Framed-Pool support

[g00g1]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guidelines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue
• AI tools were used to create at least part of the text submitted herewith.

If AI was used, please disclose:

• Model used:
• Extent of AI involvement:

Is your feature request related to a problem? Please describe.

I would like to setup OpenVPN and depending on user, RADIUS server provides different pools, making it straightforward to acl/firewall traffic.

Describe the solution you like

Framed-Pool support allows to effortlessly distinguish different user roles on the network level. Many vendors support it.

Describe alternatives you considered

Unfortunately, it is currently easier for me to replicate the desired setup on e.g. MikroTik. However, I would like to see OPNsense to support this too.

Additional context

Probably OpenVPN/openvpn#1076 is worth to be mentioned.

[AdSchellevis]

I would expect that's what Framed-IP-Address is for, when offered, that's what the client will use:

core/src/opnsense/scripts/openvpn/user_pass_verify.php

Line 47 in 7cd941d

$result['tunnel_network'] = $props['Framed-IP-Address'] . "/" . $cidrmask;

[g00g1]

As far as I understand semantics of `Framed-IP-Address`, it is literal address, so that if I were to do `Framed-IP-Address: 10.0.0.1` with `Framed-Netmask: 255.255.255.0` it won't actually allocate IP addresses from `10.0.0.0/24`.

[AdSchellevis]

your radius server should take care of that part indeed.

[g00g1]

Windows NPS lacks this but it has Framed-Pool support, and MikroTik implements IP allocation given the pool from RADIUS. That's the setup I would like to replicate with OPNsense.

[AdSchellevis]

I'm not sure how they implement it, but I don't think openvpn has a native method to include named pools.

[g00g1]

You are right, they don't have it yet - see OpenVPN/openvpn#1076