Freeradius Mikrotik Mysql

RouterOS General
1

I want to control the access to my Mikrotik APs. I’m using freeradius to do that. The clients are configured with only SSID and static IP address ( no hotspot). I’ve put the mac of every client to the radcheck table

id UserName Attribute op Value ClientName
1 xx:xx:xx:xx:xx:xx Auth-Type = Accept xxx

and the authentication is ok. But when I put Reject as a Value the client remains connected. I have to disconnect it manually so it cannot connect again (delete from the Registration Table of the AP).

How can i manage this to be done automatically. Do I have to configure the database differently?

thanks in advance
Adi

2

Maybe I don’t understand your setup. What service is using the radius server for authentication? If you could show me “/radius print” from that box, maybe I could help.

3

[admin@pn-hq] > radius print
Flags: X - disabled

SERVICE CALLED-ID DOMAIN ADDRESS SECRET

0 wireless radius ip xxxx

4

Have you used radtest on your radius server to see what it is returning?
radtest user password 127.0.0.1 0 radiussecret
Substitute the mac address for the user.
If it returns
rad_recv: Access-accept packet from host 127.0.0.1:1812, id=xxx, length=yyy
from the radius server, it will probably allow a connection.

5

Sending Access-Request of id 217 to 127.0.0.1 port 1812
User-Name = “xx:xx:xx:xx:xx:xx”
User-Password = “password”
NAS-IP-Address = 255.255.255.255
NAS-Port = 0
rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=217, length=20

6

That response will allow a connection. Something is not set correctly in the RADIUS server. If you remove the mac address from the RADIUS database, does it respond with Access-Reject?

7

well everything works ok when I put accept, but when i put reject the client doesnt disconnect. i have to delete it manually.

8

If the RADIUS server returns Access-Accept, the client will be able to connect. You need to work on your RADIUS server until it returns Access-Reject for that mac address.

I don’t use the Auth-Type attribute, but I think it should go in the radreply table maybe??? Just a guess tho…

9

I dont mind changing my configuration. all i wanna do is wireless authentication. so if you could help me with another configuration i would be glad to try

10

You have the hard part down already. :smiley: It is returning Access-Accept for the mac addresses entered in the RADIUS database, and Access-Reject for those not in the database, correct? All you need to figure out is how to get your RADIUS server to return Access-Reject for those in the database that haven’t paid their bill. I will presume that is why you want this working.

Have you tried the Auth-Type attribute in the radreply table yet?

11

so you’re telling me to put the username=mac attribute=Auth-type and Value=reject at the radreply table. what should i put at the radcheck table ?

12

I am not certain about the table, but you have confirmed it does not work in radcheck, correct? If it returns Access-Accept, it is not working. You need to play with your RADIUS tables until radtest returns Access-Reject for that mac address.

ADD: I would try leaving the mac address in radcheck. That way you don’t have to remember it and re-enter it later. I do about the same here, but with the hotspot and a date/time expiration. :smiley:

ADD2: You might want to consider changing the password on the accounts you want to reject. Set the password to “baduser” or something like that. Guaranteed to generate that Access-Reject!

13

I normally don’t double-post, but I wanted you to see this. The radcheck table is the correct table for the Auth-Type. I just checked it on mine.

I used this in MySQL radius database shell:
insert into radcheck (UserName,Attribute,op,Value) values (‘SurferTim’,‘Auth-Type’,‘:=’,‘Reject’);

and it rejected me until I removed it. Note the op is a colon and equal sign :=

14

In mine I’ve put only equal sign = to the op. I’m gona try it now

15

Also check to see that it is the only Auth-Type assigned to that UserName. It uses the first one it comes to…

16

I tried that but the user remained connected. i had to delete it from the registration table at mikrotik to force him do another authentication and be rejected.

17

I think that once the user has been connected it doesnt request authentication anymore. So the radius has to tell the mikrotik to disconnect that user or it will remain connected. what configuration should be done in mikrotik and in radius to do that

18

this command disconnects the user successfully
echo “User-name=xx:xx:xx:xx:xx:xx” | radclient -x NasIP:Nasport disconnect secret


any way to turn this into a script that asks only for the username and sends same POD to different NAS ?

For example

send “echo “User-name=xx:xx:xx:xx:xx:xx” | radclient -x NAS-1:port disconnect secret”
if reply " Error-Cause = Session-Context-Not-Found"

send “echo “User-name=xx:xx:xx:xx:xx:xx” | radclient -x NAS-2:port disconnect secret”
if reply "rad_recv: Disconnect-ACK packet from host NAS-2:port, id=24, length=36
NAS-Identifier = “MikroTik”
NAS-IP-Address = NAS-2
stop

19

After a little research, I was going to suggest trying
/interface wireless security-profiles
set default radius-mac-authentication=yes

…and if that doesn’t work by itself, try setting
/interface wireless
set wlan1 default-authentication=no

20

I’ve set that before. It’s a must to make wireless authentications