pfSense » pfSense Plus

I Should mention you can use my modifcation afterwards by creating the groups identifier and IP pool needed, by creating a "EAP Shared Secret" with an IP Pool.

If you return your created identifier with the "Class" attribute from Radius, the user is assigned an IP from your new custom pool.

You can read the more elaborate explanation on my modification here: https://forum.netgate.com/topic/172476/a-guide-to-assign-vpn-group-and-user-ip-pool-from-radius-in-22-01-2-6

I posted in the netgate forum about this functionality and got redirected to this record.

https://forum.netgate.com/topic/174957/ipsec-vpn-radius-authentication-via-nps-using-class-property-returned-by-radius-in-firewall-rules

To make this work, it requires manual modifications of the /etc/inc/ipsec.inc file, not surviving any pfSense update.

I post my comment here to give more weight to this feature request.

I'm respectfully requesting an out-of-the-box solution by extending the GUI to configure such scenarios, with the goal to not to loose such configurations after an update.

I very much hope to see this in an upcoming version. We currently have to use openvpn instances or full pfSense instances to have multiple “types” of mobile client's, but radius assigned IP pools for ipsec is really what we need. I am borderline considering pathing the proposed solution, but obviously can't really do that in production. Really looking forward to a solution here.

Christopher de Haas wrote in #note-3:

I very much hope to see this in an upcoming version. We currently have to use openvpn instances or full pfSense instances to have multiple “types” of mobile client's, but radius assigned IP pools for ipsec is really what we need. I am borderline considering pathing the proposed solution, but obviously can't really do that in production. Really looking forward to a solution here.

Thank you for upvoting this request. It’s baffeling that pfSense does not have this feature yet - I have been asking for years about it because this is the number one reason why I have to install other products than pfSense at different customers.
It may not change your position, but I have about 25 customers using my fix to allow IP-pools use in Mobile IPSec VPN, and it really works beautifully. The “hack” does not influence anything else, and it remains solid regardless of restarts and what not. The only thing that disables it is a version upgrade/reinstall of pfSense itself. Then you have to reapply the fix.
I don’t expect this feature to surface in pfSense any time soon as the initial interest Netgate showed has faded away with the challenges of migrating to FreeBSD 14 and PHP 8.1
But maybe someday - who knows. Until then this is an “easy to use” way of getting what we all need.

@Netgate - is there zero chance of this simple but VERY usefull feature to surface in pfSense? Some of your people have shown a lot of interest in bringing it to production, but have since then forgotten it. I don’t understand how such a VITAL feature for any firewall VPN solution is missing in pfSense.

we're looking at sneaking this in for 24.03

I started down the path of including this using the key identifier and using the identifier as the 'groups' value instead of 'id' if group auth was selected, but I wasn't happy with it. I've instead implemented a separate tab dedicated to defining group pools. It is a bit rudimentary because I haven't refactored out the root mobile config, so at least one group pool must be properly defined using the group selection and pool definition in the mobile ipsec tab. The also user must take care to not alias groups, or unexpected configuration behavior can result. Short of a complete refactoring of the strongswan conf generation I think this strikes a good balance of usability without drastically overhauling the code. The change is under review and should be present in 24.03-BETA.

This a fabulous ♥️ Unfortunately I’m away for a couple of weeks right now, so I won’t be able to participate in betatesting until I’m back. But I’m sure it’s solid as my former fix worked very well - so I assume this will likewise work as intended.

Tue Madsen wrote in #note-11:

This a fabulous ♥️ Unfortunately I’m away for a couple of weeks right now, so I won’t be able to participate in betatesting until I’m back. But I’m sure it’s solid as my former fix worked very well - so I assume this will likewise work as intended.

I'm hoping it's even more useful, as better validation is also being introduced to prevent pool and group collisions to help alleviate some of the confusing invalid configurations that could be generated in the past (and could have been introduced by another source of connections and pools). I'll look forward to seeing your feedback.

I am having issues creating multiple groups. I just installed the plus 24.03 RC last night on my box at home so I can test this feature. We have been waiting for this for some time since we have a lot of remote workers who connect over VPN for various reasons. The error I get is below. Even though the group names and subnets are not even similar.

The following input errors were detected:

Another entry with the same group(s) already exists.

Can you guys recreate this?

Thanks for testing! Try it with this patch: ShowHide

diff --git a/src/usr/local/www/vpn_ipsec_groups_edit.php b/src/usr/local/www/vpn_ipsec_groups_edit.php
index bb08e866add3a76bfa5bee4c9e0ef37a039bd782..8c295514fd2d8a84a65bbf3f619f5830d499677b 100644
--- a/src/usr/local/www/vpn_ipsec_groups_edit.php
+++ b/src/usr/local/www/vpn_ipsec_groups_edit.php
@@ -65,7 +65,7 @@ if ($_POST['save']) {
                 continue;
             }

-            $mgent_groups = array_map(fn($el) => trim($el), explode(",", $_POST['ident']));
+            $mgent_groups = array_map(fn($el) => trim($el), explode(",", $mgent['ident']));
             if (sizeof(array_intersect($groups, $mgent_groups)) > 0) {
                 $input_errors[] = gettext("Another entry with the same group(s) already exists.");
                 break;

That worked perfectly. Thank you guys!