Mikrotik equipment behind a NAT router and communication to a radius server

RouterOS General
1

Hi,

I have found an interesting problem with the current mikrotik OS (6.28). Here are some scenarios:

Scenario 1:
Mikrotik 1 IP: LAN:192.168.88.1 / WAN: <PUBLIC IP 1>
FreeRadius server IP: <PUBLIC IP 2>

Scenario 2:
Mikrotik 1 IP: LAN:192.168.88.1 / WAN:192.168.1.20
ADSL Modem IP: LAN: 192.168.1.1 / WAN: <PUBLIC IP 1>
FreeRadius server IP: <PUBLIC IP 2>

If I use Scenario 1: Radius authentication works fine. The Radius attribute NAS-IP-Address uses <PUBLIC IP 1> and the Radius can communicate back to this ip address.

If I use Scenario 2: Radius authentication fails with “NAS not found”. Pinging the radius server from the MikroTik gives success. Doing a wireshark trace on the packets being sent back and forth shows that the NAS-IP-Address is using MikroTik’s WAN IP which is 192.168.1.20. The radius server receives this value but is mismatched in the NAS database. Creating a NAS in FreeRadius with this IP would not help either because the radius cannot send it messages back to that address as it is a private ip address.

I do not see any way to force the NAS-IP-Address to value of my choice. If I
could, then I would set it to the current WAN IP of the ADSL modem in this scenario and everything would be fine. I have set up the ADSL modem so that the DMZ points to MikroTik’s WAN IP.

Suggestions?

Quinn

2

If you have access to solution #1, I’d suggest using it anyway. This RADIUS issue is but the tip of the iceberg.
Double nat breaks things in subtle and hard-to-find ways.

As for pursuing situation #2 academically -
I haven’t heard of a NAT protocol helper for RADIUS (not saying none exists) but that’s the kind of thing that would be required, or else a NAT-aware RADIUS daemon which could note the packet headers’ src-IP… I’m skeptical that you’re going to find a solution to this problem that will work with RAD through SRC nat.
(I’ve made it work through DST nat where the SERVER was behind NAT, but never the clients)

3

Interestingly, Cisco has built in support for changing the NAS-IP-Address for situations like this:

http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_rad_nas_ip_cfg.html

Quinn