Feature #13227


Enable IPSec Virtual IP Pool assignment by Radius for Mobile Users - SIMPLE FIX

Added by Tue Madsen 10 months ago. Updated 6 months ago.

Target version:
Start date:
Due date:
% Done:


Estimated time:
Plus Target Version:
Release Notes:


Currently you cannot create additional Virtual IP Pools to assign mobile users IP addresses from, if you are using EAP-Radius as the authentication source.
This prohibits using different firewall rules for different groups of users.
Everyone is treated the same, unless you specifically assign a static IP to a specific user from Radius via framed-ip-address - which is NOT scalable.

But all the logic is enabled in strongswan, and the GUI settings to swanctl.conf scripts already has enabled the groups features in strongswan, so it will accept the "Class" attribute from Radius as a groups identifier.

There just needs to be a way to create a groups identifier in the GUI with an attached IP Pool that is written correctly to the config files.

By hacking /etc/inc/ I have enabled this by asking the "preshared secrets" GUI part to write an EAP Shared secret as a "groups" in the remote section instead of an "id".
All I did is the following edit in /etc/inc/":
Locate the major section called: "/***f ipsec/ipsec_setup_userpools" about halfway into the file.
Locate the line: "$scconf['connections'][$upconn]['remote']['id'] = $clientid;"
Change it to "$scconf['connections'][$upconn]['remote']['groups'] = $clientid;"

Once that is done, if you enable "group authentication" on your mobile clients settings, groups identifiers returned with the "Class" attribute is respected, and the user is assigned an IP from the custom pool. Default users are still assigned IPs from the default mobile warrior pool if the Radius return the group(s) name selected in the mobile clients setup.

A very quick fix to this issue would be to add a new "Groups" tab in IPsec where you can add a group identifier and the IP Pool to use for that group. It can use most of the same script parts from "/***f ipsec/ipsec_setup_userpools" in - it just needs to create the line in the remote part of swanctl.conf with 'groups' instead of 'id'.

Actions #1

Updated by Tue Madsen 10 months ago

I Should mention you can use my modifcation afterwards by creating the groups identifier and IP pool needed, by creating a "EAP Shared Secret" with an IP Pool.

If you return your created identifier with the "Class" attribute from Radius, the user is assigned an IP from your new custom pool.

You can read the more elaborate explanation on my modification here:

Actions #2

Updated by Tom Huerlimann 6 months ago

I posted in the netgate forum about this functionality and got redirected to this record.

To make this work, it requires manual modifications of the /etc/inc/ file, not surviving any pfSense update.

I post my comment here to give more weight to this feature request.

I'm respectfully requesting an out-of-the-box solution by extending the GUI to configure such scenarios, with the goal to not to loose such configurations after an update.


Also available in: Atom PDF