Hello everyone,
I'm running into an issue with the FreeRADIUS plugin (os-freeradius) on OPNsense when setting up MAC-Based Authentication (MAB) with Ubiquiti UniFi Access Points.
The Scenario & Goal
In a MAB environment, unknown clients (whose MAC addresses are not explicitly registered in a local database) need to be caught by a global DEFAULT fallback rule in /usr/local/etc/raddb/users and assigned to a specific fallback VLAN (e.g., VLAN 20).
A working configuration in the users file requires explicit Auth-Type := Accept along with the appropriate RADIUS tunnel attributes:
DEFAULT Auth-Type := Accept
Tunnel-Type = VLAN,
Tunnel-Medium-Type = IEEE-802,
Tunnel-Private-Group-Id = "20"
The Problem
While the fallback options can be configured via the OPNsense FreeRADIUS GUI, saving any changes or restarting the service through the web interface causes the backend template engine to overwrite or alter the users file.
Specifically, the GUI-generated configuration strips the required Auth-Type := Accept handling. As a result, FreeRADIUS logs show that while the DEFAULT rule is matched, the PAP module fails because no Auth-Type is set:
(0) files: users: Matched entry DEFAULT at line 62
(0) [files] = ok
(0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type
(0) [pap] = noop
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
(0) Failed to authenticate the user
Consequently, unknown devices instantly fail authentication (Access-Reject) instead of being routed to the fallback VLAN. Every time a setting is saved in the GUI, the manual fix gets wiped out.
Current Workaround
As a temporary fix, manually editing the users file via SSH / CLI and applying an immutable flag (chflags schg /usr/local/etc/raddb/users) successfully prevents the OPNsense GUI from overwriting the working configuration during service reloads or updates.
Bug Report & Tracking
I have opened a detailed bug report on GitHub to track this and hopefully get the plugin templates adjusted so they natively preserve or generate proper DEFAULT fallback rules for MAB:
GitHub Issue: https://github.com/opnsense/plugins/issues/5914
If anyone else is experiencing this behavior or has insights on how to handle MAB defaults cleanly within the current GUI framework, I'd appreciate any feedback!
For anyone looking for a workaround while maintainer picks this up:
# opnsense-revert -r 26.7.8 os-freeradius
and re-apply the settings for the service.
Cheers,
Franco