Rate Limit on Radius Reply Attributes for PPPoE connections not working



  • Hi guys,

    I've got PPPoE server and Freeradius service working on a pfsense machine.
    I can have a test user autheticate and browse after authentication however I am trying to rate limit the connection via Radius.

    I believe the PPPoE uses MPD however I am not able to get it working.

    This is what I am getting in the users config when entering the limits on the FreeRadius gui for the user:

    Framed-IP-Address = 10.2.0.52,
    Framed-IP-Netmask = 255.255.255.255,
    Framed-Route = "10.2.0.0/32 10.2.0.1 10",
    WISPr-Bandwidth-Max-Up := 1024000,
    WISPr-Bandwidth-Max-Down := 1024000
    

    there is no Limit applied on the bandwidth (internet speedtest)

    If I Manually enter in the MPD-rate limit values as per the bottom of this page: http://mpd.sourceforge.net/doc/mpd62.html#62

    so that my users conf is like this:

    Framed-IP-Address = 10.2.0.52,
    Framed-IP-Netmask = 255.255.255.255,
    Framed-Route = "10.2.0.0/32 10.2.0.1 10",
    mpd-limit := "in#1=all shape 64000"
    

    Then I reveive the following errors in radlogs:

    Warning: [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay"   found in filter list for realm "DEFAULT".
    Thu Feb 28 01:36:02 2019 : Warning: [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec"      found in filter list for realm "DEFAULT".
    Thu Feb 28 01:36:02 2019 : Error: /usr/local/etc/raddb/mods-config/files/authorize[1]: Parse error (check) for entry mpd-limit: Invalid attribute name
    Thu Feb 28 01:36:02 2019 : Error: Failed reading /usr/local/etc/raddb/mods-config/files/authorize
    Thu Feb 28 01:36:02 2019 : Error: /usr/local/etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files"
    

    I have copied the rate limit code from this post https://forum.netgate.com/topic/21564/set-vpn-rate-limit-via-external-radius-server/7

    However that was 9 Years ago and I'm thinking if things have changed.

    Would appreciate any help, I am trying to setup a wisp locally.



  • Anyone?



  • I've figured it out for anyone googling this issue.

    First, you have to create a dictionary file under /usr/local/share/freeradius called dictionary.mpd

    and insert the following

    #----------------------------------------------------------
    # dictionary.mpd                                                                                   
                                                                                                       
    VENDOR          mpd             12341                                                              
                                                                                                       
    BEGIN-VENDOR	mpd
    
    ATTRIBUTE	mpd-rule	1	string
    ATTRIBUTE	mpd-pipe	2	string
    ATTRIBUTE	mpd-queue	3	string
    ATTRIBUTE	mpd-table	4	string
    ATTRIBUTE	mpd-table-static	5	string
    ATTRIBUTE	mpd-filter	6	string
    ATTRIBUTE	mpd-limit	7	string
    ATTRIBUTE	mpd-input-octets	8	string
    ATTRIBUTE	mpd-input-packets	9	string
    ATTRIBUTE	mpd-output-octets	10	string
    ATTRIBUTE	mpd-output-packets	11	string
    ATTRIBUTE	mpd-link	12	string
    ATTRIBUTE	mpd-bundle	13	string
    ATTRIBUTE	mpd-iface	14	string
    ATTRIBUTE	mpd-iface-index	15	integer
    ATTRIBUTE	mpd-input-acct	16	string
    ATTRIBUTE	mpd-output-acct	17	string
    ATTRIBUTE	mpd-action	18	string
    ATTRIBUTE	mpd-peer-ident	19	string
    ATTRIBUTE	mpd-iface-name	20	string
    ATTRIBUTE	mpd-iface-descr	21	string
    ATTRIBUTE	mpd-iface-group	22	string
    ATTRIBUTE	mpd-drop-user	154	integer
    
    END-VENDOR	mpd
    #----------------------------------------------------------
    

    Then add the following line to /usr/local/share/dictionary

    $INCLUDE dictionary.mpd
    

    Now in the Reply attributes for the user in freeRadius I have limited the user with 10 mbit down and 10 mbit upload:

    This goes in the "Additional reply attributes" box

    mpd-limit = "in#1=all rate-limit 10000000",mpd-limit = "out#1=all rate-limit 10000000"
    

    For more commands and traffic limit and shaping see this link:

    Sourceforge

    I hope that helps anyone else. I am using this to rate limit users which connect via pppoe through a router at CPE and authenticate through freeradius on the pfsense box. I am starting a WISP and was doing some testing and didn't want to limit via the pfsense traffic shaping feature but better through the MPD5 pppoe server instead.



  • Hi,
    I tried your findings in this post, but it did not work for me. I did everything as you did. Freeradius complains about not knowing "mpd-limit", and does not start. If I remove the attributes, Freeradius starts and I can browse the internet and all through my NAS/client.

    What version of PFsense and MPD were you using? Any other suggestions?

    I created another post here yesterday about using an external Freeradius server, because I could not get the one on PFsense to work the way I want.


Log in to reply