3 ## clients.conf -- client configuration directives
7 #######################################################################
9 # Define RADIUS clients (usually a NAS, Access Point, etc.).
12 # Defines a RADIUS client.
14 # '127.0.0.1' is another name for 'localhost'. It is enabled by default,
15 # to allow testing of the server after an initial installation. If you
16 # are not going to be permitting RADIUS queries from localhost, we suggest
17 # that you delete, or comment out, this entry.
22 # Each client has a "short name" that is used to distinguish it from
25 # In version 1.x, the string after the word "client" was the IP
26 # address of the client. In 2.0, the IP address is configured via
27 # the "ipaddr" or "ipv6addr" fields. For compatibility, the 1.x
28 # format is still accepted.
31 # Only *one* of ipaddr, ipv4addr, ipv6addr may be specified for
34 # ipaddr will accept IPv4 or IPv6 addresses with optional CIDR
35 # notation '/<mask>' to specify ranges.
37 # ipaddr will accept domain names e.g. example.org resolving
40 # If both A and AAAA records are found, A records will be
41 # used in preference to AAAA.
44 # Same as ipaddr but allows v4 addresses only. Requires A
45 # record for domain names.
46 # ipv4addr = * # any. 127.0.0.1 == localhost
48 # Same as ipaddr but allows v6 addresses only. Requires AAAA
49 # record for domain names.
50 # ipv6addr = :: # any. ::1 == localhost
53 # A note on DNS: We STRONGLY recommend using IP addresses
54 # rather than host names. Using host names means that the
55 # server will do DNS lookups when it starts, making it
56 # dependent on DNS. i.e. If anything goes wrong with DNS,
57 # the server won't start!
59 # The server also looks up the IP address from DNS once, and
60 # only once, when it starts. If the DNS record is later
61 # updated, the server WILL NOT see that update.
65 # The transport protocol.
67 # If unspecified, defaults to "udp", which is the traditional
68 # RADIUS transport. It may also be "tcp", in which case the
69 # server will accept connections from this client ONLY over TCP.
74 # The shared secret use to "encrypt" and "sign" packets between
75 # the NAS and FreeRADIUS. You MUST change this secret from the
76 # default, otherwise it's not a secret any more!
78 # The secret can be any string, up to 8k characters in length.
80 # Control codes can be entered vi octal encoding,
81 # e.g. "\101\102" == "AB"
82 # Quotation marks can be entered by escaping them,
85 # A note on security: The security of the RADIUS protocol
86 # depends COMPLETELY on this secret! We recommend using a
87 # shared secret that is composed of:
93 # And is at LEAST 8 characters long, preferably 16 characters in
94 # length. The secret MUST be random, and should not be words,
95 # phrase, or anything else that is recognisable.
97 # The default secret below is only for testing, and should
98 # not be used in any real environment.
103 # Old-style clients do not send a Message-Authenticator
104 # in an Access-Request. RFC 5080 suggests that all clients
105 # SHOULD include it in an Access-Request. The configuration
106 # item below allows the server to require it. If a client
107 # is required to include a Message-Authenticator and it does
108 # not, then the packet will be silently discarded.
110 # allowed values: yes, no
111 require_message_authenticator = no
114 # The short name is used as an alias for the fully qualified
115 # domain name, or the IP address.
117 # It is accepted for compatibility with 1.x, but it is no
118 # longer necessary in >= 2.0
120 # shortname = localhost
123 # the following three fields are optional, but may be used by
124 # checkrad.pl for simultaneous use checks
128 # The nas_type tells 'checkrad.pl' which NAS-specific method to
129 # use to query the NAS for simultaneous use.
131 # Permitted NAS types are:
145 # other # for all other types
148 nas_type = other # localhost isn't usually a NAS...
151 # The following two configurations are for future use.
152 # The 'naspasswd' file is currently used to store the NAS
153 # login name and password, which is used by checkrad.pl
154 # when querying the NAS for simultaneous use.
157 # password = someadminpas
160 # As of 2.0, clients can also be tied to a virtual server.
161 # This is done by setting the "virtual_server" configuration
162 # item, as in the example below.
164 # virtual_server = home1
167 # A pointer to the "home_server_pool" OR a "home_server"
168 # section that contains the CoA configuration for this
169 # client. For an example of a coa home server or pool,
170 # see raddb/sites-available/originate-coa
174 # Response window for proxied packets. If non-zero,
175 # then the lower of (home, client) response_window
178 # i.e. it can be used to lower the response_window
179 # packets from one client to a home server. It cannot
180 # be used to raise the response_window.
182 # response_window = 10.0
185 # Connection limiting for clients using "proto = tcp".
187 # This section is ignored for clients sending UDP traffic
191 # Limit the number of simultaneous TCP connections from a client
194 # Setting this to 0 means "no limit"
197 # The per-socket "max_requests" option does not exist.
200 # The lifetime, in seconds, of a TCP connection. After
201 # this lifetime, the connection will be closed.
203 # Setting this to 0 means "forever".
207 # The idle timeout, in seconds, of a TCP connection.
208 # If no packets have been received over the connection for
209 # this time, the connection will be closed.
211 # Setting this to 0 means "no timeout".
213 # We STRONGLY RECOMMEND that you set an idle timeout.
220 client localhost_ipv6 {
225 # All IPv6 Site-local clients
226 #client sitelocal_ipv6 {
227 # ipv6addr = fe80::/16
228 # secret = testing123
231 #client example.org {
232 # ipaddr = radius.example.org
233 # secret = testing123
237 # You can now specify one secret for a network of clients.
238 # When a client request comes in, the BEST match is chosen.
239 # i.e. The entry from the smallest possible network.
241 #client private-network-1 {
242 # ipaddr = 192.0.2.0/24
243 # secret = testing123-1
246 #client private-network-2 {
247 # ipaddr = 198.51.100.0/24
248 # secret = testing123-2
251 #######################################################################
253 # Per-socket client lists. The configuration entries are exactly
254 # the same as above, but they are nested inside of a section.
256 # You can have as many per-socket client lists as you have "listen"
257 # sections, or you can re-use a list among multiple "listen" sections.
259 # Un-comment this section, and edit a "listen" section to add:
260 # "clients = per_socket_clients". That IP address/port combination
261 # will then accept ONLY the clients listed in this section.
263 #clients per_socket_clients {
264 # client socket_client {
266 # secret = testing123