Non Payment Reminder for Expired Users in RADIUS MANAGER 4.x.x

As per requested by many friends, Following is an short guide on howto configure payment reminder for Expired users in DMASOFTLAB RADIUS MANAGER 4.x.x. I wrote this guide because its better to explain in details with snapshots here, rather then explaining to every individual.

This guide will demonstrate that if the user account is expired, he still can login to your Mikrotik / NAS, but when he will try to browse, he will be redirected to Non Payment page showing why his access is blocked. Please note that only HTTP request will be redirected, HTTPS is not supported. Example if some one tries to open HTTPS://WWW.GOOGLE.COM, he will see default browser error, but if some try to open HTTP://WWW.BBC.COM he will be properly redirected.

---

---

---

---

---

Scenario #1 :

[Simple one]

Mikrotik is used as NAS/pppoe server, all clients are connected to it via pppoe dialer/wifi routers.

• LAN IP + Default DHCP Pool for customers = 192.168.1.0/24
• Local Web Server IP which is hosting our web site + reminder page = 192.168.1.10
• PPPoE IP Pool = 172.16.0.0/24
• EXPIRED IP Pool to be created at Mikrotik = 172.16.100.0/24
• WAN IP = 1.1.1.1 [irrelevant]

 

---

1# RADIUS MANAGER CONFIGURATION

In short, perform following steps …

• Create a new / normal service according to your requirements, like1mb / 1 month limitation 
• in  Next expired service option, Select EXPIRED as Next Master Service, So when primary service expires, user service will be switched to this one.

[Note: EXPIRED service is already available in RM by default, but if you are unable to find it, then you can create it manually, just add new service with EXPIRED name and set ip pool accordingly, no expiration no speed limit, simple)

As showed in the image below …

 

---

Now Create a user in users section and assign it with the new service you just created in  above example  >  1mb / 1 month limitation

---

2# MIKROTIK CONFIGURATION

 

• Add IP POOL for Expired Users

Add new IP Pool for EXPIRED pppoe users, when the user will expire, he will be assigned EXPIRED service, which will use this pool for these users

/ip pool
add name=expired ranges=172.16.100.1-172.16.100.255

 

As showed in the image below …

• Enable WEB PROXY and add rules

Now enable WEB PROXY and add deny/redirect rule so that we can redirect the EXPIRED users pool to any web server showing the non payment reminder page. You can also use EXTERNAL proxy to do the redirection like squid proxy. but in this guide i am showing only the mikrotik level things.

# First Enable Mikrotik Web-Proxy (You can use external proxy server also like SQUID)
/ip proxy
set always-from-cache=no cache-administrator=webmaster cache-hit-dscp=4 cache-on-disk=no enabled=yes max-cache-size=unlimited max-client-connections=600 max-fresh-time=3d max-server-connections=600 \
parent-proxy=0.0.0.0 parent-proxy-port=0 port=8080 serialize-connections=no src-address=0.0.0.0

# Add rule to allow access to web server, otherwise user wont be able to access the reminder page. this rule must be on top.
/ip proxy access
add action=allow comment="Allow acess to web server so expired users can view the payment reminder page. it can be locally hosted or external (on internet) as well." disabled=no dst-address=192.168.0.10 \
dst-port=""

# Now add rule to redirect expired ip pool users too local or external web server payment reminder page.
/ip proxy
add action=deny disabled=no dst-port="" redirect-to=192.168.0.10/nonpayment/nonpayment.htm

As showed in the image below …

 

 

Add FIREWALL REDIRECT rule in NAT SECTION

Now add REDIRECT rule in FIREWALL/NAT section, and add only pppoe users pool in default NAT rule.
This is to make sure that users with expired users are redirected to web proxy which will be deny there request and redirect to web server reminder page.
and also add pppoe valid users pool in default NAT rule src-address, so that only valid pppoe users can browse the internet.

As showed in the image below …

---

RESULT

Now when the client primary profile expires, it will switch to NEXT MASTER SERVICE which we configured to EXPIRED, thus he will get ip from EXPIRED pool, and then mikrotik will redirect to proxy which will deny its request and redirect to local payment reminder page.

As showed in the image below …

---

Additional Tip for those who uses Squid Proxy as well.

SQUID PROXY RULE TO BLOCK EXPIRED POOL RANGE

in squid.conf add these on before other ACL. (or on top)

acl expired-clients src 172.16.100.0/24
http_access deny expired-clients
deny_info http://web_server_ip/nonpayment/nonpayment.htm expired-clients

Note: Ideally web server should be on same subnet. Also make sure you allow access to web server it self otherwise page will not be display.

Another Example of code: web server ip address is 192.168.10.2 , and expired pool is 10.0.0.0/24

#first allow access to web server

acl allowed_sites dst 192.168.10.2
http_access allow allowed_sites

# then block further access for expired users  and redirect them to expired clients
acl expired-clients src 10.0.0.0/24
http_access deny expired-clients
deny_info http://192.168.10.2/nonpayment.htm expired-clients

---

Another working code example

/ip firewall nat
add action=masquerade chain=srcnat comment="ALLOW 8.8.8.8 DNS REQUESTS for EXPIRED USERS...." dst-address=8.8.8.8 src-address-list=expired
add action=redirect chain=dstnat comment="Redirect EXPIRED users to web proxy for non payment page redirection" dst-port=80 protocol=tcp src-address-list=expired-pool \
to-ports=50009
add action=masquerade chain=srcnat dst-address=192.168.100.1 src-address-list=expired-pool

/ip firewall filter
add action=accept chain=input comment="ALLOW DNS PORT FOR EXPIRED USERS" dst-port=53 protocol=udp src-address-list=expired-pool
add action=accept chain=input comment="ALLOW WEB PROXY PORT FOR EXPIRED USERS" dst-port=50009 protocol=tcp src-address-list=expired-pool
add action=accept chain=forward dst-address=8.8.8.8 src-address-list=expired-pool
add action=accept chain=forward dst-address=192.168.100.1 src-address-list=expired-pool
add action=accept chain=input dst-address=192.168.100.1 src-address-list=expired-pool
add action=drop chain=forward comment="BLOCK EXPIRED USERS" src-address-list=expired-pool

/ip firewall mangle
add action=accept chain=prerouting comment="allow expired users for routing to radius account expired page" src-address-list=expired-pool

/ip proxy
set cache-administrator="Syed Jahanzaib - aacable@hotmail.com" enabled=yes max-cache-object-size=1KiB max-cache-size=none port=50009
/ip proxy access
add dst-address=192.168.100.1 src-address=192.168.255.1-192.168.255.255
add action=deny redirect-to=192.168.100.1/expired.html

---

Regard’s
Syed Jahanzaib