From 8434a13338fef0a08754c2c9017c5f2244ab1d91 Mon Sep 17 00:00:00 2001
From: "noussair.hamrit" <noussair.hamrit@helmholz.de>
Date: Thu, 10 Sep 2026 13:47:55 +0200
Subject: [PATCH] fix(freeradius): check IP after pool allocation

---
 files/sites-available/default | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/files/sites-available/default b/files/sites-available/default
index bd463cc..fc00bd7 100644
--- a/files/sites-available/default
+++ b/files/sites-available/default
@@ -446,15 +446,6 @@ authorize {
 			Pool-Name := "engineers-%{sql:SELECT split_part('%{User-Name}', '@', 2)}"
 		}
 	}
-	#
-	# HARD CHECK: must have IP
-	#
-	if (!&reply:Framed-IP-Address) {
-		update reply {
-			Reply-Message := "No IP assigned - access denied"
-		}
-		reject
-	}
 	#  If you are using /etc/smbpasswd, and are also doing mschap authentication, the un-comment this line, and configure the 'smbpasswd' module.
 #	smbpasswd
 
@@ -809,7 +800,16 @@ post-auth {
 
 		sqlippool
 	}
-
+    #
+	# HARD CHECK: must have IP
+	#
+	if (!&reply:Framed-IP-Address) {
+		update reply {
+			Reply-Message := "No IP assigned - access denied"
+		}
+		reject
+	}
+	
 	# Query VLAN ID from your DB
 	# VLAN assignment is no longer used
 	#vlan_test