From c8c416db7e2fbba3ecb08bbcce6e0ff4616ab0b7 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Fri, 4 May 2007 16:48:32 +0000 Subject: [PATCH] further changes to 1.3 for pppoe server and pptp server. added to gui add radius acct and auth ports add acct update in seconds option for external radius servers add backup radius server changes rearranges xml for better use moved radius specific features inside tags added options for additional server above 2 miner bug fixes Ticket #1306 --- etc/inc/vpn.inc | 54 ++++++---- usr/local/www/vpn_pppoe.php | 172 +++++++++++++++++++----------- usr/local/www/vpn_pptp.php | 204 +++++++++++++++++++++--------------- 3 files changed, 265 insertions(+), 165 deletions(-) diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 2c8555d9ad..61043194e6 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -678,10 +678,17 @@ EOD; EOD; } - if (isset($pptpdcfg["wins"])) - $mpdconf .= " set ipcp nbns {$pptpdcfg['wins']}\n"; - if (is_array($pptpdcfg['dnsserver']) && ($pptpdcfg['dnsserver'][0])) { - $mpdconf .= " set ipcp dns " . join(" ", $pptpdcfg['dnsserver']) . "\n"; + if (isset($pptpdcfg['wins'])) { + $mpdconf .= << - + + DNS servers + + +
+ +
+ If entered they will be given to all pppoe clients else lan dns and one wan dns will go to all clients
+ + RADIUS @@ -335,36 +385,56 @@ function enable_change(enable_over) {
> Enable RADIUS accounting
- Sends accounting packets to the RADIUS server. +
+ Sends accounting packets to the RADIUS server.
+ > + Use Backup Radius Server
+ When set, if primary server fails all requests will be sent via backup server + + + NAS IP ADDRESS + + +
radius server NAS ip Address
+ + + + Radius Accounting Update + + +
Radius accounting update period in seconds + + + + RADIUS issued IP's + + > +
Issue IP Addresses via RADIUS server. RADIUS server Primary -
- Enter the IP address of the RADIUS server. + + +
Enter the IP address and portof the RADIUS server. Format ip auth_port acct_port
+
standard port 1812 and 1813 accounting RADIUS primary shared secret -
- Enter the shared secret that will be used to authenticate +
Enter the shared secret that will be used to authenticate to the RADIUS server. - - - > - Use Backup Radius Server
- When set, all users will be authenticated using - the RADIUS server specified below. The local user database - will not be used. RADIUS server Secondary -
- Enter the IP address of the RADIUS server. + + +
Enter the IP address and port of the BACKUP RADIUS server. Format ip auth_port acct_port
+
standard port 1812 and 1813 accounting RADIUS secondary shared secret @@ -374,29 +444,6 @@ function enable_change(enable_over) { Enter the shared secret that will be used to authenticate to the RADIUS server. - - NAS IP ADDRESS - - -
- radius server NAS ip Address
- - - - Radius Accounting Update - - -
Radius accounting update period in seconds
- - - - RADIUS issued IP's - - > -
Issue IP Addresses via RADIUS server. - - - @@ -426,4 +473,3 @@ enable_change(false); - diff --git a/usr/local/www/vpn_pptp.php b/usr/local/www/vpn_pptp.php index fe5f2302b6..ae54418bef 100755 --- a/usr/local/www/vpn_pptp.php +++ b/usr/local/www/vpn_pptp.php @@ -41,18 +41,24 @@ $pconfig['redir'] = $pptpcfg['redir']; $pconfig['mode'] = $pptpcfg['mode']; $pconfig['wins'] = $pptpcfg['wins']; $pconfig['req128'] = isset($pptpcfg['req128']); -$pconfig['radiusenable'] = isset($pptpcfg['radius']['enable']); -$pconfig['radiusissueips'] = isset($pptpdcfg['radius']['radiusissueips']); -$pconfig['radiussecenable'] = isset($pptpcfg['radius']['secenable']); -$pconfig['radacct_enable'] = isset($pptpcfg['radius']['accounting']); -$pconfig['radiusserver'] = $pptpcfg['radius']['server']; -$pconfig['radiussecret'] = $pptpcfg['radius']['secret']; -$pconfig['radiusserver2'] = $pptpcfg['radius']['server2']; -$pconfig['radiussecret2'] = $pptpcfg['radius']['secret2']; $pconfig['n_pptp_units'] = $pptpcfg['n_pptp_units']; $pconfig['pptp_subnet'] = $pptpcfg['pptp_subnet']; -$pconfig['radius_acct_update'] = $pptpcfg['radius_acct_update']; -$pconfig['radius_nasip'] = $pptpcfg['radius_nasip']; +$pconfig['pptp_dns1'] = $pptpcfg['dns1']; +$pconfig['pptp_dns2'] = $pptpcfg['dns2']; +$pconfig['radiusenable'] = isset($pptpcfg['radius']['enable']); +$pconfig['radiusissueips'] = isset($pptpcfg['radius']['radiusissueips']); +$pconfig['radiussecenable'] = isset($pptpcfg['radius']['server2']['enable']); +$pconfig['radacct_enable'] = isset($pptpcfg['radius']['accounting']); +$pconfig['radiusserver'] = $pptpcfg['radius']['server']['ip']; +$pconfig['radiusserverport'] = $pptpcfg['radius']['server']['port']; +$pconfig['radiusserveracctport'] = $pptpcfg['radius']['server']['acctport']; +$pconfig['radiussecret'] = $pptpcfg['radius']['server']['secret']; +$pconfig['radiusserver2'] = $pptpcfg['radius']['server2']['ip']; +$pconfig['radiusserver2port'] = $pptpcfg['radius']['server2']['port']; +$pconfig['radiusserver2acctport'] = $pptpcfg['radius']['server2']['acctport']; +$pconfig['radiussecret2'] = $pptpcfg['radius']['server2']['secret2']; +$pconfig['radius_acct_update'] = $pptpcfg['radius']['acct_update']; +$pconfig['radius_nasip'] = $pptpcfg['radius']['nasip']; if ($_POST) { @@ -120,17 +126,31 @@ if ($_POST) { if (!$input_errors) { $pptpcfg['remoteip'] = $_POST['remoteip']; $pptpcfg['redir'] = $_POST['redir']; - $pptp['localip'] = $_POST['localip']; + $pptpcfg['localip'] = $_POST['localip']; $pptpcfg['mode'] = $_POST['mode']; $pptpcfg['wins'] = $_POST['wins']; $pptpcfg['n_pptp_units'] = $_POST['n_pptp_units']; $pptpcfg['pptp_subnet'] = $_POST['pptp_subnet']; - $pptpcfg['radius']['server'] = $_POST['radiusserver']; - $pptpcfg['radius']['secret'] = $_POST['radiussecret']; - $pptpcfg['radius']['server2'] = $_POST['radiusserver2']; - $pptpcfg['radius']['secret2'] = $_POST['radiussecret2']; - $pptpcfg['radius_nasip'] = $_POST['radius_nasip']; - $pptpcfg['radius_acct_update'] = $_POST['radius_acct_update']; + $pptpcfg['radius']['server']['ip'] = $_POST['radiusserver']; + $pptpcfg['radius']['server']['port'] = $_POST['radiusserverport']; + $pptpcfg['radius']['server']['acctport'] = $_POST['radiusserveracctport']; + $pptpcfg['radius']['server']['secret'] = $_POST['radiussecret']; + $pptpcfg['radius']['server2']['ip'] = $_POST['radiusserver2']; + $pptpcfg['radius']['server2']['port'] = $_POST['radiusserver2port']; + $pptpcfg['radius']['server2']['acctport'] = $_POST['radiusserver2acctport']; + $pptpcfg['radius']['server2']['secret2'] = $_POST['radiussecret2']; + $pptpcfg['radius']['nasip'] = $_POST['radius_nasip']; + $pptpcfg['radius']['acct_update'] = $_POST['radius_acct_update']; + + if ($_POST['pptp_dns1'] == "") + unset($pptpcfg['dns1']); + else + $pptpcfg['dns1'] = $_POST['pptp_dns1']; + + if ($_POST['pptp_dns2'] == "") + unset($pptpcfg['dns2']); + else + $pptpcfg['dns2'] = $_POST['pptp_dns2']; if($_POST['req128'] == "yes") $pptpcfg['req128'] = true; @@ -138,14 +158,14 @@ if ($_POST) { unset($pptpcfg['req128']); if($_POST['radiusenable'] == "yes") - $pptpcfg['radius']['enable'] = true; + $pptpcfg['radius']['server']['enable'] = true; else - unset($pptpcfg['radius']['enable']); + unset($pptpcfg['radius']['server']['enable']); if($_POST['radiussecenable'] == "yes") - $pptpcfg['radius']['secenable'] = true; + $pptpcfg['radius']['server']['enable'] = true; else - unset($pptpcfg['radius']['secenable']); + unset($pptpcfg['radius']['server2']['enable']); if($_POST['radacct_enable'] == "yes") $pptpcfg['radius']['accounting'] = true; @@ -199,46 +219,62 @@ function enable_change(enable_over) { document.iform.wins.disabled = 0; document.iform.n_pptp_units.disabled = 0; document.iform.pptp_subnet.disabled = 0; + document.iform.pptp_dns1.disabled = 0; + document.iform.pptp_dns2.disabled = 0; if (document.iform.radiusenable.checked || enable_over) { document.iform.radiussecenable.disabled = 0; document.iform.radacct_enable.disabled = 0; document.iform.radiusserver.disabled = 0; + document.iform.radiusserverport.disabled = 0; + document.iform.radiusserveracctport.disabled = 0; document.iform.radiussecret.disabled = 0; document.iform.radius_nasip.disabled = 0; document.iform.radius_acct_update.disabled = 0; document.iform.radiusissueips.disabled = 0; + if (document.iform.radiussecenable.checked || enable_over) { + document.iform.radiusserver2.disabled = 0; + document.iform.radiussecret2.disabled = 0; + document.iform.radiusserver2port.disabled = 0; + document.iform.radiusserver2acctport.disabled = 0; + } else { + + document.iform.radiusserver2.disabled = 1; + document.iform.radiussecret2.disabled = 1; + document.iform.radiusserver2port.disabled = 1; + document.iform.radiusserver2acctport.disabled = 1; + } } else { document.iform.radacct_enable.disabled = 1; document.iform.radiusserver.disabled = 1; + document.iform.radiusserverport.disabled = 1; + document.iform.radiusserveracctport.disabled = 1; document.iform.radiussecret.disabled = 1; document.iform.radius_nasip.disabled = 1; document.iform.radius_acct_update.disabled = 1; document.iform.radiusissueips.disabled = 1; } - if (document.iform.radiussecenable.checked || enable_over) { - document.iform.radiusserver2.disabled = 0; - document.iform.radiussecret2.disabled = 0; - } else { - - document.iform.radiusserver2.disabled = 1; - document.iform.radiussecret2.disabled = 1; - } } else { document.iform.remoteip.disabled = 1; document.iform.localip.disabled = 1; document.iform.req128.disabled = 1; document.iform.n_pptp_units.disabled = 1; document.iform.pptp_subnet.disabled = 1; + document.iform.pptp_dns1.disabled = 1; + document.iform.pptp_dns2.disabled = 1; document.iform.radiusenable.disabled = 1; document.iform.radacct_enable.disabled = 1; document.iform.radiusserver.disabled = 1; + document.iform.radiusserverport.disabled = 1; + document.iform.radiusserveracctport.disabled = 1; document.iform.radiussecret.disabled = 1; document.iform.radius_nasip.disabled = 1; document.iform.radius_acct_update.disabled = 1; document.iform.radiussecenable.disabled = 1; document.iform.radiusserver2.disabled = 1; + document.iform.radiusserver2port.disabled = 1; + document.iform.radiusserver2acctport.disabled = 1; document.iform.radiussecret2.disabled = 1; document.iform.wins.disabled = 1; document.iform.radiusissueips.disabled = 1; @@ -276,7 +312,7 @@ function enable_change(enable_over) {   -> + > Redirect incoming PPTP connections to: PPTP redirection @@ -288,14 +324,9 @@ function enable_change(enable_over) {   -> + > Enable PPTP server - - Max. concurrent - connections - - - + Server address @@ -346,55 +377,38 @@ function enable_change(enable_over) {
Hint: 10 is TEN pptp clients + + PPTP DNS Servers + + +
+ +
+ + primary and secondary dns servers for pptp clients
+ + + WINS Server + + + + RADIUS > - Use a RADIUS server for authentication
- When set, all users will be authenticated using + Use a RADIUS server for authentication
+ When set, all users will be authenticated using the RADIUS server specified below. The local user database will not be used.

> Enable RADIUS accounting
- Sends accounting packets to the RADIUS server. - - - RADIUS server - - -
- Enter the IP address of the RADIUS server. - - - RADIUS shared secret - - -
- Enter the shared secret that will be used to authenticate - to the RADIUS server. - - + Sends accounting packets to the RADIUS server.
+
> - Use a backup RADIUS server for failover authentication
- When set, all users will be authenticated using - the RADIUS server specified below. The local user database - will not be used - - - BACKUP RADIUS server - - -
- Enter the IP address of the RADIUS server. - - - BACKUP RADIUS shared secret - - -
- Enter the shared secret that will be used to authenticate - to the RADIUS server. + backup RADIUS server for failover authentication
+ When set, if primary radius fails all request will go to the backup server Radius NAS IP @@ -413,14 +427,41 @@ function enable_change(enable_over) { >
Issue IP Addresses via RADIUS server. - - + - WINS Server + RADIUS server + + + + +
+ Enter the IP address of the RADIUS server. + + + RADIUS shared secret - - + +
+ Enter the shared secret that will be used to authenticate + to the RADIUS server. + + + BACKUP RADIUS server + + + + +
+ Enter the IP address of the RADIUS server. + + + BACKUP RADIUS shared secret + + +
+ Enter the shared secret that will be used to authenticate + to the RADIUS server. @@ -461,4 +502,3 @@ enable_change(false); -