Hi,
My config is as follows:
AP1 [RB433]
Wlan1: Link to AP2 [172.17.1.1/30]
Wlan2: Wireless distribution [no ip set]
AP2 [RB433]
Wlan1: Link to AP1 [172.17.1.2/30]
Wlan2: Wireless distribution [no ip set]
Proxy server set up on AP1.
NATed network with masquerade.
FreeRADIUS Authentication.
Client CPE connects via PPPoE
Situation 1:
Client CPE [RB411] connects to AP1 via Wlan2, gets IP 10.5.50.123 from RADIUS
On proxy on AP1 set deny all rule for IP 10.5.50.123 (to suspended client) and if client tries to access internet, client has been blocked successfully, no problem.
Situation 2:
Client CPE [RB411] connects to AP2 via Wlan2, gets IP 10.5.50.231 from RADIUS
On proxy on AP1 set deny all rule for IP 10.5.50.231 (to suspended client) and if client tries to access internet, client is NOT blocked.
It appears as if the proxy receives all “client” activity from AP2 as the IP address of Wlan1 on AP2 [172.17.1.2] and not from the client CPE IP.
How can i solve this? I do not want to set up another proxy on AP2 as i intend to remove the proxy on AP1 and use Squid Proxy along with some intelegent linux scripts and FreeRADIUS to set up client restrictions, suspensions, and access warnings. But i can not implement it as the Squid proxy would also be behind a router 2 hops removed from AP2.
Generally the routers/APs only NAT when you tell them to. If you’re seeing the wrong source IP somewhere upstream you have been using NAT when you didn’t really want to.
Unfortunately from your description it’s harder to be more specific. Adjust your source NAT rules on whatever routing is performing NAT for the client to not NAT traffic going to the proxy server. A good alternative would be to have a fully routed network (with full routes everywhere - OSPF could be useful here) and only perform source NAT on the very interface that connects to your upstream ISP. That way you always have the full, real IP address of the client anywhere within your network.
I finaly figured out how to solve my own problem. Apparently the problem is in the Masquerade. Masquerade will automatically include your router’s IP in all traffic headers. You need to switch on masquerade only on your WAN interface.
This setup involves a router with 3 LAN ports, one for WAN, one for Clients and one for Proxy. The principal they use is to route mark HTTP traffic and then set up a static route to the Proxy server. Then they switch off the masquerade on all interfaces except the WAN.