Brian Carpio wrote:

I'm pretty clear on how I would add a new home_server_pool called like alt-server-balance with the other two home_servers defined which listen on the 1815,1816 the part I am confused about is how to define the new realm, since I'm using DEFAULT to send all traffic to "server-balance" how do I define a new realm which will accept traffic on 1815,1816 and send it to alt-server-balance.

I hope that makes sense.

No. You've confused *incoming* connections with *outgoing* connections. Realms allow you to send packets to outgoing connections. Realms do *not* "accept traffic". You're stuck on implementing a particular solution. Instead, focus on the problem. It will usually be easier than you think. Draw a diagram of how you want packets to flow in/out of the server. Incoming packets require a "listen" section. Outgoing packets require a "home_server" definition. The glue in between is the realms, and/or the policies you want to configure. Alan DeKok.

Hmm my line breaks where removed from my email External Servers Send Requests To - 1812,1813 --- FreeRadiusd -- Backend_Servers_Set01 (1812,1813) ---------------------------------------------------------------- External Servers Send Requests To - 1815,1816 -- FreeRadiusd -- Backend_Servers_Set02 (1815,1816) Lets try agian -----Original Message----- From: freeradius-users-bounces+bcarpio=broadhop.com@lists.freeradius.org [mailto:freeradius-users-bounces+bcarpio=broadhop.com@lists.freeradius.org] On Behalf Of Brian Carpio Sent: Friday, December 17, 2010 9:10 AM To: FreeRadius users mailing list Subject: RE: Reals Based Upon Port Thanks for the reply, here is what I am trying to do External Servers Send Requests To - 1812,1813 --- FreeRadiusd -- Backend_Servers_Set01 (1812,1813) External Servers Send Requests To - 1815,1816 -- FreeRadiusd -- Backend_Servers_Set02 (1815,1816) I guess I am not sure where the listen section goes? Maybe I removed it from my proxy.conf file? -----Original Message----- From: freeradius-users-bounces+bcarpio=broadhop.com@lists.freeradius.org [mailto:freeradius-users-bounces+bcarpio=broadhop.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, December 16, 2010 3:07 AM To: FreeRadius users mailing list Subject: Re: Reals Based Upon Port Brian Carpio wrote:

I'm pretty clear on how I would add a new home_server_pool called like alt-server-balance with the other two home_servers defined which listen on the 1815,1816 the part I am confused about is how to define the new realm, since I'm using DEFAULT to send all traffic to "server-balance" how do I define a new realm which will accept traffic on 1815,1816 and send it to alt-server-balance.

I hope that makes sense.

No. You've confused *incoming* connections with *outgoing* connections. Realms allow you to send packets to outgoing connections. Realms do *not* "accept traffic". You're stuck on implementing a particular solution. Instead, focus on the problem. It will usually be easier than you think. Draw a diagram of how you want packets to flow in/out of the server. Incoming packets require a "listen" section. Outgoing packets require a "home_server" definition. The glue in between is the realms, and/or the policies you want to configure. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Thanks for your help Alan, but I think I am not giving you the right information.. (that or I don't understand the README) So we are using freeradius for proxying requests to different backend servers only (basically using freeradius as a load balancer), we aren't using it to actually authenticate users at all, when we simply wanted to listen on 1812 and 1813 and proxy to multiple home_servers on 1812 and 1813 everything works fine ---- initial simple radiusd.conf -------- prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib64/freeradius pidfile = ${run_dir}/${name}.pid user = radiusd group = radiusd max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ ----- end radiusd.conf ------------------ ---- start simply proxy.conf ---- proxy server { default_fallback = no } home_server server01 { type = auth+acct ipaddr = server01 port = 1812,1813 virtual_server = default secret = s3cret require_message_authenticator = no response_window = 20 zombie_period = 10 status_check = request username = DEADBEEF@broadhop.com password = s3cret check_interval = 5 num_answers_to_alive = 3 } home_server server02 { type = auth+acct ipaddr = server02 port = 1812,1813 virtual_server = default secret = s3cret require_message_authenticator = no response_window = 20 zombie_period = 10 status_check = request username = DEADBEEF@broadhop.com password = s3cret check_interval = 5 num_answers_to_alive = 3 } home_server_pool server-balance { type = load-balance home_server = server01 home_server = server02 } realm DEFAULT { pool = qns-balance nostrip } ----- end proxy.conf ---------- So then I tried to edit the radiusd.conf with virtual servers and that broke our basic setup; ---- start new radiusd.conf with virtual servers --- prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib64/freeradius pidfile = ${run_dir}/${name}.pid user = radiusd group = radiusd max_request_time = 30 cleanup_delay = 5 max_requests = 1024 server default { listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf } server alt { listen { type = auth ipaddr = * port = 1815 } listen { ipaddr = * port = 1816 type = acct } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ ---- end radiusd.conf ----- What would happen is that the radiusd requests wheren't being proxies any more, freeradius was trying to authenticate the user --- output from radiusd -X ---- rad_recv: Access-Request packet from host 192.168.180.110 port 58754, id=13, length=112 User-Name = "tuser10104" User-Password = "password" Calling-Station-Id = "00-90-4b-13-a3-8a" Acct-Session-Id = "1000" Framed-IP-Address = 70.3.0.99 Cisco-Service-Info = "Time 0, Content 0" NAS-IP-Address = 192.168.181.29 server default { WARNING: Empty section. Using default return values. No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. } # server default Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 13 to 192.168.180.110 port 58754 Waking up in 4.9 seconds. Cleaning up request 0 ID 13 with timestamp +20 Ready to process requests. ---- end output ----- I even tried to add virtual_server = default to the proxy.conf but that didn't seem to work either... Sorry I am probably making this more difficult then it needs to be, but again I simply want to use freeradius as a load balancer / proxy server. Thanks, Brian Carpio -----Original Message----- From: freeradius-users-bounces+bcarpio=broadhop.com@lists.freeradius.org [mailto:freeradius-users-bounces+bcarpio=broadhop.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, December 17, 2010 9:31 AM To: FreeRadius users mailing list Subject: Re: Reals Based Upon Port Brian Carpio wrote:

Thanks for the reply, here is what I am trying to do

External Servers Send Requests To - 1812,1813 --- FreeRadiusd -- Backend_Servers_Set01 (1812,1813) External Servers Send Requests To - 1815,1816 -- FreeRadiusd -- Backend_Servers_Set02 (1815,1816)

I guess I am not sure where the listen section goes?

radiusd.conf. Or, read raddb/sites-available/README

Maybe I removed it from my proxy.conf file?

No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Thanks this is working perfectly now! -----Original Message----- From: freeradius-users-bounces+bcarpio=broadhop.com@lists.freeradius.org [mailto:freeradius-users-bounces+bcarpio=broadhop.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, December 17, 2010 1:32 PM To: FreeRadius users mailing list Subject: Re: Reals Based Upon Port Brian Carpio wrote:

Thanks for your help Alan, but I think I am not giving you the right information.. (that or I don't understand the README)

So we are using freeradius for proxying requests to different backend servers only (basically using freeradius as a load balancer), we aren't using it to actually authenticate users at all, when we simply wanted to listen on 1812 and 1813 and proxy to multiple home_servers on 1812 and 1813 everything works fine

So set "Proxy-To-Realm" manually. The "virtual server" sections need to be little more than: server x { listen { type = ... ipaddr = ... } authorize { update control { Proxy-To-Realm := 'x" } } preacct { update control { Proxy-To-Realm := 'x" } } } Really. That's *it*. Fill in the "listen" config. Define the realms, and use the ~20 lines of text above. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html