strongSwan + FreeRadius DHCP pool
Hello list, I'm trying to setup a strongSwan VPN solution with Freeradius. The plan is to have Freeradius authenticate users from a MariaDB database and give out ip addresses as well from the DB. The authentication part works fine. Users are authenticated and can make a connection, but DHCP is not working. What I've done is the following: - Add mods-config/sql/ippool-dhcp/mysql/schema.sql to the DB. - Enable the dhcp and dhcp_sqlippool mods. - Add dhcp_sqlippool to sites-available/default. - Configured sites-enabled/dhcp. I'm running Freeradius 3.0.11 on Debian 8. Is there anything I should be doing? Did I miss something obvious? Thanks in advance!
On 14 Apr 2016, at 19:26, Laurens Vets <laurens@daemon.be> wrote:
Hello list,
I'm trying to setup a strongSwan VPN solution with Freeradius. The plan is to have Freeradius authenticate users from a MariaDB database and give out ip addresses as well from the DB. The authentication part works fine. Users are authenticated and can make a connection, but DHCP is not working.
What I've done is the following: - Add mods-config/sql/ippool-dhcp/mysql/schema.sql to the DB. - Enable the dhcp and dhcp_sqlippool mods. - Add dhcp_sqlippool to sites-available/default. - Configured sites-enabled/dhcp.
I'm running Freeradius 3.0.11 on Debian 8.
Is there anything I should be doing? Did I miss something obvious?
Add ip addresses to the database? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 2016-04-14 16:33, Arran Cudbard-Bell wrote:
On 14 Apr 2016, at 19:26, Laurens Vets <laurens@daemon.be> wrote:
Hello list,
I'm trying to setup a strongSwan VPN solution with Freeradius. The plan is to have Freeradius authenticate users from a MariaDB database and give out ip addresses as well from the DB. The authentication part works fine. Users are authenticated and can make a connection, but DHCP is not working.
What I've done is the following: - Add mods-config/sql/ippool-dhcp/mysql/schema.sql to the DB. - Enable the dhcp and dhcp_sqlippool mods. - Add dhcp_sqlippool to sites-available/default. - Configured sites-enabled/dhcp.
I'm running Freeradius 3.0.11 on Debian 8.
Is there anything I should be doing? Did I miss something obvious?
Add ip addresses to the database?
Freeradius needs a table prefilled with ip addresses to work? I can't specify a range somewhere and use that?
On Apr 14, 2016, at 7:47 PM, Laurens Vets <laurens@daemon.be> wrote:
Freeradius needs a table prefilled with ip addresses to work?
That's what he said.
I can't specify a range somewhere and use that?
No. If you want a /16 range, then you need to insert the IPs into the database. FreeRADIUS isn't going to iterate over all IPs and create them as necessary. Tracking ranges would be slower and more fragile than just using a database. Databases store data. It's what they do, and they do it well. Alan DeKok.
On 2016-04-14 17:38, Alan DeKok wrote:
On Apr 14, 2016, at 7:47 PM, Laurens Vets <laurens@daemon.be> wrote:
Freeradius needs a table prefilled with ip addresses to work?
That's what he said.
I can't specify a range somewhere and use that?
No.
If you want a /16 range, then you need to insert the IPs into the database. FreeRADIUS isn't going to iterate over all IPs and create them as necessary.
Tracking ranges would be slower and more fragile than just using a database. Databases store data. It's what they do, and they do it well.
Alan DeKok.
Thank you Alan and Arran.
On 2016-04-14 17:38, Alan DeKok wrote:
On Apr 14, 2016, at 7:47 PM, Laurens Vets <laurens@daemon.be> wrote:
Freeradius needs a table prefilled with ip addresses to work?
That's what he said.
I can't specify a range somewhere and use that?
No.
If you want a /16 range, then you need to insert the IPs into the database. FreeRADIUS isn't going to iterate over all IPs and create them as necessary.
Tracking ranges would be slower and more fragile than just using a database. Databases store data. It's what they do, and they do it well.
Alan DeKok.
So I've added several ip addresses to the radippool table. For testing purposes, I'm using 2 pools, 1_pool and 2_pool. Can I assign a pool based on clients listed in clients.conf? ("ippool = 1_pool" does not seem to work).
On Apr 15, 2016, at 3:03 PM, Laurens Vets <laurens@daemon.be> wrote:
So I've added several ip addresses to the radippool table. For testing purposes, I'm using 2 pools, 1_pool and 2_pool. Can I assign a pool based on clients listed in clients.conf? ("ippool = 1_pool" does not seem to work)
You can't just invent syntax and stick it into the configuration files. The documentation says that you need to set Pool-Name for the pool module to allocate an IP. Setting "ippool = 1_pool" in the clients.conf file doesn't do that. You need to write "unlang" statements which set the Pool-Name. See the default configuration files for examples of using unlang. Alan DeKok.
On 2016-04-15 12:19, Alan DeKok wrote:
On Apr 15, 2016, at 3:03 PM, Laurens Vets <laurens@daemon.be> wrote:
So I've added several ip addresses to the radippool table. For testing purposes, I'm using 2 pools, 1_pool and 2_pool. Can I assign a pool based on clients listed in clients.conf? ("ippool = 1_pool" does not seem to work)
You can't just invent syntax and stick it into the configuration files.
The documentation says that you need to set Pool-Name for the pool module to allocate an IP. Setting "ippool = 1_pool" in the clients.conf file doesn't do that.
You need to write "unlang" statements which set the Pool-Name. See the default configuration files for examples of using unlang.
So there's no way to set Pool-Name in the clients.conf file? From what I can see in the unlang manual, I have to do: update control { &Pool-Name := "1_pool" } Do I need to do that in mods-enabled/dhcp_sqlippool? If so, will that mean I will have to write unlang if statements to match a pool to some other attribute (for instance NAS-Port-Id, Called-Station-Id or NAS-Identifier) What I'm thinking is that I have to do the following (in quick pseudocode) somewhere: update control { if(Called-Station-Id eq 1.1.1.1) { pool-name = "1_pool" } elseif(Called-Station-Id eq 2.2.2.2) { pool-name = "2_pool" } } I'm struggling with the 'somewhere' part :)
On Sun, Apr 17, 2016 at 03:10:45PM -0700, Laurens Vets wrote:
So there's no way to set Pool-Name in the clients.conf file?
Not directly. But you can make up variables there and then access them from unlang.
From what I can see in the unlang manual, I have to do: update control { &Pool-Name := "1_pool" }
Add the pool name to your clients.conf, e.g. client client_1 { ... mypoolname = pool_1 ... } Then pull this out into the Pool-Name attribute with unlang in sites-enabled/default in the post-auth{} or authorize{} section: update control { Pool-Name := "%{client:mypoolname}" }
update control { if(Called-Station-Id eq 1.1.1.1) { pool-name = "1_pool" } elseif(Called-Station-Id eq 2.2.2.2) { pool-name = "2_pool" } }
That's not correct syntax. You need the update control{} around each assignment. You can't just put the whole thing inside an update. If you want to look up the pool name from Called-Station-Id, rather than the client that is connecting, then you could configure an instance of the files module to look up Called-Station-Id in a file and set the Pool-Name. Or sql. Or many other ways, depending on where you have the data.
I'm struggling with the 'somewhere' part :)
Either authorize{} or post-auth{}. Probbaly the latter, before you do your IP assignment. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On 17 Apr 2016, at 18:10, Laurens Vets <laurens@daemon.be> wrote:
On 2016-04-15 12:19, Alan DeKok wrote:
On Apr 15, 2016, at 3:03 PM, Laurens Vets <laurens@daemon.be> wrote:
So I've added several ip addresses to the radippool table. For testing purposes, I'm using 2 pools, 1_pool and 2_pool. Can I assign a pool based on clients listed in clients.conf? ("ippool = 1_pool" does not seem to work) You can't just invent syntax and stick it into the configuration files. The documentation says that you need to set Pool-Name for the pool module to allocate an IP. Setting "ippool = 1_pool" in the clients.conf file doesn't do that. You need to write "unlang" statements which set the Pool-Name. See the default configuration files for examples of using unlang.
So there's no way to set Pool-Name in the clients.conf file?
client foo { pool_name = 'whatever' } update control { &Pool-Name := "%{client:pool_name}" }
From what I can see in the unlang manual, I have to do: update control { &Pool-Name := "1_pool" }
In v3.1.x every client definition bar those bulkloaded from SQL can have custom attributes, which you can access using the %{client:var} xlat. Should work in v3.0.x too.
Do I need to do that in mods-enabled/dhcp_sqlippool? If so, will that mean I will have to write unlang if statements to match a pool to some other attribute (for instance NAS-Port-Id, Called-Station-Id or NAS-Identifier)
No, you do it in the sections authorize/authenticate etc.. of the virtual server. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Apr 17, 2016, at 6:10 PM, Laurens Vets <laurens@daemon.be> wrote:
From what I can see in the unlang manual, I have to do: update control { &Pool-Name := "1_pool" }
Yes..
Do I need to do that in mods-enabled/dhcp_sqlippool?
No.
If so, will that mean I will have to write unlang if statements to match a pool to some other attribute (for instance NAS-Port-Id, Called-Station-Id or NAS-Identifier)
Yes...
What I'm thinking is that I have to do the following (in quick pseudocode) somewhere:
update control { if(Called-Station-Id eq 1.1.1.1) { pool-name = "1_pool" } elseif(Called-Station-Id eq 2.2.2.2) { pool-name = "2_pool" } }
I'm struggling with the 'somewhere' part :)
Run the server in debug mode to see how it works. Then, you'll know what file to edit, and where to edit it. Or, read raddb/sites-available/default. There is a LOT of documentation available. Alan DeKok.
Hello, For marketing reasons I want to authenticate users with invalid login or password and assign an IP for a specific pool. I made the modification below in sites-enabled / default file and is working, but I would like to assign a radgroupreply table group to limit band too. I tried to put Mikrotik-Rate-Limit but it's not working!! How can I do it? Auth-Type PAP { pap { reject = 1 } if(reject) { update control { Pool-Name := "mkt_pool" Mikrotik-Rate-Limit := "125K/250K 200K/350K 95K/190K 10/10" } ok } } Auth-Type CHAP { chap { reject = 1 } if(reject) { update control { Pool-Name := "mkt_pool" Mikrotik-Rate-Limit := "125K/250K 200K/350K 95K/190K 10/10" } ok } } Auth-Type MS-CHAP { mschap { reject = 1 } if(reject) { update control { Pool-Name := "mkt_pool" Mikrotik-Rate-Limit := "125K/250K 200K/350K 95K/190K 10/10" } ok } } digest unix eap }
On Tue, Apr 19, 2016 at 09:23:15AM -0300, Aurélio de Souza Ribeiro Neto wrote:
I tried to put Mikrotik-Rate-Limit but it's not working!!
"update reply" for Mikrotik-Rate-Limit, rather than "update control"? control attributes will never be sent back to the client. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Thanks Matthew, It works! Aurélio Em 19/04/2016 09:38, Matthew Newton escreveu:
On Tue, Apr 19, 2016 at 09:23:15AM -0300, Aurélio de Souza Ribeiro Neto wrote:
I tried to put Mikrotik-Rate-Limit but it's not working!! "update reply" for Mikrotik-Rate-Limit, rather than "update control"?
control attributes will never be sent back to the client.
Matthew
participants (5)
-
Alan DeKok -
Arran Cudbard-Bell -
Aurélio de Souza Ribeiro Neto -
Laurens Vets -
Matthew Newton