Radius simultaneous connection problem

virinom

I'm trying to set-up OpenVPN server with radius authentication and accounting. Basics are working. Users can authenticate to OpenVPN server with their Radius accounts but there is a problem about simultaneous connection which i couldn't fix. Also I don't have any clue about cause of problem.

The problem is Simultaneous-Use attribute is not working at all. If two clients try to connect with same username infinite loop starts. When Client #2 tries to connect while Client #1 already connected, server disconnects Client #1 and connects Client #2. Just after Client #2 connected, Client #1 tries to reconnect and disconnects Client #2. It keeps going like that forever. In correct situtation, server should block Client #2 from connecting if Client #1 is connected.

port 443
proto tcp
dev tun
server 10.8.0.0 255.255.255.0
ca /etc/openvpn/ssl/ca.crt
cert /etc/openvpn/ssl/EntityName.crt
key /etc/openvpn/ssl/EntityName.key
dh /etc/openvpn/ssl/dh.pem
crl-verify /etc/openvpn/ssl/crl.pem
tls-auth /etc/openvpn/ssl/ta.key 0
plugin /etc/openvpn/radius/radiusplugin.so /etc/openvpn/radius/radius.cnf
username-as-common-name
ifconfig-pool-persist ipp.txt
client-config-dir /etc/openvpn/ccd
persist-key
persist-tun
keepalive 10 60
reneg-sec 0
tun-mtu 1468
cipher AES-256-CBC
tun-mtu-extra 32
mssfix 1400
push "persist-key"
push "persist-tun"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
status /var/log/openvpn/status.log 1
log-append /var/log/openvpn/openvpn.log
verb 3
client-connect /etc/openvpn/statuschange.sh
client-disconnect /etc/openvpn/statuschange.sh
script-security 2
management 127.0.0.1 7777

subnet=255.255.255.0
overwriteccfiles=true
useauthcontrolfile=false
accountingonly=false
nonfatalaccounting=false
server
{
acctport=1813
authport=1812
name=OpenVPN server ip.
retry=1
wait=1
sharedsecret=MySecret
}

bbuckm

Isn’t it working the way it’s supposed to work?

--duplicate-cn
Allow multiple clients with the same common name to concurrently connect. In the absence of this option, OpenVPN will disconnect a client instance upon connection of a new client having the same common name.

TinCanTech

Maybe you can edit your server config .. I don't see --duplicate-cn in there ?

virinom

TinCanTech wrote Maybe you can edit your server config .. I don't see --duplicate-cn in there ?

bbuckm wrote Isn’t it working the way it’s supposed to work?

--duplicate-cn
Allow multiple clients with the same common name to concurrently connect. In the absence of this option, OpenVPN will disconnect a client instance upon connection of a new client having the same common name.

Thanks for replies. I can't believe myself i forgot that option 🙂
It fixed part of issue. Now 2 clients can connect with same username even if Simultaneous-Use := 1 in radius. For "virinom" username here is radcheck row

username | attribute | op | value
----------------------------------------------------------
virinom | Simultaneous-Use | := | 1

And here is radacct rows for both connections

username | nasportid | nasporttype | acctstarttime | acctstoptime
--------------|--------------------------------------------------------------------------------------
virinom | 1 virtual 2018-05-07 12:15:23 NULL
virinom | 2 virtual 2018-05-07 12:15:59 NULL

nembulus

Hi,

is there any tutorial how to set up openvpn + freeradius ( mysql backend ) ?
i try it and not working.
thanks in advanced

Regards,
Franky