Bug #12076
closed
OpenVPN RADIUS-based firewall rules do not use expected value for RADIUS-assigned IP addresses
Added by Florian Lourdault about 3 years ago.
Updated over 2 years ago.
Plus Target Version:
22.01
Description
Current OpenVPN script implemented to trigger Cisco-AVPair ACL in PF chains allows the {clientip}
syntax to match IP address of the client initiating the VPN connection.
The script (/usr/local/sbin/openvpn.attributes.sh
) relies on ${ifconfig_pool_remote_ip}
variable passed from OpenVPN to generate a PF rule (temporary file) to later insert in PF running configuration.
For some reason the IP address returned by the OpenVPN pool is not the same as the Framed-IP-Address indicated by Radius (see screenshots). I also dumped variables passed by OpenVPN to the script and none contains the Framed-IP-Address.
The workaround I implemented on my pfsense was to replace the {clientip}
substitution pattern while processing /etc/inc/util.inc
if a framed_ip is set in attribute.
Files
- Status changed from Pull Request Review to Feedback
- Assignee set to Renato Botelho
PR has been merged. Thanks!
- Target version set to 2.6.0
- Plus Target Version set to 21.09
- Subject changed from OpenVPN + Radius + Framed-Ip-Address + Cisco-AVPair: clientip != framedip to OpenVPN RADIUS-based firewall rules do not use expected value for RADIUS-assigned IP addresses
Updating subject for release notes.
- Plus Target Version changed from 21.09 to 22.01
Tested on 22.01-DEVELOPMENT (built on Sun Oct 31 05:21:32 UTC 2021)
Neither Windows 10, nor Ubuntu 21.10 were able to get correct Framed-IPv4/IPv6 addresses with active OpenVPN tunnel - in both cases IP-addresses were just random IPs from OpenVPN pool.
For example I created 'vpnuser' (vpnuser_IPv4_and_IPv6_attributes.png) with:
- IPv4 address: 10.99.11.11
- IPv6 address: 2001:db8:99::11,
but when I connected from Ubuntu 21.10 I got IPv4: 10.99.11.16 and IPv6: 2001:db8:99::100e (ifconfig_Ubuntu.png).
In PCAP I caught traffic between pfSense and FreeRadius and I saw that FreeRadius sent Framed-IP-address and Framed-IPv6-address I configured (pcap_with_radius.png)
In OpenVPN log on pfSense I saw nothing about Framed-IPs, and I wasn't able to see it in OpenVPN log on Windows as Florian saw according to his screenshot (pfsense_ovpn-radius-framedip.png)
- Status changed from Assigned to Feedback
The above commit has been reverted. Please test this issue again on the next new snapshot, or on a snapshot with that commit reverted.
- Has duplicate Bug #12497: OpenVPN Server assignes random IPv4 addresses to active clients even if FreeRadius has configured Framed-IP for all these remote clients added
- Status changed from Feedback to Resolved
Also available in: Atom
PDF