feat(radius): proxy UniFi Endpoint logins to the UDM over VLAN 11 #1561

2026-11-04T14:06:10Z

claude-bot commented

2026-11-04 14:06:10 +00:00

Depends on #1560 (radius0 on all nodes via talosctl, Cilium vlanBypass 11 with agents restarted). Merge only after both are live; otherwise the new FreeRADIUS pods stay in ContainerCreating (failed to lookup master "radius0" / DHCP no buffer space available) while the old ReplicaSet keeps serving.

The UDM RADIUS rejects the pod CIDR (unknown client 10.244.x.x) and accepts 10.2.11.0/24 since the UniFi network "(11) RADIUS" exists. FreeRADIUS gets a second interface on VLAN 11 and proxies UniFi Endpoint logins to the UDM from there.

freeradius-network-attachment.yaml (new NAD freeradius-udm): macvlan on radius0, DHCP IPAM with skipDefault + only subnet-mask requested, then tuning net.ipv6.conf.IFNAME.disable_ipv6=1. net1 holds only the connected 10.2.11.0/24, so the unbound proxy socket reaches 10.2.11.1 via net1 with the leased source; no default route (the UDM's dnsmasq sends option:router for VLAN 11 only on request — verified in /run/dnsmasq.dhcp.conf.d/), no IPv6 from VLAN 11's RAs. No sbr: it moves the connected route into a source table, and the proxy would then leave via eth0 from the pod IP.
freeradius.yaml: Multus annotation k8s.v1.cni.cncf.io/networks: freeradius-udm.
freeradius-config.yaml: home server udm → 10.2.11.1; NAS listeners bound to eth0, nothing listens on net1.
freeradius-cnp.yaml: freeradius-udm-egress removed (net1 bypasses Cilium).
tests/radius: FreeRADIUS interfaces named eth0/net1 explicitly in the harness (Docker attaches networks in no fixed order); all checks pass.
docs/radius/dot1x.md: "Path to the UDM" section.

Post-merge checks: each pod has a 10.2.11.x address on net1 and its IPv4 default route only on eth0; an Endpoint login on "Renner Test" shows Login OK from client client-client-97098937-… in the UDM log; tests/radius/live.sh still succeeds for the anonymous/authentik path.

🤖 Generated with Claude Code

**Depends on #1560** (`radius0` on all nodes via talosctl, Cilium `vlanBypass` 11 with agents restarted). Merge only after both are live; otherwise the new FreeRADIUS pods stay in ContainerCreating (`failed to lookup master "radius0"` / DHCP `no buffer space available`) while the old ReplicaSet keeps serving. The UDM RADIUS rejects the pod CIDR (`unknown client 10.244.x.x`) and accepts 10.2.11.0/24 since the UniFi network "(11) RADIUS" exists. FreeRADIUS gets a second interface on VLAN 11 and proxies UniFi Endpoint logins to the UDM from there. - `freeradius-network-attachment.yaml` (new NAD `freeradius-udm`): macvlan on `radius0`, DHCP IPAM with `skipDefault` + only `subnet-mask` requested, then `tuning` `net.ipv6.conf.IFNAME.disable_ipv6=1`. net1 holds only the connected 10.2.11.0/24, so the unbound proxy socket reaches 10.2.11.1 via net1 with the leased source; no default route (the UDM's dnsmasq sends `option:router` for VLAN 11 only on request — verified in `/run/dnsmasq.dhcp.conf.d/`), no IPv6 from VLAN 11's RAs. No `sbr`: it moves the connected route into a source table, and the proxy would then leave via eth0 from the pod IP. - `freeradius.yaml`: Multus annotation `k8s.v1.cni.cncf.io/networks: freeradius-udm`. - `freeradius-config.yaml`: home server `udm` → `10.2.11.1`; NAS listeners bound to `eth0`, nothing listens on net1. - `freeradius-cnp.yaml`: `freeradius-udm-egress` removed (net1 bypasses Cilium). - `tests/radius`: FreeRADIUS interfaces named eth0/net1 explicitly in the harness (Docker attaches networks in no fixed order); all checks pass. - `docs/radius/dot1x.md`: "Path to the UDM" section. Post-merge checks: each pod has a 10.2.11.x address on net1 and its IPv4 default route only on eth0; an Endpoint login on "Renner Test" shows `Login OK` from client `client-client-97098937-…` in the UDM log; `tests/radius/live.sh` still succeeds for the anonymous/authentik path. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-11-04 14:06:10 +00:00

feat(radius): proxy UniFi Endpoint logins to the UDM over VLAN 11

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

05d2fcac71

The UDM RADIUS rejects the pod CIDR as an unknown client; it accepts
10.2.11.0/24. FreeRADIUS pods get net1 on VLAN 11 "(11) RADIUS" and the
udm home server moves to 10.2.11.1.

- Talos k8s-{1,2,3}: VLANConfig radius0 (VLAN 11 on uplink), no
  addresses, IPv6 disabled on the host link.
- Cilium bpf.vlanBypass gains 11: radius0 is address-less like ens19, so
  its tagged frames meet the VLAN filter on uplink (#592).
- NAD freeradius-udm: macvlan on radius0, DHCP IPAM requesting only
  subnet-mask (skipDefault), so the lease has no router and net1 holds
  only the connected /24. No sbr: it moves that route into a source
  table, and the unbound proxy socket would then reach the UDM via eth0
  from the pod IP. tuning disables IPv6 on net1 (VLAN 11 sends RAs).
- NAS listeners bound to eth0, so nothing listens on net1.
- CNP freeradius-udm-egress removed: net1 traffic bypasses Cilium.
- Harness: FreeRADIUS interfaces named eth0/net1 explicitly; Docker
  attaches networks in no fixed order, and the eth0 bind exposed it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit 657e3d0d92 into main

2026-11-04 14:10:09 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1561