Netwacky87 Posted November 23, 2025 Posted November 23, 2025 Hi all, We're looking to get rid of most of our servers this coming summer, including our DCs. We run Smoothwall but UniFi doesn't talk nicely to its RADIUS server so I have to put an NPS in the middle. Does anyone run UniFi with any sort of cloud authentication? Entra 365 would be ideal but looks like you have to buy into UniFi Indentity Enterprise which looks costly. Thanks!
dhicks Posted January 4 Posted January 4 On 23/11/2025 at 21:38, Netwacky87 said: We run Smoothwall but UniFi doesn't talk nicely to its RADIUS server so I have to put an NPS in the middle. Ah - we're just looking at putting in a guest WiFi SSID, with our UniFi system talking to our (new) on-site Smoothwall appliance to inform it about guest users. I was hoping / guessing this would be a nice and easy thing to set up, have you found that the UniFi server has difficulty talking to the Smoothwall server, then? Sorry, this isn't helping your original question, quite the opposite (I'm asking you for help!), but at least two of us trying to figure out the solution might be useful.
Netwacky87 Posted January 4 Author Posted January 4 Haha!! No worries at all. If you have a smoothwall and unifi, I believe it doesn't pass framed-ip packets which doesn't work well with Smoothwall. (I could be totally wrong...) and this is for RADIUS clients so I just stick an NPS server in the middle and pass authentication details to smoothwall from NPS. However, you're just talking about Guests which we don't authenticate, they just get the lowest web filtering policies and we use the Voucher on unifi to protect it. I don't massively care about logging Guest activitiy. Its quite straight forward to set up though. 1
dhicks Posted January 4 Posted January 4 13 minutes ago, Netwacky87 said: If you have a smoothwall and unifi, I believe it doesn't pass framed-ip packets which doesn't work well with Smoothwall. (I could be totally wrong...) Gah! No, you're right - the Smoothwall RADIUS accounting implementation seems to expect the IP address of the client device in a "Framed-IP-Address" attribute - a quick Google suggests it is defined in RFC 2865 as Attribute 8, which sounds like it's a fairly well-known, standard attribute. Does UniFi send the IP address in a different field, then? As you point out, you can (and do) solve this by using an intermediate local server that accepts the RADIUS packet from the UniFi system and passes something better-formed to the Smoothwall server. However you, like us, want to reduce the number of local servers / services to maintain, not add to them. The solution in your case might be to install Smoothwall's Unified Client (assuming we're talking about school-managed devices here), which should be able to report the current logged-in user's username to the Smoothwall server. There's a registry setting you have to set to get it to report Azure AD usernames correctly. If that isn't suitable (as it isn't for us, as we're using pGina / Google's GCPW for Windows logins), I've just written a similar client that sends the username / IP address to Smoothwall via RADIUS - other thread: As that thread points out, the client isn't ready for production yet, but if you think it might solve your problem and you have a little time to try it on a test device that would be handy. Separately from that, for guest users we were hoping that we would be able to have identifiable usernames of some sort logged against any blocks / alerts on our guest network so we could better pinpoint the cause. It sounds like we might have an issue getting the UniFi server talking directly to our Smoothwall server. Like yourself, I can probably stick an intermediate server between the two (probably FreeRADIUS for us), but I would very much prefer not to if possible.
Netwacky87 Posted January 4 Author Posted January 4 We're more of a BYOD school and not school-owned devices which is our challenge. If your devices were all school owned, you could install Cloud Filter and it should be fine. IIRC, and this was a very long time ago, I don't think UniFi sends the packet in a standard way and smoothwall doesn't read it. (again, I could be wrong) We found it works but users will constantly get 'Internet not connected' in their wifi status and no webpages will load. It was way too inconsistent for us to have a working BYOD network but as soon as I put an NPS in the middle, its been rock solid. We are planning to remove all of our (or majority) on site servers next summer and we're looking at Cloud Radius but it seems very expensive at the moment.
dhicks Posted January 4 Posted January 4 42 minutes ago, Netwacky87 said: IIRC, and this was a very long time ago, I don't think UniFi sends the packet in a standard way and smoothwall doesn't read it. (again, I could be wrong) Ah, this is something to test then, that might well be sorted by now - I'll hopefully have time to look at this on our system over the next couple of days. 44 minutes ago, Netwacky87 said: We are planning to remove all of our (or majority) on site servers next summer and we're looking at Cloud Radius but it seems very expensive at the moment. How expensive? It should be possible to set up a RADIUS server on a cheap cloud-based VM (£5-a-month sort of cost), but that would, of course, need setting up and maintaining.
dhicks Posted January 4 Posted January 4 3 minutes ago, dhicks said: Ah, this is something to test then, that might well be sorted by now Ah - a quick Google suggests: Quote Smoothwall requires the Framed-IP-Address attribute to link a username to an IP. If UniFi doesn't provide this (which can happen if UniFi isn't handling DHCP), Smoothwall may see the login but won't know which device to filter. Possibly, UniFi might only pass Framed-IP-Address if it is handling DHCP itself - not sure if that's accurate, it seems a bit of an odd limitation.
dhicks Posted January 5 Posted January 5 On 23/11/2025 at 21:38, Netwacky87 said: We run Smoothwall but UniFi doesn't talk nicely to its RADIUS server so I have to put an NPS in the middle. Just thought: could you have your BYOD users authenticate with your Smoothwall server rather than your UniFi system? Smoothwall handles cloud logins quite nicely (at least, our login-with-Google logins seem to be working okay on our Smoothwall appliance), I'm pretty sure Azure AD logins are equally easy to set up on Smoothwall.
DrCheese Posted January 5 Posted January 5 Are you talking about the 802.11x BYOD not playing nice with Unifi? If so when a device doesn't seem to work (Internet not connected' in their wifi status and no webpages will load) remote onto the S/W server and run iptables -F mac1x The device should instantly come to life. If this works, then the perm fix is to do vi - /etc/actions/secondboot/0090firewall You will find a section around line 169 that looks like this: 169 # Connect INPUT and FORWARD chains to the mac1x chain 170 /sbin/iptables -I INPUT -j mac1x 171 /sbin/iptables -I FORWARD -j mac1x REM out the 2 sbin line: 169 # Connect INPUT and FORWARD chains to the mac1x chain 170 # /sbin/iptables -I INPUT -j mac1x 171 # /sbin/iptables -I FORWARD -j mac1x You have to apply this fix again after each S/W update. 1 1
Netwacky87 Posted January 6 Author Posted January 6 14 hours ago, DrCheese said: Are you talking about the 802.11x BYOD not playing nice with Unifi? If so when a device doesn't seem to work (Internet not connected' in their wifi status and no webpages will load) remote onto the S/W server and run iptables -F mac1x The device should instantly come to life. If this works, then the perm fix is to do vi - /etc/actions/secondboot/0090firewall You will find a section around line 169 that looks like this: 169 # Connect INPUT and FORWARD chains to the mac1x chain 170 /sbin/iptables -I INPUT -j mac1x 171 /sbin/iptables -I FORWARD -j mac1x REM out the 2 sbin line: 169 # Connect INPUT and FORWARD chains to the mac1x chain 170 # /sbin/iptables -I INPUT -j mac1x 171 # /sbin/iptables -I FORWARD -j mac1x You have to apply this fix again after each S/W update. Thanks @DrCheese I remember seeing your post years ago on this. I tried this but still found it wasn't 100% reliable. Some devices still had an issue or take a long time to 'get internet'
dhicks Posted January 9 Posted January 9 On 04/01/2026 at 16:04, Netwacky87 said: If you have a smoothwall and unifi, I believe it doesn't pass framed-ip packets which doesn't work well with Smoothwall. We're aiming to have guests connect to UniFi with a voucher (dished out to them by Inventry's integration with Unifi), then have UniFi inform the Smoothwall server. I've had a rummage around their documentation today: We don't seem to be able to set a UniFi Hotpot send a RADIUS packet unless we want to use RADIUS for authentication - we want to use a voucher. There doesn't seem to be a UniFi alarm / event defined for "Guest user has logged in with voucher code xyz". Therefore, the solution seems to be to have something poll the UniFi API every (say) 30 seconds, gtetting details of any vouchers used and updating the Smoothwall server via RADIUS accounting as appropriate. This means still having a local process of some sort running, but that can be a small application on a server, you don't have to have an Active Directory / NPS server on site. The polling client could (probably, I haven't checked) poll for new RADIUS users authenticated with the UniFi system and inform the Smoothwall server via RADIUS accounting.
tdawson Posted February 2 Posted February 2 Hi Entra authentication is now included at no cost in the Fabric settings. https://help.ui.com/hc/en-us/articles/30968066908439-Integrating-Microsoft-Entra-with-UniFi-Fabrics
Edu-IT Posted February 2 Posted February 2 Isn’t it the case though that you then have to connect to wifi using the Unifi app?
Netwacky87 Posted February 2 Author Posted February 2 1 hour ago, Edu-IT said: Isn’t it the case though that you then have to connect to wifi using the Unifi app? This is my understanding!
tdawson Posted February 3 Posted February 3 You need the UniFi Endpoint app but it's free too and the OPs concern was that UniFi Identity Enterprise was costly.
Netwacky87 Posted February 3 Author Posted February 3 Just wish they'd do Entra integration on a Portal, thats all. Seems a faff to install an app simply for WiFi.
Edu-IT Posted February 7 Posted February 7 On 03/02/2026 at 10:32, Netwacky87 said: Just wish they'd do Entra integration on a Portal, thats all. Seems a faff to install an app simply for WiFi. That’s my thinking.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now