I'm at a loss as to why I'm seeing this error and unable to attempt User login authentication via Radius. I'm at a development stage in setup and testing. I've reviewed a number of posts both related to User Manager and FreeRadius and have not found any information to shed light on this problem. Perhaps someone might have some insight on this issue. As you will notice, the router is talking to the Radius server and in fact sending and receiving an Accounting-Request. However, when attempting to send and Access-Request the router log indicates it can't reach the Radius server. This makes no sense. The router is set up on a bench in my NOC. There are no FW rules, NAT'ing, or Masq on the router. Ping and routing are good, as evidenced by the sending and receipt of the Accounting-Request. I have increased Timeout to 2s as well. Any ideas what might be my issue; something obvious I'm overlooking? Please let me know if there is something I can provide to assist. Thank you very much.
RB750GL RouterOS v5.25 (tried 5.18, 5.22) - IP 10.10.0.10
FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu - IP 10.0.0.28
What I see on the router:
Code: Select all
jan/02/1970 00:01:09 radius,debug sending 05:00 to 10.0.0.28:1813
jan/02/1970 00:01:09 radius,debug,packet sending Accounting-Request with id 5 to 1
0.0.0.28:1813
jan/02/1970 00:01:09 radius,debug,packet Signature = 0xd0994a75ee2088f7f7de896
a08514e98
jan/02/1970 00:01:09 radius,debug,packet Acct-Status-Type = 7
jan/02/1970 00:01:09 radius,debug,packet NAS-Identifier = "MikroTik"
jan/02/1970 00:01:09 radius,debug,packet Acct-Delay-Time = 0
jan/02/1970 00:01:09 radius,debug,packet NAS-IP-Address = 10.10.0.10
jan/02/1970 00:01:09 radius,debug,packet received Accounting-Response with id 5 fr
om 10.0.0.28:1813
jan/02/1970 00:01:09 radius,debug,packet Signature = 0xa9a7880868d30cfa1d553b4
6e513dd13
jan/02/1970 00:01:09 radius,debug received reply for 05:00
17:04:19 radius,debug[b] new request 0d:02 code=Access-Request service=login
17:04:19 radius,debug no radius server found for 0d:02
17:04:19 radius,debug timeout for 0d:02Code: Select all
admin@MikroTik] /radius> monitor 0
pending: 0
requests: 6
accepts: 1
rejects: 0
resends: 0
timeouts: 5
bad-replies: 0
last-request-rtt: 10ms
Code: Select all
rad_recv: Accounting-Request packet from host 10.10.0.10 port 43000, id=5, length=48
Acct-Status-Type = Accounting-On
NAS-Identifier = "MikroTik"
Acct-Delay-Time = 0
NAS-IP-Address = 10.10.0.10
# Executing section preacct from file /etc/freeradius/sites-enabled/default
+- entering group preacct {...}
++[preprocess] returns ok
[acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent
[acct_unique] WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistent
[acct_unique] WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistent
[acct_unique] Hashing ',Client-IP-Address = 10.10.0.10,NAS-IP-Address = 10.10.0.10,,'
[acct_unique] Acct-Unique-Session-ID = "6c7617ab6a50b15d".
++[acct_unique] returns ok
[suffix] Proxy reply, or no User-Name. Ignoring.
++[suffix] returns ok
++[files] returns noop
# Executing section accounting from file /etc/freeradius/sites-enabled/default
+- entering group accounting {...}
[detail] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.10.0.10/detail-20130808
[detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.10.0.10/detail-20130808
[detail] expand: %t -> Thu Aug 8 03:00:44 2013
++[detail] returns ok
++[unix] returns noop
[radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp
rlm_radutmp: NAS 10.10.0.10 restarted (Accounting-On packet seen)
rlm_radutmp: Error accessing file /var/log/freeradius/radutmp: No such file or directory
++[radutmp] returns ok
++[exec] returns noop
[attr_filter.accounting_response] expand: %{User-Name} ->
++[attr_filter.accounting_response] returns noop
Sending Accounting-Response of id 5 to 10.10.0.10 port 43000
Finished request 1.
Cleaning up request 1 ID 5 with timestamp +1181
Going to the next request
Ready to process requests.Code: Select all
admin@MikroTik] /radius> print detail
Flags: X - disabled
0 service=login,hotspot called-id="mtr_bench" domain="test" address=10.0.0.28 secret="testing123" authentication-port=1812
accounting-port=1813 timeout=2s accounting-backup=no realm="" src-address=10.10.0.10
Code: Select all
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
# Keep state.
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Loop device.
-A INPUT -i lo -j ACCEPT
# Radius
-A INPUT -p udp -s 10.10.0.10 --dport 1812 -i eth0 -j ACCEPT
-A INPUT -p udp -s 10.10.0.10 --dport 1813 -i eth0 -j ACCEPT
-A INPUT -p udp -s 10.10.0.10 --dport 1814 -i eth0 -j ACCEPT
Code: Select all
root@radiusdev:/etc/freeradius# iptables --list
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT udp -- 10.10.0.10 anywhere udp dpt:radius
ACCEPT udp -- 10.10.0.10 anywhere udp dpt:radius-acct
ACCEPT udp -- 10.10.0.10 anywhere udp dpt:1814
ACCEPT udp -- x.x.x.x anywhere udp dpt:snmp
ACCEPT udp -- x.x.x.x anywhere udp dpt:snmp
ACCEPT udp -- x.x.x.x anywhere udp dpt:snmp
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- x.x.x.x anywhere tcp dpt:ssh
ACCEPT tcp -- x.x.x.x anywhere tcp dpt:ssh
ACCEPT tcp -- x.x.x.x anywhere tcp dpt:ssh
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT tcp -- x.x.x.x anywhere tcp dpt:mysql
ACCEPT tcp -- x.x.x.x anywhere tcp dpt:20133
ACCEPT tcp -- anywhere anywhere tcp dpt:http limit: avg 25/min burst 100
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination Code: Select all
client localhost {
ipaddr = 127.0.0.1
secret = testing123
require_message_authenticator = no
nastype = other
}
client dw_test {
ipaddr = 10.10.0.9
secret = testing123
require_message_authenticator = no
nastype = other
}
client 10.10.0.10 {
# ipaddr = 10.10.0.10
secret = testing123
require_message_authenticator = no
nastype = other
}
Code: Select all
"noctester" ClearText-Password := "mytestpw"
Reply-Message = "Hello, %{User-Name}"
