MonsterOpsGroups¶
Overview¶
Groups let many users share the same check and reply attributes — rate limits, VLANs,
address-pool names, session timeouts — instead of repeating them on every user. A group maps to the
FreeRADIUS radgroupcheck / radgroupreply tables, and membership to radusergroup.
Put shared policy on a group, then add users to it. It's the single biggest time-saver in day-to-day RADIUS administration.
Where things are¶
- Group list — every group with its member count. Toolbar: New group.
- Group detail — the group's check and reply attributes, plus its members and any linked NAS Groups.
- Reply attributes — what FreeRADIUS returns on an Accept for members (e.g.
Mikrotik-Rate-Limit,Framed-Pool,Session-Timeout). - Check attributes — conditions evaluated at auth time for the whole group.
- NAS Group link — restrict which devices this group may authenticate against by tying the RADIUS group to a NAS Group.
Common tasks¶
- Create a plan/tier — New group (e.g.
premium) → add reply attributes (rate limit, pool) → add users on the Users page or from the group's members list. - Change a plan for everyone on it — edit the group's reply attributes once; every member picks up the change on their next authentication.
- Restrict a group to certain devices — link it to a NAS Group so members can only authenticate through those NAS clients.
Problems you may hit¶
Users get the wrong reply attributes
FreeRADIUS applies attributes in a defined order and a per-user radreply row can override
a group reply. If a user shows unexpected limits, check their Attributes tab for overrides,
and confirm they're a member of exactly the group you expect.
- Attribute has no effect — the NAS vendor may use a different attribute name; confirm the vendor dictionary and the exact attribute (e.g. Mikrotik vs. Cisco rate-limit attributes differ).
- A user is in two groups with conflicting replies — ordering/priority decides the winner; keep a user in one policy group where possible.