Correct IP settings between Captive Portal and Freeradius2

[hsrtreml]

Hello,
I'm a little bit confused, because so many "how-to's" with so many different IP settings..

Situation and questions about Captive Portal (CPx) and Freeradius (FR):

LAN-IP: 100.1, 100.0/24  (Private)

CP1-IP: 11.0/24 (Guest1)
CP2-IP: 12.0/24 (Guest2)
on both CP i will use FR for user accounting.

FR Interface-IP auth 1812, Which IP: LAN IF-IP, any LAN-IP? (FR-IF-IP-1812)
FR Interface-IP aucc 1813, Which IP: LAN IF-IP, any LAN-IP? (FR-IF-IP-1813)

FR NAS Client: Which IP: LAN IF-IP, any LAN-IP? or their own CPx-IP for authentification? (FR-NAS-IP)

Example:
CP2: Primäry FR: FR-IF-IP-1812
CP2: Accounting: Send radius to Primäry FR

CP2: Radius NAS IP Attribute: FR-NAS-IP

Easy, or?

Solution:
–-------
within FR is FR-IF-IP-1812: ?
within FR is FR-IF-IP-1813: ?
within FR is FR-NAS-IP: ?
within CP1 is Primary FR: ?
within CP1 is Radius NAS IP: ?

at the moment, i have this settings
within FR is FR-IF-IP-1812: *
within FR is FR-IF-IP-1813: *
within FR-NAS-IP: LAN-IP
within CP1 is Primary FR: LAN-IP
within CP1 is Radius NAS IP: LAN-IP

other solutions:
within FR is FR-IF-IP-1812: CP1-IP
within FR is FR-IF-IP-1813: CP1-IP
within FR is FR-NAS-IP: CP1-IP
within CP1 is Primary FR: CP1-IP
within CP1 is Radius NAS IP: CP1-IP

as well as

within FR is FR-IF-IP-1812: CP2-IP
within FR is FR-IF-IP-1813: CP2-IP
within FR is FR-NAS-IP: CP2-IP
within CP2 is Primary FR: CP2-IP
within CP2 is Radius NAS IP: CP2-IP

...

Questions: Which settings are correct and secure? How to prevent users from CP1 not logging in CP2?

Does somebody has an idea, whch are the correct settings?

br
hsttremt