Use RADIUS Accounting for Per User Customization

sokolum

Using OpenVPN VMWARE image and for authentication using RADIUS.

Now OpenVPN is limited what i can do per user for VPN connection, like which Subnets a user is allowed to connect is a Global configuration and not per users.

I tried to find out if it is possible to tell per user with Radius Accounting which Private/Public Subnet it can connect or Not. Or one user can only have internet access.

Is it also possible with Radius Reply-Items to Specify Users IP address?

xauen

You can check out this thread from bebop https://forums.openvpn.net/topic8559.html

sokolum

xauen wroteYou can check out this thread from bebop https://forums.openvpn.net/topic8559.html

Thank yo for pointing out to that topic, very interesting. Will keep as a fallback.

But still i doesn't answer if it is possible to use Radius instead.

xauen

As for the radius you can have the client-connect / -disconnect script do an sql query in the radius sql server like:

Client connect:

subnet='mysql -u $user -p$pass -h $hostname "SELECT radcheck.subnet FROM radcheck WHERE radcheck.username = $common_name"; $dbname'

iptables -t nat -A POSTROUTING -s 10.8.1.0/24 -j SNAT --to-source $subnet

Client disconnect:

subnet='mysql -u $user -p$pass -h $hostname "SELECT radcheck.subnet FROM radcheck WHERE radcheck.username = $common_name"; $dbname'

iptables -t nat -D POSTROUTING -s 10.8.1.0/24 -j SNAT --to-source $subnet

Make sure you add in the server configs "username-as-common-name"
Note: sql query might not be accurate but logic is there already. You just need to fill in the variable info.