I have FreeRADIUS installed on my server, and also have two LANs (or may be more) managed by this server. Let's say LAN A:, and LAN B: I'm using FreeRADIUS in combination with postgres database. In my radcheck table I have inserted the following row:

userbane='myuser', attribute='Password', op=':=', value='mypass'.

Now I want to let the clients that will request services from my FreeRADIUS to be able to authenticate themselves with this username and password only if they are part of LAN B.

Question: Can anyone suggest me how to get this done?

I tried to put in the radcheck one row more: username='myuser', attribute='NAS-IP-Address', op=':=', value='', but without success.

Any help would be appreciated.


I haven't used a database backend before, but using the users file the rule would look something like this:

myuser  Cleartext-Password := "mypass", NAS-IP-Address == ""

Based on that, I think you need two entries in the radcheck table:

usernane='myuser', attribute='Password', op=':=', value='mypass'
username='myuser', attribute='NAS-IP-Address', op='==', value=''
  • 1
    Thanks! the tip was '==', taking in account that instead of it I put ':='. – artaxerxe Jun 19 '12 at 5:11

Using an SQL database, I solved this by :

1) Adding a special row (site_id)

ALTER TABLE radcheck ADD site_id VARCHAR(30) NOT NULL default '' AFTER value;

2) Modifying /etc/freeradius/sql/mysql/dialup.conf as follow

authorize_check_query = "SELECT id, username, attribute, value, op, site_id, valid_from, valid_until \
  FROM ${authcheck_table} \
  WHERE username = '%{SQL-User-Name}' AND site_id='%{NAS-Identifier}' \
  ORDER BY id"

In my case I used the NAS-Id, but replacing %{NAS-Identifier} by %{NAS-IP-Address} and optionally site_id by site_ip will do the trick with an IP address

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.