Skip to content

Commit a8a4815

Browse files
alandekokalandekok
committed
add sample "proxy" virtual server
1 parent ec38eef commit a8a4815

File tree

5 files changed

+278
-2
lines changed

5 files changed

+278
-2
lines changed

‎debian/freeradius-config.postinst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ case "$1" in
4949
# install or an upgrade from before there were links; users may
5050
# want to remove them...
5151
if [ -z "$2" ] || dpkg --compare-versions "$2" lt 2.0.4+dfsg-4; then
52-
for site in default inner-tunnel; do
52+
for site in default inner-tunnel proxy; do
5353
if test ! -h /etc/freeradius/sites-enabled/$site && \
5454
test ! -e /etc/freeradius/sites-enabled/$site; then
5555
ln -s ../sites-available/$site /etc/freeradius/sites-enabled/$site

‎doc/antora/modules/reference/nav.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,7 @@
262262
*** xref:raddb/sites-available/ldap_sync.adoc[LDAP Sync]
263263
*** xref:raddb/sites-available/doc/radius.adoc[RADIUS]
264264
**** xref:raddb/sites-available/default.adoc[Default]
265+
**** xref:raddb/sites-available/proxy.adoc[Proxy]
265266
**** xref:raddb/sites-available/buffered-sql.adoc[Buffered SQL]
266267
**** xref:raddb/sites-available/challenge.adoc[Challenge-Response]
267268
**** xref:raddb/sites-available/coa.adoc[CoA]

‎doc/antora/modules/reference/pages/raddb/sites-available/proxy.adoc‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
2+
= Proxy RADIUS packets
3+
4+
This virtual server replaces the old `pre-proxy` and `post-proxy`
5+
sections that were in v3.
6+
7+
It can be called from another virtual server via the `call` keyword:
8+
9+
```
10+
# subrequest {
11+
# request := parent.request
12+
# call proxy {
13+
# }
14+
# }
15+
```
16+
17+
For server pools with load-balancing, fail-over, etc., you can just
18+
use the `load-balance` and `redundant` keywords. Those sections
19+
should then include multiple `radius` modules, one for each home
20+
server.
21+
22+
You can also create virtual modules in `mods-enabled/`, simply by
23+
giving the `load-balance` section a name. See the keyword
24+
documentation for `load-balance` for more details.
25+
26+
See also the proxy upgrade documentation for examples.
27+
xref:howto:upgrade/proxy.adoc[proxy]
28+
29+
30+
31+
32+
```
33+
server proxy {
34+
namespace = radius
35+
36+
```
37+
38+
== Authentication
39+
40+
Process Access-Request packets and responses.
41+
42+
=== Receive the Access-Request from the parent
43+
44+
This section replaces `pre-proxy`. It receives an Access-Request
45+
from the parent, and uses the `radius` module to proxy it.
46+
47+
Note that there is no `send Access-Request` section. If you add
48+
one, the server will give an error, and will refuse to start.
49+
50+
```
51+
recv Access-Request {
52+
```
53+
54+
Rewrite the Access-Request before it gets sent to the home server
55+
56+
57+
58+
This is where you decide which home server the packet is
59+
proxied to.
60+
61+
```
62+
radius
63+
}
64+
65+
```
66+
67+
=== Return the Access-Accept to the parent
68+
69+
```
70+
send Access-Accept {
71+
}
72+
73+
```
74+
75+
=== Return the Access-Reject to the parent
76+
77+
```
78+
send Access-Reject {
79+
}
80+
81+
```
82+
83+
=== Return the Access-Challenge to the parent
84+
85+
```
86+
send Access-Challenge {
87+
}
88+
89+
```
90+
91+
== Accounting
92+
93+
94+
=== Receive the Accounting-Request from the parent
95+
96+
```
97+
recv Accounting-Request {
98+
99+
```
100+
101+
As the last thing in the section, proxy it.
102+
103+
```
104+
radius
105+
}
106+
107+
```
108+
109+
=== Return the Accounting-Response to the parent
110+
111+
```
112+
send Accounting-Response {
113+
}
114+
115+
```
116+
117+
== Other Packet Types
118+
119+
You can add sections here such as `recv CoA-Request`, `send
120+
CoA-ACK`, etc.
121+
122+
123+
124+
== Finalize the response
125+
126+
```
127+
finally {
128+
```
129+
130+
Remove all Proxy-State attributes from the response
131+
132+
```
133+
reply -= Proxy-State[*]
134+
135+
```
136+
137+
Over-write all of the parents response attributes with our response.
138+
139+
```
140+
parent.reply := reply
141+
}
142+
143+
}
144+
```
145+
146+
== Default Configuration
147+
148+
```
149+
```
150+
151+
// Copyright (C) 2026 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
152+
// This documentation was developed by Network RADIUS SAS.

‎raddb/all.mk‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
LOCAL_FILES := clients.conf dictionary \
55
radiusd.conf trigger.conf panic.gdb
66

7-
DEFAULT_SITES := default inner-tunnel
7+
DEFAULT_SITES := default inner-tunnel proxy
88
LOCAL_SITES := $(addprefix raddb/sites-enabled/,$(DEFAULT_SITES))
99

1010
DEFAULT_MODULES := always attr_filter cache_eap chap client \

‎raddb/sites-available/proxy‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
# -*- text -*-
2+
######################################################################
3+
#
4+
# = Proxy RADIUS packets
5+
#
6+
# This virtual server replaces the old `pre-proxy` and `post-proxy`
7+
# sections that were in v3.
8+
#
9+
# It can be called from another virtual server via the `call` keyword:
10+
#
11+
# subrequest {
12+
# request := parent.request
13+
# call proxy {
14+
# }
15+
# }
16+
#
17+
# For server pools with load-balancing, fail-over, etc., you can just
18+
# use the `load-balance` and `redundant` keywords. Those sections
19+
# should then include multiple `radius` modules, one for each home
20+
# server.
21+
#
22+
# You can also create virtual modules in `mods-enabled/`, simply by
23+
# giving the `load-balance` section a name. See the keyword
24+
# documentation for `load-balance` for more details.
25+
#
26+
# See also the proxy upgrade documentation for examples.
27+
# doc/antora/modules/howto/pages/upgrade/proxy.adoc
28+
#
29+
#
30+
# $Id$
31+
#
32+
######################################################################
33+
34+
server proxy {
35+
namespace = radius
36+
37+
#
38+
# == Authentication
39+
#
40+
# Process Access-Request packets and responses.
41+
#
42+
# === Receive the Access-Request from the parent
43+
#
44+
# This section replaces `pre-proxy`. It receives an Access-Request
45+
# from the parent, and uses the `radius` module to proxy it.
46+
#
47+
# Note that there is no `send Access-Request` section. If you add
48+
# one, the server will give an error, and will refuse to start.
49+
#
50+
recv Access-Request {
51+
#
52+
# Rewrite the Access-Request before it gets sent to the home server
53+
#
54+
55+
#
56+
# This is where you decide which home server the packet is
57+
# proxied to.
58+
#
59+
radius
60+
}
61+
62+
63+
#
64+
# === Return the Access-Accept to the parent
65+
#
66+
send Access-Accept {
67+
}
68+
69+
#
70+
# === Return the Access-Reject to the parent
71+
#
72+
send Access-Reject {
73+
}
74+
75+
#
76+
# === Return the Access-Challenge to the parent
77+
#
78+
send Access-Challenge {
79+
}
80+
81+
#
82+
# == Accounting
83+
#
84+
#
85+
# === Receive the Accounting-Request from the parent
86+
#
87+
recv Accounting-Request {
88+
89+
#
90+
# As the last thing in the section, proxy it.
91+
#
92+
radius
93+
}
94+
95+
#
96+
# === Return the Accounting-Response to the parent
97+
#
98+
send Accounting-Response {
99+
}
100+
101+
#
102+
# == Other Packet Types
103+
#
104+
# You can add sections here such as `recv CoA-Request`, `send
105+
# CoA-ACK`, etc.
106+
#
107+
108+
#
109+
# == Finalize the response
110+
#
111+
finally {
112+
#
113+
# Remove all Proxy-State attributes from the response
114+
#
115+
reply -= Proxy-State[*]
116+
117+
#
118+
# Over-write all of the parents response attributes with our response.
119+
#
120+
parent.reply := reply
121+
}
122+
123+
}

0 commit comments

Comments
 (0)