is it possible to have an OR statement in freeradius check attributes?

I have say 10 VPN servers that authenticate from freeradius. Most users can access all servers but I have a demo user that can only access 2 of those servers.

I can set this up so that the demo can only access 1 of the servers by putting the following in the radcheck table/users file


But I need to have and OR statement in there like:

NAS-IP-Address==xxx.xxx.xxx.1 OR xxx.xxx.xxx.2

Is this possible in freeradius?

  • 1
    You could have a fallthrough I think..
    – NickW
    May 30, 2013 at 16:16

2 Answers 2


You can use the =~ operator, and a regex xxx.xxx.xxx.1|xxx.xxx.xxx.2

Reference: http://freeradius.1045715.n5.nabble.com/Logical-OR-with-Check-Attributes-td3265998.html

  • you sir are a star! May 30, 2013 at 16:22
  • Nah, just someone with freeradius experience, and a knack with google :)
    – NickW
    May 30, 2013 at 16:25
  • @user1167223 remember to mark it as resolved.. :)
    – NickW
    May 30, 2013 at 16:41
  • done, couldnt do it before, it insisted I waited 10 mins and I had to go out :) May 30, 2013 at 20:57

It's only on freeradius 2.x can work.

On 3.x can't use.

(1) sql: ERROR: Error parsing value: Failed resolving "=xxx.xxx.xxx.1|=xxx.xxx.xxx.2|=xxx.xxx.xxx.3|=xxx.xxx.xxx.4" to IPv4 address: Name or service not known (1) sql: ERROR: Error parsing user data from database result (1) sql: ERROR: Error getting check attributes


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .