User-manager and Firewall rule, auth on external AP

RouterOS General
1

Hello,

I successfully configured a network infrastructure with a Mikrotik Router acting as a Radius server (thanks to the user-manager package) and an OpenWRT Wifi AP with EAP-TLS authentification.

The Mikrotik router is acting as a DHCP server for the whole network.

Once the authentication has been made on the Wifi AP, I would like to automatically set a couple of rules linked to the user. This allow me to fine-tune the access of each user on different resources of the network (server, web services, internet access etc.)

I’ve seen in user-manager documentation that there is a “Mikrotik-Address-List” field.

Ideally, after the session has been opened on the radius server, I would like to:

  1. Retrieve the IP address of the freshly connected user
  2. (optional) Deliver a specific IP address for some users
  3. Add this IP to multiple addresses list in the firewall (let’s say: list-internet-access and list-streaming-access). The firewall already have a specific list of rule for this address list

As I’m not using the hotspot feature of Mikrotik, I would like to know how I can make this setup to work.

So basically, I’m trying to do an ACL system using EAP/Radius auth. Maybe there is another way to achieve that?

Thanks

2

I am using MIkroTik User Manager as RADIUS server for WPA3-Enterprise with EAP-PEAP authentication together with UniFi access points, but instead of doing what you described with the individual IP addresses and address lists, I simply put the WiFi users in different VLANs, based on their account (based on their groups).

Here is a screenshot from my User Groups table:

image
image982×356 21 KB

Using those three attributes supported by almost everyone, the Tunnel-Private-Group-ID attribute has the VLAN ID that I assigned to the user group.

The hybrid (because with UniFi untagged VLAN is for management) links to the APs should of course carry all those VLANs as tagged.

There is no scripting required, the WiFi users are put in the selected VLANs, and I can apply any restrictions needed per VLAN.