NAT authentication

NAT authentication

[Chen Kwong Wai William]

[-- Attachment #1: Type: text/plain, Size: 425 bytes --]

Dear all,

   I want to ask if it is possible to configure iptables NAT to use RADIUS server for authentication.

   I am seeking if it is possible for me to do:

   1. When user want to connect to Internet by NAT.
   2. A prompt will show up to authenticate the users by RADIUS to a windows 2000 server.
   3. If the user is authenticated, NAT is done, and packet send to Internet.

   Thx a lot.

Best,
William

[-- Attachment #2: Type: text/html, Size: 1241 bytes --]

Re: NAT authentication

[Julian Gomez]

On Tue, Apr 15, 2003 at 05:51:14PM +0800, William spoke thusly:

>   1. When user want to connect to Internet by NAT.

What outgoing user services will be used ?

>   2. A prompt will show up to authenticate the users by RADIUS to a windows 
>   2000 server.   

If you are using it for plain http/https/ftp sessions, then I would suggest
plugging in a transparent proxy (eg: Squid), and have that perform the OOB
authentication to your RADIUS daemon.

Otherwise, if you need it for generic outgoing services, I think it might
be possible to plug in a SOCKS5 server with authentication to your Win2K
RADIUS daemon.

>   3. If the user is authenticated, NAT is done, and packet send to Internet.

See above, this won't touch iptables (except for the transparent proxying
most probably).

Another, probably less secure method would be to have the user authenticate
itself to some web server (Apache, checking your Win2K RADIUS db), if
successful have your gateway add in the appropriate rules. Otherwise just
ignore it. This means interfacing between the web server, radius + your
gateway.

-- 
"any nation that wants to control its borders can do so." 
		- Tommy Franks; Mexicans && Columbia Drug War ?