Disclaimer! This is important!
Every Network is different , so one solution cannot be applied to all. Therefore try to understand logic & create your own solution as per your network scenario. Just dont follow copy paste.
If anybody here thinks I am an expert on this stuff, I am NOT certified in anything Mikrotik/Cisco/Linux or Windows. However I have worked with some core networks and I read , research & try stuff all of the time. So I am not speaking/posting about stuff I am formerly trained in, I pretty much go with experience and what I have learned on my own. And , If I don’t know something then I read & learn all about it.
So , please don’t hold me/my-postings to be always 100 percent correct. I make mistakes just like everybody else. However – I do my best, learn from my mistakes and always try to help others.
Regard’s
Syed Jahanzaib~
Scenario:
- We have FREERADIUS installed as a AAA system in Ubuntu 16.04 server
- Mikrotik version 6.44 is acting as PPPoE NAS connected with radius for AAA
Requirement:
When any user connects with our NAS, he should be added to mikrotik dynamic address list under IP > firewall > address list, so that we can manipulate this address list for different tasks, example mark connections/packets/routing and use them in Queues / Routes section or perform different sort of filtering as required.
In this particular task we are dynamically adding user in particular address list using radius attributes, then using this address list packet marking is being made, and then in Queues we are using these marked packets for different sort of bandwidth policies, example for normal internet we will limit 1mb per user , and for CDN traffic we will add addition 2mb for YT & FB. [and vice versa for different packages accordingly]
Solution:
We will use Mikrotik-Address-List attribute in radgroupreply section. as shown here.
1# Adding User entry in RADCHECK table so user can authenticate …
1 2 3 4 5 6 7 | mysql> select * from radcheck;+----+----------+--------------------+----+-------------------+| id | username | attribute | op | value |+----+----------+--------------------+----+-------------------+| 1 | zaib | Cleartext-Password | := | zaib |+----+----------+--------------------+----+-------------------+1 rows in set (0.01 sec) |
2# Adding Radius Group Reply for 1mb Group, Example 1mb group user will get 1mb dynamic queue plus they will be added dynamically in address list name 1mb
1 2 3 4 5 6 7 8 | mysql> select * from radgroupreply;+----+-----------+-----------------------+----+--------------+| id | groupname | attribute | op | value |+----+-----------+-----------------------+----+--------------+| 21 | 1mb | Mikrotik-Rate-Limit | == | 1024k/1024k || 22 | 1mb | Mikrotik-Address-List | := | 1mb |+----+-----------+-----------------------+----+--------------+2 rows in set (0.00 sec) |
2# Adding username ZAIB in the Radius user group & assign him 1mb Group.
1 2 3 4 5 6 7 | mysql> select * from radusergroup;+----+----------+-----------+----------+| id | username | groupname | priority |+----+----------+-----------+----------+| 5 | zaib | 1mb | 1 |+----+----------+-----------+----------+1 row in set (0.00 sec) |
RADTEST:
Now we will test user via RADTEST cmd …
1 | radtest zaib zaib localhost 1812 testing123 |
Result:
1 2 3 4 5 6 7 8 9 10 | Sending Access-Request of id 130 to 127.0.0.1 port 1812User-Name = "zaib"User-Password = "zaib"NAS-IP-Address = 101.11.11.254NAS-Port = 1812Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=130, length=50Mikrotik-Rate-Limit = "1024k/1024k"Mikrotik-Address-List = "1mb" |
Freeradius Debug Result:
1 2 3 4 | Sending Access-Accept of id 156 to 127.0.0.1 port 34563Mikrotik-Rate-Limit == "1024k/1024k"Mikrotik-Address-List := "1mb"Finished request 32. |
Now try to connect user from your user device, & upon connection you will see new address list entry for this user IP ..
& its 1mb queues have been created as well
# Mikrotik Mangling & Queueing Section !
Now we will move towards Mikrotik related configuration for mangling & queue. in above steps we added DYNAMIC queue for test purposes, & as we will be using simple queues therefore we need to remove the dynamic queue, Do so , then we will move further …
- Marking upload & download separately for 1mb user address list …
1 2 3 | /ip firewall mangleadd action=mark-packet chain=forward comment="1mb users UPLOAD" new-packet-mark=1mb_users_up src-address-list=1mb passthrough=noadd action=mark-packet chain=forward comment="1mb users DOWNLOAD" dst-address-list=1mb new-packet-mark=1mb_users_down passthrough=no |
- Creating PCQ base 1mb download/upload limit variable …
1 2 3 | /queue typeadd kind=pcq name=download-1mb pcq-classifier=dst-address pcq-dst-address6-mask=64 pcq-rate=1024k pcq-src-address6-mask=64add kind=pcq name=upload-1mb pcq-classifier=src-address pcq-dst-address6-mask=64 pcq-rate=1024k pcq-src-address6-mask=64 |
- Creating PCQ base simple Queues to actual limit each user with 1mb download/upload …
1 2 3 | /queue simpleadd name="1mb user DOWN - PCQ" packet-marks=1mb_users_down queue=upload-1mb/download-1mb target=""add name="1mb user UP - PCQ" packet-marks=1mb_users_up queue=128k-per-user/128k-per-user target="" |
PC#1
PC#2
TIPS:
How to remove all dynamic queues [can be used in script login section]
