Request for assistance: FreeRadius configuration for split accounting of users into groups
Dear FreeRadius Mailing List, I hope this email finds you well. I am reaching out to request assistance with a technical issue that my team and I have been facing while configuring FreeRadius for our OpenVPN setup. We have configured OpenVPN with the OpenVPN Radius Plugin for authentication and accounting, and we have connected it to a FreeRadius server. Our aim is to split users into two groups, Premium and Limited, and configure bandwidth throttling for them depending on their group. For Premium users, we would like to provide unlimited bandwidth without any throttling. However, for Limited users, we want to provide free 1GB/day and then throttle their connection if they exceed the limit. To achieve this, we have configured the PERL module as an External Scripting functionality to check daily consumption and other metrics of the user in "Acct-Interim-Updates." We use this functionality to control the user's group by switching them from Premium to Limited and vice versa. Additionally, we apply throttling to the OpenVPN server using tc. We also allow users to purchase tokens to top up their allowed bandwidth. If a user exceeds their daily limit, their purchased credits allow them to continue their internet usage without any additional throttling. However, we are facing issues with the accounting per user group. Specifically, we have noticed that if a user is now in the Limited group and consuming traffic on a throttled connection, the daily_consumption metric continues to add up, even if they have already exceeded their allowed daily bandwidth. For example, let's say a user has consumed 0.5 GB in addition to their allowed 1 GB per day, which makes their total consumption 1.5 GB/day. If the user then purchases extra credits worth 0.2 GB, their total allowed consumption would be 1.2. GB/Day, however, their actual. total daily consumption would still be 1.5 GB/day, which renders the user in the same `limited` group and breaks the accounting purposes. To address this issue, we would like to have split accounting for each group. In other words, once a user is throttled, we want to ignore the bandwidth recorded and only calculate the bandwidth consumed during their Premium group connection. It is important to note that the `acctinputoctets` and `acctoutputoctets` values are pushed by OpenVPN-Radius Plugin as total incremented values of the connection , and not interval values during each `Acct-Interim-Updates`. We would greatly appreciate any assistance or guidance on how to achieve this goal. Thank you in advance for your time and expertise. Best regards, Ahmad R. Gharib -- ~ ~ *Ahmad R. Gharib* *Linux Systems Administrator at Securealm SARL* *Mobile: +961 71953385*
On Mar 28, 2023, at 5:25 PM, Ahmad Gharib <ahmadrg49@gmail.com> wrote:
We have configured OpenVPN with the OpenVPN Radius Plugin for authentication and accounting, and we have connected it to a FreeRadius server. Our aim is to split users into two groups, Premium and Limited, and configure bandwidth throttling for them depending on their group.
For Premium users, we would like to provide unlimited bandwidth without any throttling. However, for Limited users, we want to provide free 1GB/day and then throttle their connection if they exceed the limit.
All of these issues end up being local policy rules. i.e. write down what you want the server to do, and then make the server do it. If the server doesn't do what you want, it's because there's a disconnect between what you want, and what you told the server to do.
To achieve this, we have configured the PERL module as an External Scripting functionality to check daily consumption and other metrics of the user in "Acct-Interim-Updates." We use this functionality to control the user's group by switching them from Premium to Limited and vice versa. Additionally, we apply throttling to the OpenVPN server using tc.
Dynamic switching like this may work, but it can be a source of confusion. What group is the user in? Does their current profile match their group?
We also allow users to purchase tokens to top up their allowed bandwidth. If a user exceeds their daily limit, their purchased credits allow them to continue their internet usage without any additional throttling.
These are all complex local rules. It takes a careful approach to write "unlang" policies which match the goals you have.
However, we are facing issues with the accounting per user group. Specifically, we have noticed that if a user is now in the Limited group and consuming traffic on a throttled connection, the daily_consumption metric continues to add up, even if they have already exceeded their allowed daily bandwidth.
The default configuration has none of these rules. So if the rules don't do what you want, it's because of rules created on your local system.
For example, let's say a user has consumed 0.5 GB in addition to their allowed 1 GB per day, which makes their total consumption 1.5 GB/day. If the user then purchases extra credits worth 0.2 GB, their total allowed consumption would be 1.2. GB/Day, however, their actual. total daily consumption would still be 1.5 GB/day, which renders the user in the same `limited` group and breaks the accounting purposes.
So write rules to check for this situation?
To address this issue, we would like to have split accounting for each group. In other words, once a user is throttled, we want to ignore the bandwidth recorded and only calculate the bandwidth consumed during their Premium group connection.
You have to update the schema && the accounting queries to do this. It's not trivial.
It is important to note that the `acctinputoctets` and `acctoutputoctets` values are pushed by OpenVPN-Radius Plugin as total incremented values of the connection , and not interval values during each `Acct-Interim-Updates`.
Yes, that's how RADIUS accounting works. The NAS has no idea what the rules are on the server side.
We would greatly appreciate any assistance or guidance on how to achieve this goal. Thank you in advance for your time and expertise.
To be honest, this is all very complicated, and I'm still not quite clear on what you want it to do.
Hi Alan, Thank you for taking the time to answer my questions, and sorry for the late reply. The main deliverable was to extend FreeRadius as a AAA server to have the ability of switching users between groups, trace per-group accounting for the users (Check the usage of user A while being in group X, and in group Y), and to apply traffic shaping actions based on the group assignment. The groups being `limited` or `unlimited` in terms of connection speed in OpenVPN. I agree, the setup/deliverable is very complicated, but I have managed to work around the limitations I faced with the usage of the PERL module during "Start", "Interim-Update", and "Stop" accounting requests. It all had to be custom made with the usage of Redis caching along with MySQL. We aren't using FreeRadius policies as for now, but I'll check it for later development. If you need more information on the script and component logic, please let me know and I'll share it with you. :) You can consider this case as solved. Thank you. Regards On Thu, Mar 30, 2023 at 5:17 AM Alan DeKok <aland@deployingradius.com> wrote:
On Mar 28, 2023, at 5:25 PM, Ahmad Gharib <ahmadrg49@gmail.com> wrote:
We have configured OpenVPN with the OpenVPN Radius Plugin for authentication and accounting, and we have connected it to a FreeRadius server. Our aim is to split users into two groups, Premium and Limited, and configure bandwidth throttling for them depending on their group.
For Premium users, we would like to provide unlimited bandwidth without any throttling. However, for Limited users, we want to provide free 1GB/day and then throttle their connection if they exceed the limit.
All of these issues end up being local policy rules. i.e. write down what you want the server to do, and then make the server do it.
If the server doesn't do what you want, it's because there's a disconnect between what you want, and what you told the server to do.
To achieve this, we have configured the PERL module as an External Scripting functionality to check daily consumption and other metrics of the user in "Acct-Interim-Updates." We use this functionality to control the user's group by switching them from Premium to Limited and vice versa. Additionally, we apply throttling to the OpenVPN server using tc.
Dynamic switching like this may work, but it can be a source of confusion. What group is the user in? Does their current profile match their group?
We also allow users to purchase tokens to top up their allowed bandwidth. If a user exceeds their daily limit, their purchased credits allow them to continue their internet usage without any additional throttling.
These are all complex local rules. It takes a careful approach to write "unlang" policies which match the goals you have.
However, we are facing issues with the accounting per user group. Specifically, we have noticed that if a user is now in the Limited group and consuming traffic on a throttled connection, the daily_consumption metric continues to add up, even if they have already exceeded their allowed daily bandwidth.
The default configuration has none of these rules. So if the rules don't do what you want, it's because of rules created on your local system.
For example, let's say a user has consumed 0.5 GB in addition to their allowed 1 GB per day, which makes their total consumption 1.5 GB/day. If the user then purchases extra credits worth 0.2 GB, their total allowed consumption would be 1.2. GB/Day, however, their actual. total daily consumption would still be 1.5 GB/day, which renders the user in the same `limited` group and breaks the accounting purposes.
So write rules to check for this situation?
To address this issue, we would like to have split accounting for each group. In other words, once a user is throttled, we want to ignore the bandwidth recorded and only calculate the bandwidth consumed during their Premium group connection.
You have to update the schema && the accounting queries to do this. It's not trivial.
It is important to note that the `acctinputoctets` and `acctoutputoctets` values are pushed by OpenVPN-Radius Plugin as total incremented values of the connection , and not interval values during each `Acct-Interim-Updates`.
Yes, that's how RADIUS accounting works. The NAS has no idea what the rules are on the server side.
We would greatly appreciate any assistance or guidance on how to achieve this goal. Thank you in advance for your time and expertise.
To be honest, this is all very complicated, and I'm still not quite clear on what you want it to do. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Ahmad Gharib -
Alan DeKok