From: Julian Gomez <kluivert@tm.net.my>
To: netfilter@lists.netfilter.org
Subject: Re: NAT authentication
Date: Thu, 17 Apr 2003 21:56:33 +0800 [thread overview]
Message-ID: <20030417135633.GC1518@floyd> (raw)
In-Reply-To: <OE539Bbw2oj1l489Ypx0002dde3@hotmail.com>
On Tue, Apr 15, 2003 at 05:51:14PM +0800, William spoke thusly:
> 1. When user want to connect to Internet by NAT.
What outgoing user services will be used ?
> 2. A prompt will show up to authenticate the users by RADIUS to a windows
> 2000 server.
If you are using it for plain http/https/ftp sessions, then I would suggest
plugging in a transparent proxy (eg: Squid), and have that perform the OOB
authentication to your RADIUS daemon.
Otherwise, if you need it for generic outgoing services, I think it might
be possible to plug in a SOCKS5 server with authentication to your Win2K
RADIUS daemon.
> 3. If the user is authenticated, NAT is done, and packet send to Internet.
See above, this won't touch iptables (except for the transparent proxying
most probably).
Another, probably less secure method would be to have the user authenticate
itself to some web server (Apache, checking your Win2K RADIUS db), if
successful have your gateway add in the appropriate rules. Otherwise just
ignore it. This means interfacing between the web server, radius + your
gateway.
--
"any nation that wants to control its borders can do so."
- Tommy Franks; Mexicans && Columbia Drug War ?
prev parent reply other threads:[~2003-04-17 13:56 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-04-15 9:51 NAT authentication Chen Kwong Wai William
2003-04-17 13:56 ` Julian Gomez [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030417135633.GC1518@floyd \
--to=kluivert@tm.net.my \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox