How to configure a freeradius server to require NAS-IP-Address attribute?

StackOverflow https://stackoverflow.com/questions/21944862

  •  14-10-2022
  •  | 
  •  

Question

I want to configure a freeradius server in the way that an authentication is successful only if NAS-IP-Address attribute is not empty and equals to some specific IP (of course a user name and a password match).

How should I do it? I have tried to read the documentation without success: http://freeradius.org/rfc/attributes.html http://freeradius.org/rfc/rfc2865.html#NAS-IP-Address

Was it helpful?

Solution

Sure, there are many ways of doing this.

authorize {
   if (!NAS-IP-Address) {
       reject
   }

   if (NAS-IP-Address != 192.168.0.2) {
      reject
   }

   if ("%{sql:SELECT count(*) FROM table WHERE User-Name = '%{User-Name}' AND IP-Address = '%{NAS-IP-Address}'" == 0) {
      reject
   }
}

In v3.0.x subnet matching is also supported, where < > are reassigned to mean the set operators (< subset of) (> superset of).

if (!(<ipv4prefix>NAS-IP-Address < 192.168.0.0/16)) {
    reject
}

NAS-IP-Address = 192.168.0.2

(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16) 
(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16)  -> TRUE

NAS-IP-Address = 192.169.0.2

(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16) 
(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16)  -> FALSE
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top