This virtual server is an example, and should not be enabled as-is.
To enable dynamic clients in an existing virtual server, copy the
"dynamic_clients" sub-section of the "udp" listener from the below
example. Then copy the "new client", "add client", and "deny
client" sub-sections into the virtual server. Set dynamic_clients
= yes in the listener, and then the virtual server will be enabled
for dynamic clients.
When clients are added to a listener, they exist ONLY for that listener. Dynamic clients can process packets ONLY through the virtual server in which they are defined. Unlike v3, you CANNOT define a global client, and point it to a different virtual server,
See the "default" virtual server for examples of how to configure a "listen" section. Only the "dynamic_clients" changes are documented here.
Limits for this socket.
Limit the number of dynamic clients which can be defined.
If there are no dynamic clients, this configuration item is ignored.
The special value of "0" means "no limit". We do not recommend this.
Limit the total number of connections which used. Each connection opens a new socket, so be aware of system file descriptor limitations.
If the listeners do not use connected sockets, then this configuration item is ignored.
Free a dynamic client, or close a connection if it does not receive a packet within this time.
Useful range of values: 5 to 600
- nak_lifetime
-
Time for which blocked clients are placed into a NAK cache.
If a dynamic client is disallowed, it is placed onto a "NAK" list for a period of time. This process helps to prevent DoS attacks. When subsequent packets are received from that IP address, they hit the "NAK" cache, and are immediately discarded.
After nak_timeout seconds, the blocked
entry will be removed, and the IP will be
allowed to try again to define a dynamic
client.
Useful range of values: 1 to 600
cleanup_delay: The time to wait (in seconds) before cleaning up a reply to an Access-Request packet.
The reply is normally cached internally for a short period of time, after it is sent to the NAS. The reply packet may be lost in the network, and the NAS will not see it. The NAS will then resend the request, and the server will respond quickly with the cached reply.
If this value is set too low, then duplicate requests from the NAS MAY NOT be detected, and will instead be handled as separate requests.
If this value is set too high, then the server will use more memory for no benefit.
Useful range of values: 2 to 10
Whether or not we allow dynamic clients.
If set to true, then packets from unknown clients are passed through the "new client" subsection below. See that section for more information.
If dynamic clients are allowed, then limit them to only a small set of source networks.
If dynamic clients are not allowed, then this section is ignored.
Allow packets from these networks to define dynamic clients.
Packets from all other sources will be rejected.
Even if a packet is from an allowed network, it still must be configured by the "new client" subsection.
There is no limit to the number of networks which can be listed here. Networks are put into a patricia trie, so lookups are fast and efficient.
The default is to deny all networks which are not in the "allow" list.
However, it may be useful to allow a large range, and then deny a subset of IPs in that range. For that situation, use a "deny"
In this example, 127.0.0.1 can be used to define a dynamic client. But the (hypothetical) 127.1.0.1 address cannot be used to define a dynamic client.
When a request is received from an unknown client, it is initially passed through this 'new client' section to determine whether to add the client or not.
This section should define the client fields as attributes,
and return ok to add the client.
If this section returns fail, then the client is denied.
Put any modules you want here. SQL, LDAP, "exec", Perl, etc. The only requirements is that the attributes to define a new client MUST go into the control list.
The packet received here is a complete, normal, packet. All attributes are decoded and available. However, all attributes that depend on the shared secret (e.g. User-Password, etc.) are blank.
Example 1: Hard-code a client IP. This example is useless, but it documents the attributes you need.
Copy the IP address of the client from the request just received
require_message_authenticator
shortname
nas_type
This subsection is called when the client was added.
The main purpose of this section is to enable logging when a client is added.
If this section is empty, you can just delete it entirely.
This subsection is called if the client was NOT added.
The main purpose of this section is to enable logging when a client is denied.
If this section is empty, you can just delete it entirely.
After client is added, the packet is run through the normal processing sections
Default Configuration
# Sample configuration file for dynamically updating the list
# of RADIUS clients at run time.
# Everything is keyed off a client "network" (for example,
# 192.168.0.2/24). This configuration lets the server know that
# clients within that network are defined dynamically. The
# network limitation also ensures that the server accepts
# dynamic client requests from only a limited, "local" network.
# When the server receives a packet from an unknown IP address
# within that network, it tries to find a dynamic definition
# for that client. If the definition is found, the IP address
# (and other configuration) is added to the server's internal
# cache of "known clients", with a configurable lifetime.
# Further packets from that IP address result in the client
# definition being found in the cache. Once the lifetime is
# reached, the client definition is deleted, and any new
# requests from that client are looked up as above.
# If the dynamic definition is not found, then the request is
# treated as if it came from an unknown client, i.e. it is
# silently discarded.
# The server has a negative cache for denied dynamic clients.
# Once a client is denied, it is added to the negative cache,
# and all packets from that source IP are rejected for 30s.
server dynamic_clients {
namespace = radius
listen {
type = Access-Request
transport = udp
limit {
max_clients = 256
max_connections = 256
idle_timeout = 60.0
nak_lifetime = 30.0
cleanup_delay = 5.0
}
udp {
ipaddr = 127.0.0.1
port = 2812
dynamic_clients = true
networks {
allow = 127/8
allow = 192.0.2/24
deny = 127.1/16
}
}
}
new client {
&control += {
&FreeRADIUS-Client-IP-Address = "%{Net.Src.IP}"
&FreeRADIUS-Client-Require-MA = no
&FreeRADIUS-Client-Limit-Proxy-State = "auto"
&FreeRADIUS-Client-Secret = "testing123"
&FreeRADIUS-Client-Shortname = "%{Net.Src.IP}"
&FreeRADIUS-Client-NAS-Type = "other"
}
ok
}
add client {
ok
}
deny client {
ok
}
recv Access-Request {
accept
}
}