Skip to content

๐Ÿ“ก RADIUS Proxy Server Authentication Guide

๐Ÿ“Œ 1. Role of the Proxy Server

๐Ÿ”น Why is a Proxy Server Needed?

In the RADIUS authentication architecture, Proxy Server is mainly used to forward authentication requests rather than processing authentication directly. Its core role is to ensure that client authentication requests can reach the final RADIUS server in a distributed environment.

Proxy Server is essential in the following scenarios: - Enterprise WiFi authentication (e.g., Eduroam multi-site roaming) - Multi-level RADIUS authentication (e.g., ISP authentication systems) - Cross-national/cross-regional WiFi authentication (authentication forwarding between RADIUS servers in different countries)

๐Ÿ“ก 2. Proxy Server Workflow

1๏ธโƒฃ Client sends an EAP-TLS authentication request
2๏ธโƒฃ Proxy Server receives the request and forwards it to the final RADIUS Server
3๏ธโƒฃ RADIUS Server processes the authentication request and returns the result
4๏ธโƒฃ Proxy Server sends the result back to the client
5๏ธโƒฃ Client successfully connects to WiFi ๐ŸŽ‰

โš™๏ธ 3. Proxy Server Configuration

๐Ÿ“ 3.1 Device Environment

Device Role IP Address
MiniPC-1 Authentication Client (EAP-TLS) 192.168.8.220
Router (GL-AXT1800-83b-5G) Connects all devices, Proxy acts as RADIUS server N/A
MiniPC-2 Proxy Server (Forwards RADIUS authentication requests) 192.168.8.182
PC (RADIUS Server) Authentication Server (FreeRADIUS 3.0.26) 192.168.8.195

๐Ÿ“ 3.2 Ensure Proxy Server Can Connect to RADIUS Server

Test UDP 1812 Port Connectivity

nc -zvu 192.168.8.195 1812

โœ… UDP port 1812 is reachable, indicating Proxy Server can communicate with RADIUS Server.

๐Ÿ“ 3.3 Configure Proxy Server

๐Ÿ”น 1. Modify proxy.conf

proxy_requests = yes

realm DEFAULT {
    type = radius
    authhost = 192.168.8.195:1812
    accthost = 192.168.8.195:1813
    secret = shared_secret_key
}

โœ… Ensure Proxy Server acts only as a "relay" and not a "local authentication" server

๐Ÿ”น 2. Configure RADIUS Server to Allow Proxy

Add Proxy Server to clients.conf:

client 192.168.8.182 {
    secret = shared_secret_key
    shortname = proxy
}

โœ… Ensure the secret is consistent between Proxy Server and RADIUS Server to avoid errors

๐Ÿ”น 3. Start RADIUS Server and Proxy Server

systemctl restart freeradius

View logs:

journalctl -u freeradius -f

โœ… Ensure services are running normally without errors

๐Ÿ›  4. Conducting EAP-TLS Authentication Test

๐Ÿ“Œ 4.1 Configure EAP-TLS Client

Create eapol_test.conf:

network={
    ssid="GL-AXT1800-83b-5G"
    key_mgmt=WPA-EAP
    eap=TLS
    identity="testuser"
    anonymous_identity="testuser"
    ca_cert="/home/user/ca.crt"
    client_cert="/home/user/client.crt"
    private_key="/home/user/client.key"
    private_key_passwd=""
}

๐Ÿ“Œ 4.2 Run EAP-TLS Authentication

eapol_test -c ~/eapol_test.conf -s shared_secret_key -a 192.168.8.182 -p 1812

โœ… Proxy Server forwards the request to RADIUS Server, completing authentication

โœ… 5. Issues and Solutions

๐Ÿ”ด 1. Proxy Server Did Not Forward Requests Correctly

โŒ Issue

  • The Proxy Server did not forward the EAP-TLS authentication request but handled authentication locally instead.
  • No authentication request forwarding was found in the radiusd -X logs.

โœ… Solution

  1. Enable proxy forwarding ini proxy_requests = yes
  2. Ensure realm configuration in proxy.conf is correct ini realm DEFAULT { type = radius authhost = 192.168.8.195:1812 accthost = 192.168.8.195:1813 secret = shared_secret_key auth_pool = my_auth_failover # Replace with your own configuration }
  3. Restart FreeRADIUS sh systemctl restart freeradius โœ… Successfully forwarded EAP-TLS authentication requests to the RADIUS Server! ๐ŸŽ‰

๐Ÿ”ด 2. Certificate Chain Error

โŒ Issue

  • eapol_test authentication failed, with logs showing: Certificate chain - 1 cert(s) untrusted
  • RADIUS Server logs showed: TLS Alert read: warning: unknown CA

โœ… Solution

  1. Ensure eap.conf on the RADIUS Server is configured correctly ini tls-config tls-common { private_key_file = /etc/freeradius/3.0/certs/server.key certificate_file = /etc/freeradius/3.0/certs/server.pem ca_file = /etc/freeradius/3.0/certs/ca.pem }
  2. Import the CA certificate on the client sh scp [email protected]:/etc/freeradius/3.0/certs/ca.crt ~/Desktop/ โœ… Certificates successfully matched, authentication passed! ๐ŸŽ‰

๐Ÿ“Œ 6. Future Optimization Directions

  • ๐ŸŒ Multi-level Proxy Authentication Testing: Attempt secondary forwarding of authentication requests
  • ๐Ÿ“Š Authentication Delay Optimization: Measure additional latency introduced by Proxy Server
  • ๐Ÿ” Certificate Management Optimization: Simplify client certificate import process to ensure automatic trust of RADIUS CA

๐Ÿ“Œ References