Rate Limit on Radius Reply Attributes for PPPoE connections not working

ibysmalls

Hi guys,

I've got PPPoE server and Freeradius service working on a pfsense machine.
I can have a test user autheticate and browse after authentication however I am trying to rate limit the connection via Radius.

I believe the PPPoE uses MPD however I am not able to get it working.

This is what I am getting in the users config when entering the limits on the FreeRadius gui for the user:

Framed-IP-Address = 10.2.0.52,
Framed-IP-Netmask = 255.255.255.255,
Framed-Route = "10.2.0.0/32 10.2.0.1 10",
WISPr-Bandwidth-Max-Up := 1024000,
WISPr-Bandwidth-Max-Down := 1024000

there is no Limit applied on the bandwidth (internet speedtest)

If I Manually enter in the MPD-rate limit values as per the bottom of this page: http://mpd.sourceforge.net/doc/mpd62.html#62

so that my users conf is like this:

Framed-IP-Address = 10.2.0.52,
Framed-IP-Netmask = 255.255.255.255,
Framed-Route = "10.2.0.0/32 10.2.0.1 10",
mpd-limit := "in#1=all shape 64000"

Then I reveive the following errors in radlogs:

Warning: [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay"   found in filter list for realm "DEFAULT".
Thu Feb 28 01:36:02 2019 : Warning: [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec"      found in filter list for realm "DEFAULT".
Thu Feb 28 01:36:02 2019 : Error: /usr/local/etc/raddb/mods-config/files/authorize[1]: Parse error (check) for entry mpd-limit: Invalid attribute name
Thu Feb 28 01:36:02 2019 : Error: Failed reading /usr/local/etc/raddb/mods-config/files/authorize
Thu Feb 28 01:36:02 2019 : Error: /usr/local/etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files"

I have copied the rate limit code from this post https://forum.netgate.com/topic/21564/set-vpn-rate-limit-via-external-radius-server/7

However that was 9 Years ago and I'm thinking if things have changed.

Would appreciate any help, I am trying to setup a wisp locally.

ibysmalls

Anyone?

ibysmalls

I've figured it out for anyone googling this issue.

First, you have to create a dictionary file under /usr/local/share/freeradius called dictionary.mpd

and insert the following

#----------------------------------------------------------
# dictionary.mpd                                                                                   
                                                                                                   
VENDOR          mpd             12341                                                              
                                                                                                   
BEGIN-VENDOR	mpd

ATTRIBUTE	mpd-rule	1	string
ATTRIBUTE	mpd-pipe	2	string
ATTRIBUTE	mpd-queue	3	string
ATTRIBUTE	mpd-table	4	string
ATTRIBUTE	mpd-table-static	5	string
ATTRIBUTE	mpd-filter	6	string
ATTRIBUTE	mpd-limit	7	string
ATTRIBUTE	mpd-input-octets	8	string
ATTRIBUTE	mpd-input-packets	9	string
ATTRIBUTE	mpd-output-octets	10	string
ATTRIBUTE	mpd-output-packets	11	string
ATTRIBUTE	mpd-link	12	string
ATTRIBUTE	mpd-bundle	13	string
ATTRIBUTE	mpd-iface	14	string
ATTRIBUTE	mpd-iface-index	15	integer
ATTRIBUTE	mpd-input-acct	16	string
ATTRIBUTE	mpd-output-acct	17	string
ATTRIBUTE	mpd-action	18	string
ATTRIBUTE	mpd-peer-ident	19	string
ATTRIBUTE	mpd-iface-name	20	string
ATTRIBUTE	mpd-iface-descr	21	string
ATTRIBUTE	mpd-iface-group	22	string
ATTRIBUTE	mpd-drop-user	154	integer

END-VENDOR	mpd
#----------------------------------------------------------

Then add the following line to /usr/local/share/dictionary

$INCLUDE dictionary.mpd

Now in the Reply attributes for the user in freeRadius I have limited the user with 10 mbit down and 10 mbit upload:

This goes in the "Additional reply attributes" box

mpd-limit = "in#1=all rate-limit 10000000",mpd-limit = "out#1=all rate-limit 10000000"

For more commands and traffic limit and shaping see this link:

Sourceforge

I hope that helps anyone else. I am using this to rate limit users which connect via pppoe through a router at CPE and authenticate through freeradius on the pfsense box. I am starting a WISP and was doing some testing and didn't want to limit via the pfsense traffic shaping feature but better through the MPD5 pppoe server instead.

econst

Hi,
I tried your findings in this post, but it did not work for me. I did everything as you did. Freeradius complains about not knowing "mpd-limit", and does not start. If I remove the attributes, Freeradius starts and I can browse the internet and all through my NAS/client.

What version of PFsense and MPD were you using? Any other suggestions?

I created another post here yesterday about using an external Freeradius server, because I could not get the one on PFsense to work the way I want.

viktor_g

See https://redmine.pfsense.org/issues/11102