Discriminating request between internal and external of the tunnel

[Fabio]

Hi,
I am using radius for authorize/authenticate wireless users using PEAP and TTLS.
I want to autenticate the users using the information in the tunneled request to a MySQL server. The problem is that freeradius try to authorize also the request outside of the tunnel, that contains an anonymous identity.

I am now using the check "Freeradius-Proxied-To == 127.0.0.1" in the file users for determining when a request is inside the tunnel (this attribute is present) and when is outside (the attribute is not present).

Is this the right way to do this or there is a better way?

Thanks.