Network and RADIUS
From tariff straight to RADIUS. No router logins.
Set plan parameters on the service and django-nms generates FreeRADIUS entries for MikroTik and Cisco ASR plus configuration files for Linux routers. Deployment over SSH, with audit and safety nets.
- PPPoE and MAC auth in one generator
- Sessions refreshed every 60 seconds from every edge router
- Hard and soft blocking as one action from the host list
Three platforms, one data model
The subscriber host (PPPoE login, IP addresses, speeds, limits, blocks) is defined once. The output format depends on your network.
-
MikroTik RouterOS
Mikrotik-Rate-Limit (day/night) and repeated Mikrotik-Address-List attributes (e.g. business, nolimit). Active PPP sessions and address lists read over SSH.
-
Cisco ASR 1001-X
Cisco-Service-Info for QoS on IOS-XE ISG and IOS-XR BNG. A "show subscriber session" parser matches sessions by login or IP.
-
Linux routers
client.cfg and ipforward.cfg (1:1 NAT) export for DHCP, NAT and tc scripts. Per-router deployment through a jump host.
-
FreeRADIUS files
Generated users entries: Cleartext-Password, Framed-IP-Address, vendor attributes. MAC auth in both address notations. Servers restarted one by one.
-
Deployment safety nets
Refuses an empty configuration or one that drops more than 10% of hosts. Redis locks, debounce, log of every deployment.
-
Planned
CoA and MikroTik API
Speed changes without PPPoE re-login (RADIUS CoA) and queue/secret writes through the RouterOS API. On the roadmap.
Live sessions: who is online, on which router
Every 60 seconds a background task polls the enabled edge routers (MikroTik: /ppp active, Cisco: show subscriber session), matches sessions to hosts by login and then by IP address, and records the last-seen time. The dashboard shows sessions per router, active and blocked hosts by reason. The host list has an online/offline badge and a list/map toggle.
- Routers and jump hosts configured in the panel, SSH keys only on disk
- Custom session-read command validated against an allow-list
- A "Probe" action stores the raw router output for diagnostics
Hard and soft blocking
A host has a block reason (payment, DDoS, manual) and a mode: hard removes the RADIUS entry, soft leaves a few hundred kb/s so the customer can see a message and pay. A host expiry date deactivates it automatically every hour with the reason "payment". Every change triggers a configuration deployment, debounced to group consecutive clicks.
- Bulk actions: activate, deactivate, soft-block
- Automatic block after invoice due date: on the roadmap, all building blocks exist
- Redirect page for blocked users (captive portal): on the roadmap
IPAM: address pools with an occupancy map
An IP network has address and mask, gateway, interface or VLAN, DNS, domain, DHCP range. A host belongs to a network by address, without manual links. The address map view shows roles (network, broadcast, gateway, DHCP, host), assigned hosts, free addresses and a compaction plan.
- Overlap validation between networks
- Next free address in one click
- IPv6: on the roadmap
Technical questions
Is RADIUS SQL-backed?
No. django-nms generates FreeRADIUS files-module entries and deploys them over SSH. A simple, auditable model with no extra database. RADIUS SQL and accounting are on the roadmap.
Does the system write configuration to MikroTik?
Today it reads sessions and address lists over SSH and steers traffic through RADIUS attributes. Writes through the RouterOS API (queues, secrets, hotspot) are on the roadmap.
Does it work with a BNG other than Cisco ASR?
The RADIUS attributes are standard, so authentication works. The session parser is built for IOS-XE and IOS-XR. Other platforms are added on request.
Show us your topology
On a technical demo we go through your edge routers and show what provisioning would look like.