Issue with AAA server auth req routing

[Tribbio]

Hi everybody.

I have a problem with my radius server.

I have an SSID (on the site A), that use a VM with freeradius (on the site B).

Both sites are linked eachother with a VPN connection.

On my SSID configuration I put an public address 193.xxx.xxx.95 (which is the ip addres on the VM), in the field MyRadius.

The AAA process seems to work but every time someone try to connect on the site A, the radius server recieve auth request from the public IP of the site A.

Therefore, the connection pass through internet insted of VPN connection.

I've already configurated a VPN connection through public ip 193.xxx.xxx.3 (site B).

And other SSIDs are able to comunicate with other radius servers (on site B) through VPN, the only difference is that other SSIDs use radius servers configurated with local ip (172.xxx.xxx.xxx).

Can someone please tell me how to directing traffic through VPN using 193.xxx.xxx.95?

Thank you.

[RaphaelL]

Hi ,

Why are you not using the LAN IP of the Radius server ? Is the routing between the 2 sites even working ?

[Tribbio]

Unfortunately the Radius is a VM with only an ethernet interface (configured with public ip). Is It necessary or there's another way to bypass this issue?

I mean, I think I could add another interface with a local ip address.

Do u think this will solve the problem?

[RaphaelL]

What a weird setup. 

You are sending / receiving RADIUS request over the Internet without encryption ( RadSec ) ? 

[Tribbio]

Yep I know ahahha.

I'm talking abt freeradius, for eduroam service.

If u know this service.

[alemabrahao]

You have to use your radius private IP instead of the public IP.

[Tribbio]

Unfortunately the Radius is a VM with only an ethernet interface (configured with public ip). Is It necessary or there's another way to bypass this issue?

I mean, I think I could add another interface with a local ip address.

Do u think this will solve the problem?

[alemabrahao]

I highly advise you to do this instead of leaving your server exposed to the internet.