Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    FreeRADIUS2+Accounting

    Scheduled Pinned Locked Moved
    2.1 Snapshot Feedback and Problems - RETIRED
    3
    15
    6.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Alan87i
      last edited by

      Your right I have to save at least 1 user in FR2 and open CP and save .
      A tid bit of the syslog before and after. The top of the log is after PF did an update .
      I let it sit for an hour. First thing I did was hit a page with both users(laptops) and I got through.
      Tonight I'll remove one user and see if it can connect after an update with out saving cp and FR2 user.

      Also you'll see each login writes 2 lines for login OK from radius.
      Even more weird is Bandwidthd pumping out 4 lines.

      Jun 28 06:15:00 	php: : The command '/usr/local/etc/rc.d/radiusd.sh stop' returned exit code '1', the output was 'radiusd not running?'
Jun 28 06:15:03 	php: : The command '/usr/local/etc/rc.d/radiusd.sh stop' returned exit code '1', the output was 'radiusd not running?'
Jun 28 06:15:05 	php: : The command '/usr/local/etc/rc.d/radiusd.sh stop' returned exit code '1', the output was 'radiusd not running?'
Jun 28 06:15:08 	radiusd[43484]: Loaded virtual server <default>
Jun 28 06:15:08 	radiusd[43779]: Ready to process requests.
Jun 28 06:15:09 	php: : The command '/usr/local/etc/rc.d/bandwidthd.sh stop' returned exit code '1', the output was 'No matching processes were found'
Jun 28 06:15:09 	kernel: em0: promiscuous mode disabled
Jun 28 06:15:13 	bandwidthd: Monitoring subnet 192.168.1.0 with netmask 192.168.1.0
Jun 28 06:15:13 	bandwidthd: Monitoring subnet 192.168.1.0 with netmask 192.168.1.0
Jun 28 06:15:14 	bandwidthd: Opening em0
Jun 28 06:15:14 	bandwidthd: Packet Encoding: Ethernet
Jun 28 06:15:14 	kernel: em0: promiscuous mode enabled
Jun 28 06:15:14 	bandwidthd: Opening em0
Jun 28 06:15:14 	bandwidthd: Opening em0
Jun 28 06:15:14 	bandwidthd: Opening em0
Jun 28 06:15:14 	bandwidthd: Packet Encoding: Ethernet
Jun 28 06:15:14 	bandwidthd: Packet Encoding: Ethernet
Jun 28 06:15:14 	bandwidthd: Packet Encoding: Ethernet
Jun 28 06:15:16 	login: login on ttyv0 as root
Jun 28 06:15:16 	sshlockout[53380]: sshlockout/webConfigurator v3.0 starting up
Jun 28 06:15:17 	check_reload_status: Reloading filter
Jun 28 08:04:06 	check_reload_status: Syncing firewall
Jun 28 08:04:06 	radiusd[43779]: Signalled to terminate
Jun 28 08:04:06 	radiusd[43779]: Exiting normally.
Jun 28 08:04:07 	php: /pkg_edit.php: The command '/usr/local/etc/rc.d/radiusd.sh stop' returned exit code '1', the output was 'radiusd not running?'
Jun 28 08:04:09 	radiusd[44083]: Loaded virtual server <default>
Jun 28 08:04:09 	radiusd[44196]: Ready to process requests.
Jun 28 08:05:24 	check_reload_status: Syncing firewall
Jun 28 08:05:25 	minicron: (/etc/rc.prunecaptiveportal) terminated by signal 15 (Terminated: 15)
Jun 28 08:05:26 	check_reload_status: Reloading filter
Jun 28 08:05:28 	radiusd[44196]: Login OK: [00:1e:ec:ad:45:29] (from client pfsense port 2 cli 00:1e:ec:ad:45:29)
Jun 28 08:05:28 	radiusd[44196]: Login OK: [00:1e:ec:ad:45:29] (from client pfsense port 2 cli 00:1e:ec:ad:45:29)
Jun 28 08:05:29 	root: FreeRADIUS: Used amount of daily traffic by 00:1e:ec:ad:45:29 is 5875 of 10000 MB! The user was accepted!!!
Jun 28 08:05:50 	radiusd[44196]: Login OK: [00:1b:38:b0:e1:51] (from client pfsense port 4 cli 00:1b:38:b0:e1:51)
Jun 28 08:05:50 	radiusd[44196]: Login OK: [00:1b:38:b0:e1:51] (from client pfsense port 4 cli 00:1b:38:b0:e1:51)
Jun 28 08:05:50 	root: FreeRADIUS: Used amount of daily traffic by 00:1b:38:b0:e1:51 is 103 of 2048 MB! The user was accepted!!!</default></default>

      Also

      
Enter an option: 8

[2.1-BETA0][admin@pfsense.testing.com]/root(1): /var//log/radutmp radwho
/var//log/radutmp: Permission denied.
[2.1-BETA0][admin@pfsense.testing.com]/root(2):
      1 Reply Last reply Reply Quote 0
      • N
        Nachtfalke
        last edited by

        http://freeradius.org/radiusd/man/radwho.html

        
[2.0.1-RELEASE][admin@pfsense1.hpa]/(9): radwho /var/log/radutmp
Login      Name              What  TTY  When      From            Location

        PS: I do not have accounting enabled so no entries here.

        @Alan87i
        Can you please explain again step by step what you did.
        authenticated the user, all is working, updated pfsense, what isn't working.
        Thank you!

        1 Reply Last reply Reply Quote 0
        • A
          Alan87i
          last edited by

          After each snapshot upgrade.
          All packages are reinstalled.
          I have 2 users in radius.

          What I see is both users have access through the wan but CP and FR2 does not authenticate. No log entries CP user status is empty.

          I have to save 1 user in FR2 and save on the CP page . Then I see normal log entries and CP shows both users connected.
          before next snap I will remove one user and test too see if he is denied. Before following the re-save steps

          1 Reply Last reply Reply Quote 0
          • A
            Alan87i
            last edited by 

            $ radwho /var/log/radutmp
Login      Name              What  TTY  When      From            Location
00:1b:38:b 00:1b:38:b0:e1:51 shell S2   Thu 10:23 192.168.1.1     192.168.1.101
00:1e:ec:a 00:1e:ec:ad:45:29 shell S4   Thu 10:23 192.168.1.1     192.168.1.100
00:1e:ec:a 00:1e:ec:ad:45:29 shell S6   Tue 09:52 192.168.1.1     192.168.1.100

            Just updated again too latest snap.
            This time I saved CP and tried and the users showed in the logs.

            1 Reply Last reply Reply Quote 0
            • N
              Nachtfalke
              last edited by

              @Alan87i:

              $ radwho /var/log/radutmp
Login      Name              What  TTY  When      From            Location
00:1b:38:b 00:1b:38:b0:e1:51 shell S2   Thu 10:23 192.168.1.1     192.168.1.101
00:1e:ec:a 00:1e:ec:ad:45:29 shell S4   Thu 10:23 192.168.1.1     192.168.1.100
00:1e:ec:a 00:1e:ec:ad:45:29 shell S6   Tue 09:52 192.168.1.1     192.168.1.100

              Just updated again too latest snap.
              This time I saved CP and tried and the users showed in the logs.

              Correct me if I am wrong:
              1.) After the snapshot update you didn't change anything on FR2?
              2.) After the snapshot update you clicked "Save" on the CP page ?
              3.) After that you ran the "radwho" command ?

              a) Before you did step 2 - the user could connect to the internet without authentication ?
              b) After you did step 2 - the used needed to authenticate on CP ?

              Did you set any "Simultaneous-Use" settings on FR2? If yes - delete them. Uncheck the "Disable concurrent connections" on CP page.

              Explanation about /var/log/radutmp:
              This file only works when accounting is enabled
              This file will be used by FR2 to check for simultaneous connections of a user. So when a user authenticates on CP then an accounting packet is sent from CP to FR2 and FR2 writs this user to the file. FR2 will first delete the user from this file if CP tell to do so. If CP is not doing than FR2 is not the fault. Your radwho output shows to connections from same MAC on different days (Tuesday + Thursday).

              Can you please do the following:
              The next time after you did an update go "Services" and stop FR2.
              Then go to console and start FR2 with:

              
/usr/local/etc/rc.d/radiusd -X

              Then try to authenticate on CP and see the output of FR2 - or post the complete output here.

              PS: what is happening if an user authenticated correct on PC and after that you just reboot pfsense and then again try to authenticte on CP. Will this work correct or not ?

              1 Reply Last reply Reply Quote 0
              • A
                Alan87i
                last edited by

                Correct me if I am wrong:
                1.) After the snapshot update you didn't change anything on FR2?

                yes

                2.) After the snapshot update you clicked "Save" on the CP page ?

                yes

                3.) After that you ran the "radwho" command ?

                yes

                a) Before you did step 2 - the user could connect to the internet without authentication ?

                yes

                b) After you did step 2 - the used needed to authenticate on CP ?

                Yes happens automatically using mac auth 8.0x in FR2 shows up in log

                Did you set any "Simultaneous-Use" settings on FR2? If yes - delete them. Uncheck the "Disable concurrent connections" on CP page.

                Disable concurrent logins was checked  Now unchecked

                Explanation about /var/log/radutmp:
                This file only works when accounting is enabled
                This file will be used by FR2 to check for simultaneous connections of a user. So when a user authenticates on CP then an accounting packet is sent from CP to FR2 and FR2 writs this user to the file. FR2 will first delete the user from this file if CP tell to do so. If CP is not doing than FR2 is not the fault. Your radwho output shows to connections from same MAC on different days (Tuesday + Thursday).

                Can you please do the following:
                The next time after you did an update go "Services" and stop FR2.
                Then go to console and start FR2 with:

                
/usr/local/etc/rc.d/radiusd -X

                Then try to authenticate on CP and see the output of FR2 - or post the complete output here.

                PS: what is happening if an user authenticated correct on PC and after that you just reboot pfsense and then again try to authenticte on CP. Will this work correct or not ?

                I removed 1 of the 2 users . saved and rebooted PF.
                After boot up both have internet.
                restarted FR2 no change  / saved the 1 user FR2 no change.

                Jun 28 12:37:52 	radiusd[55327]: Loaded virtual server <default>
Jun 28 12:37:52 	radiusd[55430]: Ready to process requests.
Jun 28 12:38:25 	radiusd[55430]: Signalled to terminate
Jun 28 12:38:25 	radiusd[55430]: Exiting normally.
Jun 28 12:38:25 	php: /status_services.php: The command '/usr/local/etc/rc.d/radiusd.sh stop' returned exit code '1', the output was 'radiusd not running?'
Jun 28 12:38:28 	radiusd[22872]: Loaded virtual server <default>
Jun 28 12:38:28 	radiusd[23092]: Ready to process requests.</default></default>

                Go too CP page click save

                Jun 28 12:41:27 	check_reload_status: Syncing firewall
Jun 28 12:41:29 	minicron: (/etc/rc.prunecaptiveportal) terminated by signal 15 (Terminated: 15)
Jun 28 12:41:29 	check_reload_status: Reloading filter
Jun 28 12:41:51 	radiusd[23092]: Login OK: [00:1b:38:b0:e1:51] (from client pfsense port 2 cli 00:1b:38:b0:e1:51)
Jun 28 12:41:51 	radiusd[23092]: Login OK: [00:1b:38:b0:e1:51] (from client pfsense port 2 cli 00:1b:38:b0:e1:51)
Jun 28 12:41:51 	root: FreeRADIUS: Used amount of daily traffic by 00:1b:38:b0:e1:51 is 108 of 2048 MB! The user was accepted!!!
Jun 28 12:42:23 	radiusd[23092]: Login incorrect: [00:1e:ec:ad:45:29/blaa] (from client pfsense port 4 cli 00:1e:ec:ad:45:29)
Jun 28 12:42:23 	radiusd[23092]: Login incorrect: [00:1e:ec:ad:45:29/blaa] (from client pfsense port 4 cli 00:1e:ec:ad:45:29)
Jun 28 12:42:25 	radiusd[23092]: Login incorrect: [00:1e:ec:ad:45:29/blaa] (from client pfsense port 6 cli 00:1e:ec:ad:45:29)
Jun 28 12:42:25 	radiusd[23092]: Login incorrect: [00:1e:ec:ad:45:29/blaa] (from client pfsense port 6 cli 00:1e:ec:ad:45:29)

                And all seems fine after that.

                1 Reply Last reply Reply Quote 0
                • A
                  Alan87i
                  last edited by 

                  
[2.1-BETA0][admin@pfsense.testing.com]/root(1): /usr/local/etc/rc.d/radiusd -X
/usr/local/etc/rc.d/radiusd: unknown directive '-X'.
Usage: /usr/local/etc/rc.d/radiusd [fast|force|one|quiet](start|stop|restart|rcvar|reload|debug|status|poll)


                    }
 Module: Linked to module rlm_chap
 Module: Instantiating module "chap" from file /usr/pbi/freeradius-i386/etc/raddb/modules/chap
 Module: Linked to module rlm_mschap
 Module: Instantiating module "mschap" from file /usr/pbi/freeradius-i386/etc/raddb/modules/mschap
  mschap {
        use_mppe = yes
        require_encryption = no
        require_strong = no
        with_ntdomain_hack = yes
        allow_retry = yes
  }
 Module: Instantiating module "motp" from file /usr/pbi/freeradius-i386/etc/raddb/modules/motp
  exec motp {
        wait = yes
        program = "/usr/local/bin/bash /usr/pbi/freeradius-i386/etc/raddb/scripts/otpverify.sh %{request:User-Name} %{request:User-Password} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{reply:MOTP-Offset}"
        input_pairs = "request"
        shell_escape = yes
  }
 Module: Linked to module rlm_digest
 Module: Instantiating module "digest" from file /usr/pbi/freeradius-i386/etc/raddb/modules/digest
 Module: Linked to module rlm_unix
 Module: Instantiating module "unix" from file /usr/pbi/freeradius-i386/etc/raddb/modules/unix
  unix {
        radwtmp = "/var/log/radwtmp"
  }
 Module: Linked to module rlm_eap
 Module: Instantiating module "eap" from file /usr/pbi/freeradius-i386/etc/raddb/eap.conf
  eap {
        default_eap_type = "md5"
        timer_expire = 60
        ignore_unknown_eap_types = no
        cisco_accounting_username_bug = no
        max_sessions = 4096
  }
 Module: Linked to sub-module rlm_eap_md5
 Module: Instantiating eap-md5
 Module: Linked to sub-module rlm_eap_leap
 Module: Instantiating eap-leap
 Module: Linked to sub-module rlm_eap_gtc
 Module: Instantiating eap-gtc
   gtc {
        challenge = "Password: "
        auth_type = "PAP"
   }
 Module: Linked to sub-module rlm_eap_tls
 Module: Instantiating eap-tls
   tls {
        rsa_key_exchange = no
        dh_key_exchange = yes
        rsa_key_length = 512
        dh_key_length = 512
        verify_depth = 0
        CA_path = "/usr/pbi/freeradius-i386/etc/raddb/certs"
        pem_file_type = yes
        private_key_file = "/usr/pbi/freeradius-i386/etc/raddb/certs/server.pem"
        certificate_file = "/usr/pbi/freeradius-i386/etc/raddb/certs/server.pem"
        CA_file = "/usr/pbi/freeradius-i386/etc/raddb/certs/ca.pem"
        private_key_password = "whatever"
        dh_file = "/usr/pbi/freeradius-i386/etc/raddb/certs/dh"
        random_file = "/usr/pbi/freeradius-i386/etc/raddb/certs/random"
        fragment_size = 1024
        include_length = yes
        check_crl = no
        cipher_list = "DEFAULT"
        ecdh_curve = "prime256v1"
    cache {
        enable = no
        lifetime = 24
        max_entries = 255
    }
    verify {
    }
    ocsp {
        enable = no
        override_cert_url = no
        url = "http://127.0.0.1/ocsp/"
    }
   }
 Module: Linked to sub-module rlm_eap_ttls
 Module: Instantiating eap-ttls
   ttls {
        default_eap_type = "md5"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        include_length = yes
   }
 Module: Linked to sub-module rlm_eap_peap
 Module: Instantiating eap-peap
   peap {
        default_eap_type = "mschapv2"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        proxy_tunneled_request_as_eap = yes
        soh = no
   }
 Module: Linked to sub-module rlm_eap_mschapv2
 Module: Instantiating eap-mschapv2
   mschapv2 {
        with_ntdomain_hack = no
        send_error = no
   }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating module "preprocess" from file /usr/pbi/freeradius-i386/etc/raddb/modules/preprocess
  preprocess {
        huntgroups = "/usr/pbi/freeradius-i386/etc/raddb/huntgroups"
        hints = "/usr/pbi/freeradius-i386/etc/raddb/hints"
        with_ascend_hack = no
        ascend_channels_per_line = 23
        with_ntdomain_hack = no
        with_specialix_jetstream_hack = no
        with_cisco_vsa_hack = no
        with_alvarion_vsa_hack = no
  }
 Module: Linked to module rlm_realm
 Module: Instantiating module "suffix" from file /usr/pbi/freeradius-i386/etc/raddb/modules/realm
  realm suffix {
        format = "suffix"
        delimiter = "@"
        ignore_default = no
        ignore_null = yes
  }
 Module: Instantiating module "ntdomain" from file /usr/pbi/freeradius-i386/etc/raddb/modules/realm
  realm ntdomain {
        format = "prefix"
        delimiter = "\"
        ignore_default = no
        ignore_null = yes
  }
 Module: Linked to module rlm_files
 Module: Instantiating module "files" from file /usr/pbi/freeradius-i386/etc/raddb/modules/files
  files {
        usersfile = "/usr/pbi/freeradius-i386/etc/raddb/users"
        acctusersfile = "/usr/pbi/freeradius-i386/etc/raddb/acct_users"
        preproxy_usersfile = "/usr/pbi/freeradius-i386/etc/raddb/preproxy_users"
        compat = "no"
  }
 Module: Linked to module rlm_checkval
 Module: Instantiating module "checkval" from file /usr/pbi/freeradius-i386/etc/raddb/modules/checkval
  checkval {
        item-name = "Calling-Station-Id"
        check-name = "Calling-Station-Id"
        data-type = "string"
        notfound-reject = no
  }
rlm_checkval: Registered name Calling-Station-Id for attribute 31
 Module: Checking preacct {...} for more modules to load
 Module: Checking accounting {...} for more modules to load
 Module: Linked to module rlm_detail
 Module: Instantiating module "detail" from file /usr/pbi/freeradius-i386/etc/raddb/modules/detail
  detail {
        detailfile = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
        header = "%t"
        detailperm = 384
        dirperm = 493
        locking = no
        log_packet_header = no
  }
 Module: Instantiating module "datacounterdaily" from file /usr/pbi/freeradius-i386/etc/raddb/modules/datacounter_acct
  exec datacounterdaily {
        wait = yes
        program = "/bin/sh /usr/pbi/freeradius-i386/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} daily %{request:Acct-Input-Octets} %{request:Acct-Output-Octets}"
        input_pairs = "request"
        shell_escape = yes
  }
 Module: Instantiating module "datacounterweekly" from file /usr/pbi/freeradius-i386/etc/raddb/modules/datacounter_acct
  exec datacounterweekly {
        wait = yes
        program = "/bin/sh /usr/pbi/freeradius-i386/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} weekly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets}"
        input_pairs = "request"
        shell_escape = yes
  }
 Module: Instantiating module "datacountermonthly" from file /usr/pbi/freeradius-i386/etc/raddb/modules/datacounter_acct
  exec datacountermonthly {
        wait = yes
        program = "/bin/sh /usr/pbi/freeradius-i386/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} monthly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets}"
        input_pairs = "request"
        shell_escape = yes
  }
 Module: Instantiating module "datacounterforever" from file /usr/pbi/freeradius-i386/etc/raddb/modules/datacounter_acct
  exec datacounterforever {
        wait = yes
        program = "/bin/sh /usr/pbi/freeradius-i386/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} forever %{request:Acct-Input-Octets} %{request:Acct-Output-Octets}"
        input_pairs = "request"
        shell_escape = yes
  }
 Module: Linked to module rlm_radutmp
 Module: Instantiating module "radutmp" from file /usr/pbi/freeradius-i386/etc/raddb/modules/radutmp
  radutmp {
        filename = "/var/log/radutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        perm = 384
        callerid = yes
  }
 Module: Linked to module rlm_attr_filter
 Module: Instantiating module "attr_filter.accounting_response" from file /usr/pbi/freeradius-i386/etc/raddb/modules/attr_filter
  attr_filter attr_filter.accounting_response {
        attrsfile = "/usr/pbi/freeradius-i386/etc/raddb/attrs.accounting_response"
        key = "%{User-Name}"
        relaxed = no
  }
 Module: Checking session {...} for more modules to load
 Module: Checking pre-proxy {...} for more modules to load
 Module: Instantiating module "attr_filter.pre-proxy" from file /usr/pbi/freeradius-i386/etc/raddb/modules/attr_filter
  attr_filter attr_filter.pre-proxy {
        attrsfile = "/usr/pbi/freeradius-i386/etc/raddb/attrs.pre-proxy"
        key = "%{Realm}"
        relaxed = no
  }
 Module: Checking post-proxy {...} for more modules to load
 Module: Instantiating module "attr_filter.post-proxy" from file /usr/pbi/freeradius-i386/etc/raddb/modules/attr_filter
  attr_filter attr_filter.post-proxy {
        attrsfile = "/usr/pbi/freeradius-i386/etc/raddb/attrs"
        key = "%{Realm}"
        relaxed = no
  }
 Module: Checking post-auth {...} for more modules to load
 Module: Instantiating module "attr_filter.access_reject" from file /usr/pbi/freeradius-i386/etc/raddb/modules/attr_filter
  attr_filter attr_filter.access_reject {
        attrsfile = "/usr/pbi/freeradius-i386/etc/raddb/attrs.access_reject"
        key = "%{User-Name}"
        relaxed = no
  }
 } # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
        type = "auth"
        ipaddr = 192.168.1.1
        port = 1812
}
listen {
        type = "acct"
        ipaddr = 192.168.1.1
        port = 1813
}
listen {
        type = "status"
        ipaddr = 192.168.1.1
        port = 1816
}
Listening on authentication address 192.168.1.1 port 1812
Listening on accounting address 192.168.1.1 port 1813
Listening on status address 192.168.1.1 port 1816
Listening on proxy address 192.168.1.1 port 1814
Ready to process requests.

```was all I could capture from that command in the window

This post all after the latest snap . Again I had too only open CP and click save on the first page.
Before that all devices had access.
                  1 Reply Last reply Reply Quote 0
                  • N
                    Nachtfalke
                    last edited by

                    Ok, but this all seems to indicate a CP issue.
                    Do you have the same problem when you just reboot pfsense or is it only after a snapshot update ?

                    1 Reply Last reply Reply Quote 0
                    • A
                      Alan87i
                      last edited by

                      Just a reboot causes the same problem Not authorized connected pc's have full access until I save the main CP page .

                      1 Reply Last reply Reply Quote 0
                      • N
                        Nachtfalke
                        last edited by

                        @Alan87i:

                        Just a reboot causes the same problem Not authorized connected pc's have full access until I save the main CP page .

                        Ok, then you should probably open a new thread containing a well chosen headline like "CaptivePortal does not authenticate users after reboot against RADIUS".

                        Or you can open a ticket on redmine.pfsense.org

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.