreeRADIUS? In front of the database? Maybe ask the HAproxy people.
1. How do I separate out writes from reads - I have two sites, each with one FR server and one Galera node. There is a high-speed network between the two, but ideally, I want to keep cross-site traffic to a minimum.
For this sort of thing you'd normally use a "redundant" type section (see instantiate in radiusd.conf) with two sql module instances, one that you point to the database server you use for RW, and the other pointing to the DB server for RO. e.g. from the example in radiusd.conf, maybe something like redundant redundant_sql { sql_local sql_remote } then call 'redundant_sql' instead of 'sql'. sql_local/remote would of course be the other way around at the other site. If 'sql_local' is unavailable, FR will fall back to using 'sql_remote'. Or, alternatively, define them as 'sql_ro' and 'sql_rw' and call each one as appropriate if you want to just read, or write. I seem to remember there may have been some bugs fixed with this in the last couple of versions or so; another reason to upgrade before trying it. -- Matthew - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Cd.lake%40surrey.ac.uk%7Ccbc286cb549f48a5695508df14b669b6%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C0%7C639252445900941934%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=LowXtU6J6CYwx0k6e0uSfYGt4Yfu6vcZSXDk%2B7tQrH4%3D&reserved=0<http://www.freeradius.org/list/users.html>
On 9/17/26 11:52 AM, David Lake via Freeradius-Users wrote:
Thanks.
In terms of HAProxy, I have this running between the FreeRadius servers and the Galera cluster.
I’ve seen some recommendations that I direct all write to one node and then allow read from all so I will ask HAProxy.
Noted on the upgrade - work now in progress.
Thanks
David
From: Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> Date: Thursday, 17 September 2026 at 13:23 To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Cc: Matthew Newton <mcn@freeradius.org> Subject: Re: FreeRadius 3.0.3 and Galera Cluster
On 17/09/2026 12:43, David Lake via Freeradius-Users wrote:
I have two FR 3.0.3 servers and a 3-node Galera cluster for HA. ... 1. Should I run the ’Skip Locked’ on FreeRadius or not? Some documentation says that I shouldn’t as MariaDB doesn’t support it, but other say newer versions do support it Unsure on the database side, but it sounds like your whole system needs an upgrade. Then new features will become available to you.
1. What is the optimal way of configuring HAProxy?
For what? In front of FreeRADIUS? In front of the database? Maybe ask the HAproxy people.
1. How do I separate out writes from reads - I have two sites, each with one FR server and one Galera node. There is a high-speed network between the two, but ideally, I want to keep cross-site traffic to a minimum.
For this sort of thing you'd normally use a "redundant" type section (see instantiate in radiusd.conf) with two sql module instances, one that you point to the database server you use for RW, and the other pointing to the DB server for RO.
e.g. from the example in radiusd.conf, maybe something like
redundant redundant_sql { sql_local sql_remote }
then call 'redundant_sql' instead of 'sql'. sql_local/remote would of course be the other way around at the other site. If 'sql_local' is unavailable, FR will fall back to using 'sql_remote'.
Or, alternatively, define them as 'sql_ro' and 'sql_rw' and call each one as appropriate if you want to just read, or write.
I seem to remember there may have been some bugs fixed with this in the last couple of versions or so; another reason to upgrade before trying it.
-- Matthew
- List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Cd.lake%40surrey.ac.uk%7Ccbc286cb549f48a5695508df14b669b6%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C0%7C639252445900941934%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=LowXtU6J6CYwx0k6e0uSfYGt4Yfu6vcZSXDk%2B7tQrH4%3D&reserved=0<http://www.freeradius.org/list/users.html> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
i'll keep this brief, in case this belongs being taken off-list... i use HA Proxy in front of MariaDB, with all 3 nodes taking reads and writes. i do this because my machines are relatively low powered, and i want the most performance from the cluster. by using all nodes in read/write mode, i can distribute all workloads across all instances. YMMV. my HA Proxy config, as it pertains to MariaDB is below. i do use proxy-protocol so that the instances see the original client IP, and i can base my ACLs off the client IP, not the HA Proxy VIP/shared IP. in my load-sharing-over-Anycast instances of FreeRADIUS, i point to the HA Proxy VIP for any DB pieces and dont have to worry about the redundant configs in FreeRADIUS. because the infrastructure surrounding MariaDB handles HA, fault tolerance and failover, FreeRADIUS configs are simplified. frontend mariadb mode tcp bind 192.168.120.3:3306 default_backend mariadb backend mariadb source 192.168.120.3 mode tcp option mysql-check user haproxy server mariadb1 192.168.88.1:3306 check inter 10000 send-proxy-v2 server mariadb2 192.168.88.2:3306 check inter 10000 send-proxy-v2 server mariadb3 192.168.88.8:3306 check inter 10000 send-proxy-v2 HTH, Brendan
Thanks I’ve read quite a lot saying that one node in the Galera cluster should be for all writes and then read from all three nodes. For example: https://severalnines.com/blog/avoiding-deadlocks-galera-setting-haproxy-sing... My environment is slightly different in that I have two FreeRadius across two sites, each serving ‘local’ users but from a single pool of IP addresses. At the moment, the NAS routers access their local FreeRadius server and then to the Galera DB. Do you think this is the best thing to do or should I direct the NAS to one FreeRadius as main and the other as backup? I wish I could split the IP pools more sensibly between the two sites (I have a LOT of /32 routes!) but at the moment, I can’t… Thanks again for all the comments and ideas. David From: Brendan Kearney <bpk678@gmail.com> Date: Thursday, 17 September 2026 at 17:52 To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Subject: Re: FreeRadius 3.0.3 and Galera Cluster On 9/17/26 11:52 AM, David Lake via Freeradius-Users wrote:
Thanks.
In terms of HAProxy, I have this running between the FreeRadius servers and the Galera cluster.
I’ve seen some recommendations that I direct all write to one node and then allow read from all so I will ask HAProxy.
Noted on the upgrade - work now in progress.
Thanks
David
From: Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> Date: Thursday, 17 September 2026 at 13:23 To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Cc: Matthew Newton <mcn@freeradius.org> Subject: Re: FreeRadius 3.0.3 and Galera Cluster
On 17/09/2026 12:43, David Lake via Freeradius-Users wrote:
I have two FR 3.0.3 servers and a 3-node Galera cluster for HA. ... 1. Should I run the ’Skip Locked’ on FreeRadius or not? Some documentation says that I shouldn’t as MariaDB doesn’t support it, but other say newer versions do support it Unsure on the database side, but it sounds like your whole system needs an upgrade. Then new features will become available to you.
1. What is the optimal way of configuring HAProxy?
For what? In front of FreeRADIUS? In front of the database? Maybe ask the HAproxy people.
1. How do I separate out writes from reads - I have two sites, each with one FR server and one Galera node. There is a high-speed network between the two, but ideally, I want to keep cross-site traffic to a minimum.
For this sort of thing you'd normally use a "redundant" type section (see instantiate in radiusd.conf) with two sql module instances, one that you point to the database server you use for RW, and the other pointing to the DB server for RO.
e.g. from the example in radiusd.conf, maybe something like
redundant redundant_sql { sql_local sql_remote }
then call 'redundant_sql' instead of 'sql'. sql_local/remote would of course be the other way around at the other site. If 'sql_local' is unavailable, FR will fall back to using 'sql_remote'.
Or, alternatively, define them as 'sql_ro' and 'sql_rw' and call each one as appropriate if you want to just read, or write.
I seem to remember there may have been some bugs fixed with this in the last couple of versions or so; another reason to upgrade before trying it.
-- Matthew
- List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Cd.lake%40surrey.ac.uk%7Cc56c94fc14b94fd180ad08df14dc11e6%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C1%7C639252607618488613%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=bbPlRk6%2FYd9Qg2J1mkTn094TqzqpQHyAmGZPILw3B%2FQ%3D&reserved=0<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Cd.lake%40surrey.ac.uk%7Cc56c94fc14b94fd180ad08df14dc11e6%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C1%7C639252607618518221%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=L0D4hO%2F0DNY0dnnai8CDQ%2FhZd%2BXsc%2BBe3ckf2vRO458%3D&reserved=0><http://www.freeradius.org/list/users.html> - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Cd.lake%40surrey.ac.uk%7Cc56c94fc14b94fd180ad08df14dc11e6%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C1%7C639252607618538263%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=AMflZtspXyYhcDxhhuhNk3vREyTXkOhdwN1LKhtCGuM%3D&reserved=0<http://www.freeradius.org/list/users.html>
i'll keep this brief, in case this belongs being taken off-list... i use HA Proxy in front of MariaDB, with all 3 nodes taking reads and writes. i do this because my machines are relatively low powered, and i want the most performance from the cluster. by using all nodes in read/write mode, i can distribute all workloads across all instances. YMMV. my HA Proxy config, as it pertains to MariaDB is below. i do use proxy-protocol so that the instances see the original client IP, and i can base my ACLs off the client IP, not the HA Proxy VIP/shared IP. in my load-sharing-over-Anycast instances of FreeRADIUS, i point to the HA Proxy VIP for any DB pieces and dont have to worry about the redundant configs in FreeRADIUS. because the infrastructure surrounding MariaDB handles HA, fault tolerance and failover, FreeRADIUS configs are simplified. frontend mariadb mode tcp bind 192.168.120.3:3306 default_backend mariadb backend mariadb source 192.168.120.3 mode tcp option mysql-check user haproxy server mariadb1 192.168.88.1:3306 check inter 10000 send-proxy-v2 server mariadb2 192.168.88.2:3306 check inter 10000 send-proxy-v2 server mariadb3 192.168.88.8:3306 check inter 10000 send-proxy-v2 HTH, Brendan - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Cd.lake%40surrey.ac.uk%7Cc56c94fc14b94fd180ad08df14dc11e6%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C1%7C639252607618557482%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=1%2BQOJVMw%2F0V0j0UPdrSeHfFMS5J5cnc65P2WdNuK2go%3D&reserved=0<http://www.freeradius.org/list/users.html>
On 9/28/26 6:44 AM, David Lake via Freeradius-Users wrote:
Thanks
I’ve read quite a lot saying that one node in the Galera cluster should be for all writes and then read from all three nodes. For example:
https://severalnines.com/blog/avoiding-deadlocks-galera-setting-haproxy-sing...
My environment is slightly different in that I have two FreeRadius across two sites, each serving ‘local’ users but from a single pool of IP addresses.
At the moment, the NAS routers access their local FreeRadius server and then to the Galera DB.
Do you think this is the best thing to do or should I direct the NAS to one FreeRadius as main and the other as backup?
I wish I could split the IP pools more sensibly between the two sites (I have a LOT of /32 routes!) but at the moment, I can’t…
Thanks again for all the comments and ideas.
David
From: Brendan Kearney <bpk678@gmail.com> Date: Thursday, 17 September 2026 at 17:52 To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Subject: Re: FreeRadius 3.0.3 and Galera Cluster
On 9/17/26 11:52 AM, David Lake via Freeradius-Users wrote:
Thanks.
In terms of HAProxy, I have this running between the FreeRadius servers and the Galera cluster.
I’ve seen some recommendations that I direct all write to one node and then allow read from all so I will ask HAProxy.
Noted on the upgrade - work now in progress.
Thanks
David
From: Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> Date: Thursday, 17 September 2026 at 13:23 To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Cc: Matthew Newton <mcn@freeradius.org> Subject: Re: FreeRadius 3.0.3 and Galera Cluster
On 17/09/2026 12:43, David Lake via Freeradius-Users wrote:
I have two FR 3.0.3 servers and a 3-node Galera cluster for HA. ... 1. Should I run the ’Skip Locked’ on FreeRadius or not? Some documentation says that I shouldn’t as MariaDB doesn’t support it, but other say newer versions do support it Unsure on the database side, but it sounds like your whole system needs an upgrade. Then new features will become available to you.
1. What is the optimal way of configuring HAProxy?
For what? In front of FreeRADIUS? In front of the database? Maybe ask the HAproxy people.
1. How do I separate out writes from reads - I have two sites, each with one FR server and one Galera node. There is a high-speed network between the two, but ideally, I want to keep cross-site traffic to a minimum.
For this sort of thing you'd normally use a "redundant" type section (see instantiate in radiusd.conf) with two sql module instances, one that you point to the database server you use for RW, and the other pointing to the DB server for RO.
e.g. from the example in radiusd.conf, maybe something like
redundant redundant_sql { sql_local sql_remote }
then call 'redundant_sql' instead of 'sql'. sql_local/remote would of course be the other way around at the other site. If 'sql_local' is unavailable, FR will fall back to using 'sql_remote'.
Or, alternatively, define them as 'sql_ro' and 'sql_rw' and call each one as appropriate if you want to just read, or write.
I seem to remember there may have been some bugs fixed with this in the last couple of versions or so; another reason to upgrade before trying it.
-- Matthew
- List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Cd.lake%40surrey.ac.uk%7Cc56c94fc14b94fd180ad08df14dc11e6%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C1%7C639252607618488613%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=bbPlRk6%2FYd9Qg2J1mkTn094TqzqpQHyAmGZPILw3B%2FQ%3D&reserved=0<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Cd.lake%40surrey.ac.uk%7Cc56c94fc14b94fd180ad08df14dc11e6%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C1%7C639252607618518221%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=L0D4hO%2F0DNY0dnnai8CDQ%2FhZd%2BXsc%2BBe3ckf2vRO458%3D&reserved=0><http://www.freeradius.org/list/users.html> - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Cd.lake%40surrey.ac.uk%7Cc56c94fc14b94fd180ad08df14dc11e6%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C1%7C639252607618538263%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=AMflZtspXyYhcDxhhuhNk3vREyTXkOhdwN1LKhtCGuM%3D&reserved=0<http://www.freeradius.org/list/users.html> i'll keep this brief, in case this belongs being taken off-list...
i use HA Proxy in front of MariaDB, with all 3 nodes taking reads and writes. i do this because my machines are relatively low powered, and i want the most performance from the cluster. by using all nodes in read/write mode, i can distribute all workloads across all instances. YMMV.
my HA Proxy config, as it pertains to MariaDB is below. i do use proxy-protocol so that the instances see the original client IP, and i can base my ACLs off the client IP, not the HA Proxy VIP/shared IP. in my load-sharing-over-Anycast instances of FreeRADIUS, i point to the HA Proxy VIP for any DB pieces and dont have to worry about the redundant configs in FreeRADIUS. because the infrastructure surrounding MariaDB handles HA, fault tolerance and failover, FreeRADIUS configs are simplified.
frontend mariadb mode tcp bind 192.168.120.3:3306 default_backend mariadb
backend mariadb source 192.168.120.3 mode tcp option mysql-check user haproxy
server mariadb1 192.168.88.1:3306 check inter 10000 send-proxy-v2 server mariadb2 192.168.88.2:3306 check inter 10000 send-proxy-v2 server mariadb3 192.168.88.8:3306 check inter 10000 send-proxy-v2
HTH,
Brendan
- List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Cd.lake%40surrey.ac.uk%7Cc56c94fc14b94fd180ad08df14dc11e6%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C1%7C639252607618557482%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=1%2BQOJVMw%2F0V0j0UPdrSeHfFMS5J5cnc65P2WdNuK2go%3D&reserved=0<http://www.freeradius.org/list/users.html> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
a quick look at my DB shows that i do not have any deadlocks, since uptime. i reboot on the first of each month. stats show that i have about 290k log events per day. deadlocks are not an issue in my environment, it seems. maybe i dont have enough volume to bring about the concern. note, that the logs i am capturing are all of the system logs from about 8 devices. i have a router/firewall/gateway, 3 general purpose servers running a myriad of services, a NAS, a hypervisor and a VPN VM. i configure each box to forward all systemd-journald and syslog messages to my syslog receivers and the receivers insert the events into a single table in my DB. of note, i do purge my DB when the record count gets above ~4 million entries. its just me, myself and i, so my logs are consequential. i have a separate DB for FR that does not involve the systemd-journald and syslog events on the same servers as my syslog DB and i dont have enough traffic from FR to evaluate DB performance related to capacity. i am only doing user AuthN/Z and not 802.1x (yet?). having one FR instance as primary is something that you would have to test. the latency across a WAN link may have impact, but you would have to measure. to me, does the protocol traversing the WAN matter? RADIUS may not feel the difference as much as SQL. RADIUS being stateless and connectionless vs. SQL being stateful and connection-oriented may be something to consider. HTH, brendan
On Sep 28, 2026, at 6:44 AM, David Lake via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I’ve read quite a lot saying that one node in the Galera cluster should be for all writes and then read from all three nodes. For example:
The issue overall is that multi-master database writes are problematic. Database store data, and don't know how to merge conflicting writes. In contrast, applications know how to merge conflicting writes. For example the RADIUS server knows the meaning of accounting data. So if it gets an accounting packet, it can correctly merge that data into a pre-existing row. SQL databases can't do this automatically. Which is why if you need multi-master SQL, you can shard the data on a key. Each key then maps to only one SQL DB, so there's only one master, and multi-master issues are avoided.
Do you think this is the best thing to do or should I direct the NAS to one FreeRadius as main and the other as backup?
I wish I could split the IP pools more sensibly between the two sites (I have a LOT of /32 routes!) but at the moment, I can’t…
We've had good luck with splitting IP pools. But if you can't do that, use a clustered Redis solution. We've also had good luck with that. i.e. don't use two SQL databases. They're "clustered" in that you can talk to both of them, but if the docs say you should use only one master, then it's not really a cluster. In contrast, a Redis cluster solution will do sharding behind the scenes. When FreeRADIUS tries to write an IP address, the cluster protocol will tell FreeRADIUS which server to use. This all happens automatically. We've managed to get 100K IPs per second out of a 6 node redis cluster. And that isn't the limit of what Redis can do. Given your limitations on IPs, your only real choice is a centralized IP assignment system. This could be multiple RADIUS servers talking to the same cluster, or the NASes sending all of their packets to one RADIUS server. Alan DeKok.
Hi Alan Thanks. We are also stuck with an SQL-based DB at the moment because this links to a CRM system which links to a billing system which links to…. Etc. So a backend Galera cluster makes sense (although Redis does make MUCH more sense). WAN bandwidth between the two sites is not an issue (dark fibre) so the answer for now is probably to have the RADIUS servers as main and backup and then have everything in one place. The highest number will ever get to that need IP allocation all-at-once is about 8,000 clients (that is in the event of site failure all clients rehoming to the second site) so we’re not going to be hitting any limited in terms of system performance. Looks like I need to build HAProxy or ProxySQL to hide the multi-master and then direct both my NASes through one RADIUS server for now. (Any preferences for HAProxy vs ProxySQL?) Thanks! David On 28/09/2026, 15:19, "Alan DeKok" <alan.dekok@inkbridge.io> wrote: On Sep 28, 2026, at 6:44 AM, David Lake via Freeradius-Users <freeradius-users@lists.freeradius.org<mailto:freeradius-users@lists.freeradius.org>> wrote:
I’ve read quite a lot saying that one node in the Galera cluster should be for all writes and then read from all three nodes. For example:
The issue overall is that multi-master database writes are problematic. Database store data, and don't know how to merge conflicting writes. In contrast, applications know how to merge conflicting writes. For example the RADIUS server knows the meaning of accounting data. So if it gets an accounting packet, it can correctly merge that data into a pre-existing row. SQL databases can't do this automatically. Which is why if you need multi-master SQL, you can shard the data on a key. Each key then maps to only one SQL DB, so there's only one master, and multi-master issues are avoided.
Do you think this is the best thing to do or should I direct the NAS to one FreeRadius as main and the other as backup?
I wish I could split the IP pools more sensibly between the two sites (I have a LOT of /32 routes!) but at the moment, I can’t…
We've had good luck with splitting IP pools. But if you can't do that, use a clustered Redis solution. We've also had good luck with that. i.e. don't use two SQL databases. They're "clustered" in that you can talk to both of them, but if the docs say you should use only one master, then it's not really a cluster. In contrast, a Redis cluster solution will do sharding behind the scenes. When FreeRADIUS tries to write an IP address, the cluster protocol will tell FreeRADIUS which server to use. This all happens automatically. We've managed to get 100K IPs per second out of a 6 node redis cluster. And that isn't the limit of what Redis can do. Given your limitations on IPs, your only real choice is a centralized IP assignment system. This could be multiple RADIUS servers talking to the same cluster, or the NASes sending all of their packets to one RADIUS server. Alan DeKok.
On Sep 28, 2026, at 10:50 AM, David Lake <d.lake@surrey.ac.uk> wrote:
Thanks. We are also stuck with an SQL-based DB at the moment because this links to a CRM system which links to a billing system which links to…. Etc.
Life is complicated. :(
WAN bandwidth between the two sites is not an issue (dark fibre) so the answer for now is probably to have the RADIUS servers as main and backup and then have everything in one place. The highest number will ever get to that need IP allocation all-at-once is about 8,000 clients (that is in the event of site failure all clients rehoming to the second site) so we’re not going to be hitting any limited in terms of system performance.
Having both RADIUS servers talk to one SQL cluster is fine, so long as the connectivity is _very_ reliable.
Looks like I need to build HAProxy or ProxySQL to hide the multi-master and then direct both my NASes through one RADIUS server for now.
(Any preferences for HAProxy vs ProxySQL?)
I've had good luck with HAproxy. I haven't looked at ProxySQL. Alan DeKok.
Perfect - thank you. Looks like I need to start rebuilding this evening then! David On 28/09/2026, 15:55, "Alan DeKok" <alan.dekok@inkbridge.io> wrote: On Sep 28, 2026, at 10:50 AM, David Lake <d.lake@surrey.ac.uk<mailto:d.lake@surrey.ac.uk>> wrote:
Thanks. We are also stuck with an SQL-based DB at the moment because this links to a CRM system which links to a billing system which links to…. Etc.
Life is complicated. :(
WAN bandwidth between the two sites is not an issue (dark fibre) so the answer for now is probably to have the RADIUS servers as main and backup and then have everything in one place. The highest number will ever get to that need IP allocation all-at-once is about 8,000 clients (that is in the event of site failure all clients rehoming to the second site) so we’re not going to be hitting any limited in terms of system performance.
Having both RADIUS servers talk to one SQL cluster is fine, so long as the connectivity is _very_ reliable.
Looks like I need to build HAProxy or ProxySQL to hide the multi-master and then direct both my NASes through one RADIUS server for now.
(Any preferences for HAProxy vs ProxySQL?)
I've had good luck with HAproxy. I haven't looked at ProxySQL. Alan DeKok.
just want to put my PoV. FreeRadius and it's un-lang is very (super?) fast and powerful. But it need learning curved for so-called "Common Programmer" (just like me) Fortunately, there is rlm_rest came to the rescue. by Only need simple JSON rest knowledge, you can do any kungfu you want. Yes it will add another one-hop, but I have no complain about it as far. Personally, i put rlm_rest as "FreeRadius Swiss Army Knife". Sincerely -bino- On Thu, Sep 17, 2026 at 10:53 PM David Lake via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
Thanks.
In terms of HAProxy, I have this running between the FreeRadius servers and the Galera cluster.
I’ve seen some recommendations that I direct all write to one node and then allow read from all so I will ask HAProxy.
Noted on the upgrade - work now in progress.
Thanks
David
From: Matthew Newton via Freeradius-Users < freeradius-users@lists.freeradius.org> Date: Thursday, 17 September 2026 at 13:23 To: freeradius-users@lists.freeradius.org < freeradius-users@lists.freeradius.org> Cc: Matthew Newton <mcn@freeradius.org> Subject: Re: FreeRadius 3.0.3 and Galera Cluster
On 17/09/2026 12:43, David Lake via Freeradius-Users wrote:
I have two FR 3.0.3 servers and a 3-node Galera cluster for HA. ... 1. Should I run the ’Skip Locked’ on FreeRadius or not? Some documentation says that I shouldn’t as MariaDB doesn’t support it, but other say newer versions do support it
Unsure on the database side, but it sounds like your whole system needs an upgrade. Then new features will become available to you.
1. What is the optimal way of configuring HAProxy?
For what? In front of FreeRADIUS? In front of the database? Maybe ask the HAproxy people.
1. How do I separate out writes from reads - I have two sites, each with one FR server and one Galera node. There is a high-speed network between the two, but ideally, I want to keep cross-site traffic to a minimum.
For this sort of thing you'd normally use a "redundant" type section (see instantiate in radiusd.conf) with two sql module instances, one that you point to the database server you use for RW, and the other pointing to the DB server for RO.
e.g. from the example in radiusd.conf, maybe something like
redundant redundant_sql { sql_local sql_remote }
then call 'redundant_sql' instead of 'sql'. sql_local/remote would of course be the other way around at the other site. If 'sql_local' is unavailable, FR will fall back to using 'sql_remote'.
Or, alternatively, define them as 'sql_ro' and 'sql_rw' and call each one as appropriate if you want to just read, or write.
I seem to remember there may have been some bugs fixed with this in the last couple of versions or so; another reason to upgrade before trying it.
-- Matthew
- List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freerad... <http://www.freeradius.org/list/users.html> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
Alan DeKok -
Bino Oetomo -
Brendan Kearney -
David Lake -
Matthew Newton