How To Configure FreeRadius on pfsense and static assign IP addresses to VPN users

[@ChadHigh09]

These videos are excellent. I dont subscribe to a lot of channels but, Tom has the right thing going here.

[@zmullin1]

Can you do a video where you setup 2 factor auth with openvpn ?

[@marjundelarama9749]

Thak you sir Tom for having this video. I've been watching your videos it helps a lot. Thumbs up.

[@chanabra]

Thanks for this. I have seen many of your videos and you have been a fantastic resource for me - configuring my network on my relatively new homelab setup. I recently decided I wanted a more formal authentication process for various services on my lab and it appears that I could use FreeRadius package on pfsense to accomplish this. This is fantastic for me as I am using a post-bug SuperMicro A1SRI-C2758 w/ 32gb ecc ram (purchased this much thinking I would virtualize pfsense on proxmox, then discovered pfsense supports atom c2758 QAT so back to baremetal) - and being a small household this is alot of hardware for a small house so I am thrilled I can get more use out of pfsense. thank you for the video keep em coming.

[@alex.prodigy]

I don't know how outdated this freeradius configuration is but thanks for the video guide. The user still shows as connected because it's using UDP which is connectionless , so there's an option that you can add in the OVPN client config to notify the server that you disconnected And second , you can't change the IP address client side because the server keeps track of which client has which address and i think it does some kind of checksum when packets are received , if it doesn't match ... the packet is dropped

[@qwerty74]

loving the pfSense videos. keep it up!

[@jycannel4626]

I need to implement this into my stack! As always great video!

[@barrikin]

I'd be interested in a video detailing the linking FreeNAS to use the pfsense radius for user/group file permissions.

[@m1ni_m4l]

Thanks man, that really helped me setting my radius server to configure 2fa auth! You should do a video also explaining the 2fa configuration in pfsense, cause i couldn't find nothing really direct in that theme. Success!

[@LasVegasVocalist]

Great Video Tom! I haven't used RADIUS in quite some time. I have also implemented and used TACACS+ in the data center for access to all the network hardware within. Oh those were the good ole days.

[@LasVegasVocalist]

@Grayson Peddie Yes, It's primarily for Cisco devices. However, I have seen a few oddball installs for server authentication (Non Cisco gear) . Good Job on getting the Network+ Cert. There are books specifically on TACACS+ and include some details on RADIUS and a few other AAA protocols. Then you could setup a Virtual Lab to practice setting it all up. As you get into more controlled environments such as a data center vs. a small corporate office you will NEED TACACS+ to prevent the Rogue or Misconfigured switch or router showing up in your network causing havoc. Been there done that, only once fortunately. With TACACS+ every networking device within your network is an authenticated one. So if a Rogue device shows up, It can do almost nothing to your network. AND, with TACACS+, EVERYTHING is encrypted. No packet sniffers and script kiddies getting your credentials or configuration details. RADIUS claims encryption of password data but how hard is it to create a rainbow table of MD5 Hashes? TACACS+ all the way.

[@cammelspit]

VERY interesting, ive never considered using an auth server like this. I do have a bunch of outward facing services and I use a reverse proxy for those but a good few of them do support using a radius server for auth, might be worth looking into. THANKS!

[@jeremyalbert9183]

Great video. I will need to implement this soon. I setup OpenVPN and it works great for games that use DirectIP. The problem is that it doesn't work for games that use open LAN broadcasts. At least I haven't gotten it to work. Hamachi works sometimes and for some games but I need OpenVPN to work like the "Evolve" service (which is no longer available). Can this be done with OpenVPN?

[@jonathangarcia4959]

This is way better but I still have one concern with this. I got it set up and it got me thinking. Can this be brute forced? Unlike applications like Duo where you get a pop up on your phone and you press a green button, you are inputting a random generated number in which if you do not have it set up to lock, someone can definitely brute force this with a lucky random guess.

[@Unit2020]

Hi. First thanks for creating such helpful videos. I have a question about setting up Radius. Will it allow me to... 1) Set a fail limit on logins| 2) Set a retry delay after hitting the limit. 3) Alert the admin when someone hits the fail limit? Thanks, Rob

[@LAWRENCESYSTEMS]

No, don't think that is supported with the built in FreeRadius.

[@fossdom5568]

I just setup FreeRADIUS last week for home wifi authentication for testing purposes,works okay.

[@hassanmusa2201]

Thank you

[@dirkwauters957]

Good content! Keep it coming. Big tumbs up!

[@joedickinson1241]

Could you also use this for account auth for FreeNAS?

[@emilhuseynli]

Hi Tom, you are assigning a static IP to VPN user via RADIUS settings, but I've noticed that the same effect can be achieved by using 'VPN/OpenVPN/Client Specific Overrides'. There you can override the 'IPv4 Tunnel Network' setting, which results in a user getting that specific IP on establishing a VPN connection. In addition you can also define other user specific settings like dns servers. What do you think about it, is it a proper way to set a static IP? :)

[@LAWRENCESYSTEMS]

I have not tested it.

[@harryrickenbach5890]

How about using free RADIUS for authentication for Wi-Fi

[@eyurtese]

Hi, it is a quite nice video. You said you do not like to do unnecessary settings :) but you have setup accounting server for freeradius. Yet you did not check the accounting logs etc. Where are they and how do you check it?

[@TMC-CSG]

Thanks Tom, Fantastic tutorial! Is it possible without creating different users to allow a single authentication login that would assign the first connection to connect to a specific address, but allow them to be assigned to a pool if they sign in under multiple devices?

[@abdraoufx]

awesome i needed this and didn't even know it existed

[@jonny1218]

Great video. Could you do a video on a Ubiquiti Dream machine pro RADIUS server setup?

[@cyberbud]

Followed everything, worked well, but when I restrict one use to connect only to specific network, it loses internet. If I assign any permission, then Internet works. How to fix that ?

[@PowerUsr1]

This is interesting. How is this different than OpenVPN Client Override?

[@prudentialpropertiesl.l.c2778]

Excellent Briefing...

[@bytetime]

Trying to setup a Radius server on PFSense to do Mac address authentication to allocate VLANs on my home network using PFSense and Unifi so I can move my IOT devices to their own VLAN and if they get moved on my network I don't have to reconfigure/tag ports because something got moved.

[@luqmanhaqim97]

Is it possible for the pfsense to be on the same device as the freeradius? I'm using my pfsense as a router that is connected to wan.

[@filipeeiti9003]

Hey Lawrence, Your videos are really good! Congratulations! Would you know how I can create two requirements for authentication? I'm using freeradius together with open vpn. I've implemented password authentication and it's functional. But along with this I wanted to validate the MacAddress of the device that is connecting. Would you know if it is possible?

[@LAWRENCESYSTEMS]

Not for a VPN

[@stefanmarkov7]

What do I have to consider when I'm setting up pfsense HA with pfsync and CARP? Will FreeRadius still work if I set it up on both Firewalls?

[@quangb8448]

Thank you for the setup tutorial. I'm unable to sort users inside FreeRadius. They seemed to be listed in the order that they were created. Even the Filters do not work. Is that common or is it my setup? Appreciate any info.

[@luisrondonpaz5842]

losted you completely in the lan config, there was a interface that were not there and now all the sudden we have a LAN2 ????

[@KristianKirilov]

Hey @Lawrence Systems, which is the PS1 extension you use in this Linux? I'm interested in PS1 shell script? Can you share that info? Thanks

[@LAWRENCESYSTEMS]

github.com/lawrencesystems/dotfiles

[@zmullin1]

Great video!!

[@merkava1988]

How if I want to use EAP along with freeradius? how to configure it?

[@TylerB_777]

I had this same question. I used this forum post to figure it out. It seems to also work for the follow up video with TOTP. NICE! forum.netgate.com/topic/82279/confused-about-openvpn-username-cert-radius/3 Theses are the steps I had to take in order for the OpenVPN Export tool to show the user: - Go to VPN > OpenVPN > Pencil icon. - Change Server mode to Remote Access (SSL/TSL + User Auth) - Go to Services > EAP > check Validate the Client Certificate Common Name - Now create a certificate using the FreeRadius CA that was created - Then make sure you match the username in FreeRadius with the common name while you create a certificate. - The user you created a certificate for should be in VPN > OpenVPN > Client Export

[@vadimg7140]

We have some non-commercial pfsense VM servers with openvpn deamons and many remote users connect to them.In each openvpn deamon we use freeradius authentication . The freeradius deamon is also installed in each pfsense VM server but no user database is there and we just use DEFAULT user with openLDAP authentication DEFAULT Auth-Type := LDAP. It works BUT now we need to restrict vpn sessions of remote users to only 1 for each user across all our pfsense VM servers. Is it possible at all in our situation or not ? If not how to accomplish this task with Pfsense environment ? Thank you

[@bitlogic7013]

Hey Lawrence can you do a video freeradius and Captive Portals and accounting with MySQL

[@LAWRENCESYSTEMS]

I don't use that setup, so not likely

[@bjarneeins]

With your setup my clients have to enter their login credentials every hour again, if they don't enter, the connection will be terminated. Is there any way around this and do you know why it is happening?

[@bjarneeins]

If someone is having the same problem: it could be due to the option "auth-nocache" in the client configuration. Which i added myself. :)

[@陳秉軒-c9b]

That 1 dislike came from waiting too long for this video.

[@derekchen4352]

Would FreeRadius using clear text to authenticate be an issue?

[@LAWRENCESYSTEMS]

If you are using it on pfsense, it never leave pfsense.

[@masterchef2408]

Thank You For The Video. I would still like to know how to block something like youtube.com on only one IP... like if i wanted to block youtube.com only on the "Amazon Fire TV Stick" .... i would really love a video on that using PFsense... Thank You

[@MAbdilahi]

you can use aliases with rules to block a specific website on pfsense if i am right here ,I have done it and it's working fine.

[@masterchef2408]

@@MAbdilahi MMmm I will give it a try, Thank You

[@masterchef2408]

@@MAbdilahi I just looked, all i see is ways to block all the IP's on my network from youtube... i'm trying to just block 1 IP from going to youtube

[@MAbdilahi]

@@masterchef2408 yes you can do that just make sure to make the IP address you wanted to block going to youtube to use aliases source address and the destination address will be youtube.com

[@masterchef2408]

@@MAbdilahi ? so i click on firewall>Aliases>IP>ADD>...under "TYPE" do i pick "HOST"? and add the IP of the computer i want to block? Also were do i put the destination address youtube.com ? Thank You

[@jesusdimalantajr648]

edited users file in /usr/loca/etc/raddb/users not reflecting on gui

[@CoreyThompson73]

Anyone here using RADIUS for VLAN steering with 802.1X?

[@antonio.luevano]

I have used it for Dynamic VLAN assignment using it for Ruckus APs / ZoneDirector. I'm currently working on leveraging it with Azure AD to provision accounts directly. Ping me if you have any q's. It isn't easy, but once is done, worth it.

[@nextto_official]

device 17 cant connect

[@landonscellphone6296]

i tried to follow what you were doing and why you were doing it, however you are speaking at too high of a level for me to understand. Thank you for making the video, but now i have more questions then before I watched this.

[@JasonLeaman]

Pfsense :( Barf!