Restrict FreeRADIUS clients to access service from different LANs with same user and password

freeradius2radius

I have FreeRADIUS installed on my server, and also have two LANs (or may be more) managed by this server. Let's say LAN A:192.168.1.0, and LAN B: 192.168.2.0. I'm using FreeRADIUS in combination with postgres database. In my radcheck table I have inserted the following row:

userbane='myuser', attribute='Password', op=':=', value='mypass'.

Now I want to let the clients that will request services from my FreeRADIUS to be able to authenticate themselves with this username and password only if they are part of LAN B.

Question: Can anyone suggest me how to get this done?

I tried to put in the radcheck one row more: username='myuser', attribute='NAS-IP-Address', op=':=', value='192.168.2.1', but without success.

Any help would be appreciated.

Best Answer

I haven't used a database backend before, but using the users file the rule would look something like this:

myuser  Cleartext-Password := "mypass", NAS-IP-Address == "192.168.2.1"

Based on that, I think you need two entries in the radcheck table:

usernane='myuser', attribute='Password', op=':=', value='mypass'
username='myuser', attribute='NAS-IP-Address', op='==', value='192.168.2.1'
Related Topic