Add RADIUS node pinning to enforce client connection to assigned OpenVPN node

2026-04-14 16:24:35 +02:00
parent 8c1289f92e
commit fca66dfa52
1 changed files with 13 additions and 0 deletions
@@ -418,7 +418,20 @@ authorize {
 	#
 	#  See "Authorization Queries" in mods-available/sql
 	sql
+	update control {
+        Tmp-String-0 := "%{sql:SELECT node_ip FROM node_assignments WHERE username='%{User-Name}'}"
+    }

+    if (&control:Tmp-String-0 == "") {
+        reject
+    }
+
+    if (&control:Tmp-String-0 != "%{NAS-IP-Address}") {
+        update reply {
+            Reply-Message := "Wrong node"
+        }
+        reject
+    }
 	#  If you are using /etc/smbpasswd, and are also doing mschap authentication, the un-comment this line, and configure the 'smbpasswd' module.
 #	smbpasswd