Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Simultaneous-Use CP??

    Scheduled Pinned Locked Moved Captive Portal
    38 Posts 2 Posters 11.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      Nachtfalke
      last edited by

      @Alan87i:

      Auth log when the user has a set usage limit in radius

      Apr 16 19:44:27 	logportalauth[40065]: MACHINE LOGIN: 00-23-69-fb-79-33, 00:23:69:fb:79:33, 192.168.1.100
      Apr 16 20:45:17 	logportalauth[27313]: TIMEOUT: 00-23-69-fb-79-33, 00:23:69:fb:79:33, 192.168.1.100
      Apr 16 20:47:25 	logportalauth[39722]: MACHINE LOGIN: 00-23-69-fb-79-33, 00:23:69:fb:79:33, 192.168.1.100
      Apr 16 21:48:07 	logportalauth[49897]: TIMEOUT: 00-23-69-fb-79-33, 00:23:69:fb:79:33, 192.168.1.100
      Apr 16 21:49:03 	logportalauth[39722]: MACHINE LOGIN: 00-23-69-fb-79-33, 00:23:69:fb:79:33, 192.168.1.100
      

      Using interim update  in CP because from reading start stop has a bug. Seems as though this one does too.

      The "bug" I mentioned above is that it counts traffic wrong but in general it is working. What your log means - I don't know. It is related to CP or in other word it is a CP log and not a freeradius log.
      Did you read the documentation of freeradius about "acct_unique" ? Probably disable acct_unique
      Did you set any idle/hard timeout on CP which causes this problem ? disable or set the timeouts high enough for testing
      Did you set re-authenticate every minute on CP ? you need this so that freeradius can reject access if the limit is reached

      Can the user get access or does it timeout when accounting and usage limit is enabled ?

      1 Reply Last reply Reply Quote 0
      • A
        Alan87i
        last edited by

        Did you read the documentation of freeradius about "acct_unique" ? Probably disable acct_unique

        Yes it has been disabled the whole time.

        Did you set any idle/hard timeout on CP which causes this problem ? disable or set the timeouts high enough for testing

        Hard time out was at 60 , I took it out and added 120 too idle timeout.

        Did you set re-authenticate every minute on CP ? you need this so that freeradius can reject access if the limit is reached

        Yes this is checked also.

        I set it back too start stop updates.
        Deleted the user and created a new one. With limit in the account set too 500 MB then downloaded a 700 mb file. The user is still connected.

        Found this issue http://redmine.pfsense.org/issues/2164  Not sure how too apply a patch.

        1 Reply Last reply Reply Quote 0
        • N
          Nachtfalke
          last edited by

          Are you running pfsense on embedded or nanobsd ?

          Check if these folders and files exist:

          
          /var/log/radacct/datacounter/
          /var/log/radacct/timecounter/
          /usr/local/etc/raddb/scripts/datacounter_acct.sh
          
          

          If not, reinstall freeradius2 package please.

          The redmine ticket you found is for time-based accounting. I opened that ticket in the past ;)
          Datacounter is working - with the known bug that CP sends 6 times more MB as used in reality.

          1 Reply Last reply Reply Quote 0
          • A
            Alan87i
            last edited by

            Yes all the files exist .
            I have opened the daily data file and in bytes it had the number that matched the MB limit I set for the user 505 MB When in fact I downloaded close too 2.5 GB off my server. And it's not a server I set in the allowed IP field. I thought that might stop the counter from working.

            1 Reply Last reply Reply Quote 0
            • N
              Nachtfalke
              last edited by

              You could stop radiusd process from GUI.
              connect with SSH to your pfsense and run radius in debug mode. type:

              radiusd -X
              

              You can see all the output. Try to connect with a client from CP and check the output when the client reaches the limit. (Acct-Input-Octets and Acct-Output-Octets) will show you the bytes tranferred.

              1 Reply Last reply Reply Quote 0
              • A
                Alan87i
                last edited by

                @Nachtfalke:

                You could stop radiusd process from GUI.
                connect with SSH to your pfsense and run radius in debug mode. type:

                radiusd -X
                

                You can see all the output. Try to connect with a client from CP and check the output when the client reaches the limit. (Acct-Input-Octets and Acct-Output-Octets) will show you the bytes tranferred.

                Ok I see it says Cat/var/log/radacct/daily/max-octets-bunch of numbers  No such file or dircetory

                same for used octets

                1 Reply Last reply Reply Quote 0
                • A
                  Alan87i
                  last edited by

                  Could it be some permissions problem? The files seem to be there .

                  EDIT
                  From the debug ssh window
                  the max and used octets-00X23X69XfbX79X33
                  That file as you can see from the screen shot does not exist.

                  max-octets-00-23-69-fb-79-33

                  max-octets-00:23:69:fb:79:33

                  Edit again !!
                  I went ahead and tried editing the files replacing the - with X's and voila
                  I see this in the log file

                  Apr 17 10:13:38 	admin: FreeRADIUS: Credentials are probably correct but the user 00X23X69XfbX79X33 has reached the daily Amount of Upload and Download Traffic which is 0 MB! The user was rejected!!!
                  

                  So I put " 1048576000 " into the modified file and was able to log back in just fine .

                  pf.datacounter.JPG
                  pf.datacounter.JPG_thumb

                  1 Reply Last reply Reply Quote 0
                  • N
                    Nachtfalke
                    last edited by

                    I updated freeradius2 package to replace the "  :  " with "  X  ".
                    Try if this helps. Perhaps try and test with a username and password like "John" and "mypass" if this in general works for you.

                    1 Reply Last reply Reply Quote 0
                    • A
                      Alan87i
                      last edited by

                      I want to run this with mac auth like I've been testing.

                      What would cause my system to put : for the file name and freeraduis to look for the X .
                      Creating the files with an X didn't work , perhaps the new files don't have correct permissions ?

                      1 Reply Last reply Reply Quote 0
                      • A
                        Alan87i
                        last edited by

                        radiusd -X
                        

                        Login OK: [00:23:69:fb:79:33] (from client admin port 8 cli 00:23:69:fb:79:33)

                        Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default

                        +- entering group post-auth {…}
                        cat: /var/log/radacct/datacounter/daily/max-octets-00X23X69XfbX79X33: No such file or directory
                        cat: /var/log/radacct/datacounter/daily/used-octets-00X23X69XfbX79X33: No such file or directory
                        Exec-Program output:
                        Exec-Program: returned: 0
                        ++[exec] returns ok
                        Sending Access-Accept of id 198 to 192.168.1.1 port 36700
                                WISPr-Bandwidth-Max-Up := 262144
                                WISPr-Bandwidth-Max-Down := 8192000
                                Session-Timeout = 53872310
                        Finished request 0.
                        Going to the next request
                        Waking up in 4.9 seconds.
                        Cleaning up request 0 ID 198 with timestamp +19
                        Ready to process requests.

                        I killed radius removed the files from the daily folder , deleted the user account , then re made a new account. This is what I still have for a problem. It's looking for a ocetets file with X's and it makes an octets file with :'s

                        1 Reply Last reply Reply Quote 0
                        • N
                          Nachtfalke
                          last edited by

                          For me it is working but I have to set the correct MAC format according to the username entry in freeradius -> "Users".

                          So if I chose "ietf" on CP then my username must look like "ietf": 11-22-33-44-55-66
                          If i chose "default" on CP then my username must look like "default": 11:22:33:44:55:66

                          But I found another "bug" - if I delete the files in:

                          /var/log/radacct/datacounter/daily
                          

                          by hand then the script will not recreate these files withe the according values. To recreate the files I need to go to "users" tab, edit a user (not change anything) and press save so that "users" file will be created new and so there will be new "datacounter limit files if not exist".

                          I will try to find a solution for that.

                          1 Reply Last reply Reply Quote 0
                          • A
                            Alan87i
                            last edited by

                            Well I tried the latest version and it didn't seem to work. So I uninstalled downloaded pf config NO package info and RE uploaded it .
                            Re installed freeraduis2 and set it up again.

                            Now I can't get a user to log with a mac and shared secret.
                            This is from the log
                            Apr 17 15:33:42 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 60612
                            Apr 17 15:33:42 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 60612
                            Apr 17 15:33:45 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 60612
                            Apr 17 15:33:45 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 60612
                            Apr 17 15:33:52 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 44857
                            Apr 17 15:33:52 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 44857

                            1.1. is PF lan IP The router is on DHCP at 1.100

                            So I reinstalled PF from the disk. and get the same problem.

                            1 Reply Last reply Reply Quote 0
                            • N
                              Nachtfalke
                              last edited by

                              @Alan87i:

                              Well I tried the latest version and it didn't seem to work. So I uninstalled downloaded pf config NO package info and RE uploaded it .
                              Re installed freeraduis2 and set it up again.

                              Now I can't get a user to log with a mac and shared secret.
                              This is from the log
                              Apr 17 15:33:42 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 60612
                              Apr 17 15:33:42 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 60612
                              Apr 17 15:33:45 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 60612
                              Apr 17 15:33:45 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 60612
                              Apr 17 15:33:52 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 44857
                              Apr 17 15:33:52 radiusd[48787]: Ignoring request to authentication address 192.168.1.1 port 1812 from unknown client 192.168.1.1 port 44857

                              1.1. is PF lan IP The router is on DHCP at 1.100

                              So I reinstalled PF from the disk. and get the same problem.

                              This means you did not enter the pfsense LAN IP as a "NAS" in freeradius and/or wrong shared secret. That's a communication problem between NAS/CP and freeradius.

                              1 Reply Last reply Reply Quote 0
                              • A
                                Alan87i
                                last edited by

                                Thanks I was having a brief stupid moment.
                                And yes things seem to be working now. I removed the used octets file and saved the user again in radius , that made a new blank used file.
                                I set 18432MB in radius witch should give me 3 GB.
                                I read in the guide that cron could be used to reset the daily folder every night.
                                Is that needed?

                                I want too run this with all users on a monthly basis. Should a cron job be set up to reset the counter monthly?
                                BTW
                                Thanks very much for all the help!!

                                1 Reply Last reply Reply Quote 0
                                • N
                                  Nachtfalke
                                  last edited by

                                  @Alan87i:

                                  Thanks I was having a brief stupid moment.
                                  And yes things seem to be working now. I removed the used octets file and saved the user again in radius , that made a new blank used file.
                                  I set 18432MB in radius witch should give me 3 GB.
                                  I read in the guide that cron could be used to reset the daily folder every night.
                                  Is that needed?

                                  I want too run this with all users on a monthly basis. Should a cron job be set up to reset the counter monthly?
                                  BTW
                                  Thanks very much for all the help!!

                                  Yes, you must setup a cron job. When I wrote the documentation in the past I forgot to mention that after the cron job deletes "used" and "max" octets files it does not automaticalle recreate the files with the new/resetted values. I need to create a script which recreates the users file and recreates the max-octets file after cron job deleted them.

                                  If you chose "daily", "monthly" or whatever in the GUI places the files in the specific ../datacounter/daily or ../datacounter/monthly folder.

                                  To make it a little more clear:
                                  Setting up daily, monthly and so on in the GUI just places the files in different folders.
                                  You have to setup a cron job manually to delete these folders daily, monthly or whatever
                                  After the files were deleted by cron you need to re-run the "squid.xml" file (Users tab). There is a check if a user has set a limit but no files exist in the folder they will be created new ones. If they exist, nothing will be done. (For this behaviour I need to write an additional script or someone provides it for us).

                                  PS: To reset a users counter just edit the user, empty the value for limit, save, edit the user again and setup a new limit. This deletes the old files and creates new ones with new limit.

                                  Thanks for testing :-)

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    Alan87i
                                    last edited by

                                    Ok With CP set too Mac format type default and radius user xx:f4:ff format I still get the octets 00X33X what have you file not found.
                                    With CP set too ietf and user 00-99-ff format it counts .
                                    But
                                    The figure of the counting bug using start stop or interm seems to count much faster than 6 times the real rate.

                                    I set the user mac too 18432 MB total daily = 18gb divide by 6 gives 3 GB
                                    The octets file shows this as 19327352832 bytes witch is correct
                                    I test download a 1.4 GB file
                                    I get roughly 732MB about 1/2 of it and I get kicked
                                    Used octets reads 21725770732 bytes witch is roughly 20.2 GB

                                    1 Reply Last reply Reply Quote 0
                                    • N
                                      Nachtfalke
                                      last edited by

                                      I did some more tests and you are right.  :(

                                      The traffic counter is not working as it should. At the moment I am unsure if the CP sends the accounting information according to the RFC and my script is not correct or if it is vice versa.  :(

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        Alan87i
                                        last edited by

                                        I deleted the two scripts and reinstalled changed format too default ran radiusd -X

                                        Login OK: [00:23:69:fb:79:33] (from client admin port 8 cli 00:23:69:fb:79:33)
                                        # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default
                                        +- entering group post-auth {...}
                                        cat: /var/log/radacct/datacounter/daily/max-octets-00X23X69XfbX79X33: No such file or directory
                                        cat: /var/log/radacct/datacounter/daily/used-octets-00X23X69XfbX79X33: No such file or directory
                                        Exec-Program output:
                                        Exec-Program: returned: 0
                                        ++[exec] returns ok
                                        Sending Access-Accept of id 86 to 192.168.1.1 port 1436
                                                WISPr-Bandwidth-Max-Up := 262144
                                                WISPr-Bandwidth-Max-Down := 15360000
                                                Session-Timeout = 53777840
                                        Finished request 3.
                                        Going to the next request
                                        Waking up in 4.9 seconds.
                                        Cleaning up request 3 ID 86 with timestamp +48
                                        Ready to process requests.
                                        
                                        
                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          Alan87i
                                          last edited by

                                          @Nachtfalke:

                                          I did some more tests and you are right.  :(

                                          The traffic counter is not working as it should. At the moment I am unsure if the CP sends the accounting information according to the RFC and my script is not correct or if it is vice versa.  :(

                                          Yea I just did another test and got the same result. set radius user for 20 Gb and could not pass 1 GB before it cut the user off.
                                          I'm happy to test any updates or ideas . I would really like to implement this on 2 networks.

                                          1 Reply Last reply Reply Quote 0
                                          • N
                                            Nachtfalke
                                            last edited by

                                            Hi again,

                                            I took some time to remember what my scripts are doing and I would like to let you know and understand:

                                            To count the traffic we use octets. One octet is one byte. The CP sends Input and Output Octets.

                                            If you set volume limit for a user this limit will be calculated as octets/bytes and written to the file "max-octets-username".
                                            The script runs everytime an interim or stop/start accounting packet arrives. Both packets include information about the input and output octets. the script summates the both values and summates this with the value written in the "used-octets-username" file. After this the script checks if used-octets is greater than max-octets and rejects the connection or still allows it.

                                            The changes below will not summate the values sent from CP with the values in the file but still writes the new values to the file.
                                            But the problem with this is that if a user disconnects and reconnets 2hours later the CP starts to count the octets from zero.

                                            You try to edit the script. Go to:

                                            /usr/local/etc/raddb/scripts/datacounter_acct.sh
                                            

                                            Change line 22 from this:

                                            USEDOCTETS=$(($ACCTINPUTOCTETS+$ACCTOUTPUTOCTETS+`cat "/var/log/radacct/datacounter/$TIMERANGE/used-octets-$USERNAME"`))
                                            

                                            to

                                            USEDOCTETS=$(($ACCTINPUTOCTETS+$ACCTOUTPUTOCTETS))
                                            

                                            This could perhaps help when using stop/start accounting.

                                            For the problem with the username and the" : " try to edit line 4 to this on datacounter_acct.sh

                                            USERNAME=`echo -n "\$1" | sed 's/[^0-9a-zA-Z.:_-]/X/g' `
                                            

                                            and datacounter_auth.sh on line 4 to this

                                            USERNAME=`echo -n "\$1" | sed 's/[^0-9a-zA-Z._:-]/X/g' `
                                            
                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.