¶ Radius
¶ Overview
To configure general and advanced settings for RADIUS, navigate to Config → Networking → Radius.
¶ General
¶ Reject IP addresses
- Reject IP 0 - Reject IP range when a user is not found (real);
- Reject IP 1 - Reject IP range when a user is blocked, not active, or not in the system;
- Reject IP 2 - Reject IP range when a user has a negative balance or a filter is applied;
- Reject IP 3 - Reject IP range when a user has the wrong MAC address (if enabled) or other error;
- Reject IP 4 - Reject IP range when a user has entered the wrong password.
-
Reject IPv6 0 - Reject IPv6 range when a user is not found (real);
-
Reject IPv6 1 - Reject IPv6 range when a user is blocked, not active, or not in the system;
-
Reject IPv6 2 - Reject IPv6 range when a user has a negative balance or a filter is applied;
-
Reject IPv6 3 - Reject IPv6 range when a user has the wrong MAC address (if enabled) or other error;
-
Reject IPv6 4 - Reject IPv6 range when a user has entered the wrong password.
¶ NAS config
Select the NAS type you are going to use and click on the Load button. The NAS configuration options are stored separately for each NAS type, so they appear only after a type is selected and loaded. You can use a default type or create a new NAS type — for more information, see NAS types.
¶ MikroTik configuration
A new configuration section will appear:
- Prevent duplicate session - if a customer is online and tries to connect, it sends a disconnect package to the online session;
- Allow with a negative account balance - allows a connection when the account balance of the customer trying to connect is less than the specified minimum balance;
- Allow without IP/MAC - if disabled, IP/MAC will be checked during authorization, and if enabled, authorization will be allowed with any IP/MAC;
- MAC address field - different NAS routers can use different fields of MAC addresses, default is "Calling-Station-Id";
- Bind MAC on - choose a source for MAC binding when enabled 'Bind MAC address on first connect';
- Port ID attribute for PPP - the attribute is used for authorization of PPP connections via Port ID value;
- Port ID attribute for DHCP - the attribute is used for authorization of DHCP connections via Port ID value;
- Inverse rate limit - change rate limit of upload by download and vice versa;
- Inverse accounting - change accounting of upload by download and vice versa;
- Process accounting without IP - enables/disables processing of accounting without IP;
- Split session with zero accounting - enables/disables splitting of session to a new one if the accounting has sent zero in usage;
- Accounting interval (in seconds) - set time to update accounting. Recommended value is 300 sec, and minimal value is 60 sec;
- Accounting interval factor - set how many accounting intervals the system should wait to consider the customer online and begin accounting. Default = 2;
- Ignore processing traffic on accounting packet - if this option is enabled, traffic from radius accounting packets will be ignored, MikroTik API or another API accounting can be used;
- Ignore username and password for PPP - if enabled, login and password will be ignored for PPP connection. MAC address or Port ID values will be used for authorization;
- Activate service on first auth - activates a pending internet service the first time the customer's equipment authenticates and sets its billing start date to that day. Off by default. See Activate service on first auth
- Customer attributes field - specify the customer additional field which will be used to send RADIUS attributes. Used for RADIUS customization;
- Plan attributes field - specify the tariff additional field which will be used to send RADIUS attributes. Used for RADIUS customization;
- Rate-Limit attributes - list of rate-limit attributes. Recommended to keep default;
- Customer Block - when a customer's status is going to be "blocked", "inactive" and customer is online;
- CoA Block attributes - list of CoA block attributes. Please keep default;
- CoA Restore attributes - list of CoA restore attributes. Please keep default;
- Cards Rate-Limit attributes - list of rate-limit attributes. Please keep default;
- Radius incoming port - set port for incoming RADIUS;
- FUP CoA Rate-Limit attributes - list of FUP CoA rate-limit attributes. Please keep default;
- FUP Block - set FUP blocking type;
- FUP CoA Block attributes - list of FUP CoA block attributes. Please keep default;
- FUP CoA Restore attributes - list of FUP CoA restore attributes. Please keep default;
- Overwrite CoA IP - all CoA requests will be sent to this IP. Leave blank to use NAS-IP-address;
- Overwrite PoD IP - all PoD requests will be sent to this IP. Leave blank to use NAS-IP-Address;
- COA & POD parameters - send session ID with CoA & PoD requests;
- Use reject IP [0-4] - Enable this to use the IP's 0-4 explained in the first step.
- Reject [0-4] Attribute - list of attributes of reject pools;
-
Error session time limit - limitation of the session time (in seconds) in case of an authorization error, forcing users to reconnect after a time out (for customers that do not have any active services).
This is necessary in order that after activation, the customer received his address from Splynx, without manual reconnection on their part; -
Use admin login - when enabled, it allows logins to the router with administrator credentials;
-
Attribute for Read Group - specify the attribute for read group;
-
Attribute for Write Group - specify the attribute for write group;
-
Attribute for Full Group - specify the attribute for full group;
¶ Radius tools
There are two buttons at the bottom of the page to Restart radius and Clear all online sessions.
- Restart radius - will restart radius. Customer's connections can be dropped;
- Clear online sessions - will clear current online sessions.
¶ Activate service on first auth
Activate service on first auth lets Splynx start billing an internet service from the day the customer is really connected, instead of from a start date entered before the equipment was installed. This prevents invoicing for periods when the service was not yet usable.
Enable the toggle in the NAS config section of Config → Networking → Radius — select the NAS Type, click Load, and the option appears with the rest of that type's settings.
How it works
When the RADIUS server returns Access-Accept for a customer, Splynx checks the internet service used for that authentication. The service is activated only when both conditions are met:
- its status is Pending;
- its start date is empty (
0000-00-00).
If both are true, Splynx sets the service status to Active and sets the start date to the current date, so billing starts from the day of the first successful authentication.
Services that are already active, and services that already have a start date, are never changed.
Scope and defaults
- The option is set per NAS type, not per service, and it applies to all authentication-based internet services on that NAS type — PPPoE, DHCP with RADIUS, IPoE, and hotspot.
- The toggle is off by default and must be enabled separately for each NAS type you use.
Tracking the activation
Splynx writes the activation to the customer and service log, so you can see that the system performed it and on which date. No notification is sent to the customer or to the administrator.
Enable this option only if you create internet services with the Pending status and an empty start date. If your workflow fills in the start date up front, the service is left untouched and billing follows the date you entered.
¶ Advanced
In this section, you can configure extended features for RADIUS.
¶ Radd Server
In Splynx we have two Radius servers. We use Freeradius as an external Radius server; it accepts connections from clients (from routers). Freeradius transfers Radius requests to the internal Radius server called splynx_radd. Here we can configure where splynx_radd listens to connections.
- Listen Ip - IP of the splynx_radd server.
- Listen port - splynx_radd port.
If you change the configuration here, you should also change it in the PeerAddr and PeerPort configuration in the /etc/freeradius/splynx/splynx.pl file.
¶ Debug and Logs
- Short log - enables/disables Radius short logs;
- File (short log) - Radius short.log file location;
- Debug - enables/disables Radius debug log (/var/www/splynx/logs/radius/debug.log). The radius debug mode will automatically turn off in 60 minutes;
- Debug level - debug level (0 - 10), 10 - more detailed;
- Console - push debug messages to console, not recommended;
- Syslog - push debug messages to syslog, not recommended;
- File - push debug messages to file: /var/www/splynx/logs/radius/debug.log
¶ Radius extended
-
Check online - checks if a customer is already online. If online, do not allow a new connection (with the same credentials). If disabled, customers can connect multiple times with the same credentials;
-
DHCP (Send framed-route attribute) - send a framed-route from the Radius server;
-
DHCP (Add customer to online after login) - when we use DHCP, add customers to the online list, immediately after they connect. If disabled, customers will be added to the online list, only when their traffic reaches the accounting limit (under Config → Networking → MikroTik API "Min bytes for accounting");
-
Bind MAC address on first connect - if the MAC attribute is empty in the internet service settings, this adds the MAC/IP from where the customer connects for the first time;
-
Maximum unique MAC addresses - maximum number of MAC addresses that can be added into the internet service settings;
-
Overwrite oldest mac in case of new trying to log-in - enable this toggle to overwrite the previous MAC address when there is a new trying to log-in.
-
Enable multiple PSK SSID - configure Multiple PSK SSID. Allow multiple pre-shared keys for a single SSID to manage access and policies. Works only for internet services.
¶ Administrative access
- Allow admins to access unknown NAS devices - allows administrators access in case the NAS is not found on Splynx;
- Default NAS ID - NAS ID, needed if access without NAS is enabled.
¶ Radius NAS settings
-
Force the specified network to use one NAS - enables/disables forcing a network to use only one NAS;
-
Network - specify the network (for example: 10.10.0.0/20) if the previous settings is enabled;
-
Default NAS ID - NAS ID which will be used by default for the network from the previous setting;
-
Set static IP on connect - if enabled, static IPs will be set to services on connecting.
¶ Proxy accounting
- Enable proxy accounting - enables/disables proxy accounting;
- Radius host - IP:Port;
- Radius secret - Radius secret;
- NAS type ID - request for this NAS Type will be proxied to the next radius, 0 - all.
¶ IP From pools (assignment)
-
Link locations - link the customer location to the IP pool location. This will work in a case where, in the customer service, "Any pool" is selected, and all locations will cover different pools;
-
Use IP pool with "Location = All" - in case if the pool associated with the customer location is not found, we can use Pools with Location = All.
¶ Periodic radius server restart
We can specify periodic restarts of the radius server to prevent memory leaks here. The use of this feature is highly recommended.
-
Enable - enables/disables periodic restarts;
-
Restart once per - select a period for the periodic restart (day, week, month);
-
Hour - time when the radius server will be restarted. Recommended time: late at night, midnight or after.
¶ RADIUS tools
- Restart radius - this button restarts the RADIUS server. It is recommended to use this after making new configurations to apply the changes after the reboot.
Be attentive - for a brief period unauthorized customers will not be able to log in via Radius. Radius restart usually takes up to 15 seconds.