---
name: "radiusd_ipcp"
section: "8"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/radiusd_ipcp"
---

# radiusd\_ipcp(8)

provides IP configuration and manages IP address pool

## NAME

**radiusd\_ipcp** – provides IP configuration and manages IP address pool

## SYNOPSIS

**radiusd\_ipcp**

## DESCRIPTION

The **radiusd\_ipcp** module is executed by [radiusd(8)](/radiusd/8.md) as a module to provide IP configuration through RADIUS Access-Accept messages and manages the IP address pool through RADIUS accounting messages. The internal sessions can be shown or monitored by [radiusctl(8)](/radiusctl/8.md). **radiusd\_ipcp** also provides session timeouts and disconnects requested by [radiusctl(8)](/radiusctl/8.md) through the Dynamic Authorization Extension (DAE, RFC 5176).

## CONFIGURATIONS

To use the **radiusd\_ipcp** module, it should be configured as a decoration module of the authentication and as an accounting module.

```
authenticate * by (any auth module) decorate-by ipcp
account      * to ipcp
```

The **radiusd\_ipcp** module supports the following configuration keys and values:

- **address** **pool** *address-space* *...*

  Specify the IP address spaces that is pooled. The *address-space* can be specified by an address range (e.g. 192.168.1.1-192.168.1.199) or an address mask (e.g. 192.168.1.0/24). The pooled addresses are used for dynamic assignment.

- **address** **static** *address-space* *...*

  Specify the IP address spaces that is pooled for static assignment. The *address-space* is the same syntax as **address** **pool**, above.

- **name-server** *primary-address* \[*secondary-address*\]

  Specify the DNS servers' IP addresses.

- **netbios-server** *primary-address* \[*secondary-address*\]

  Specify the NetBIOS name servers' IP addresses.

- **session-timeout** *seconds* \| “radius”

  Specify the session-timeout in seconds, or “radius”. **radiusd\_ipcp** disconnects the session through DAE at the specified time after starting. When “radius” is specified, the value of the Session-Timeout attribute in Access-Accept is used for the timeout. When the value is specified in seconds and the Session-Timeout attribute is specified for a session, the Session-Timeout attribute value is used to disconnect the session in preference. Configure **dae** **server** to use this option.

- **dae** **server** *address*\[*:port*\] *secret* \[*nas-id*\]

  Configure a DAE server which **radiusd\_ipcp** requests disconnection for sessions. Specify the *address*, optionally the *port* number, and the *secret*. If the optional *nas-id* is specified, the server is selected only for the session which NAS-Identifier is matched the specified value. The default port number is 3799.

- **max-sessions** *number*

  Specify the maximum number of sessions. ‘0’ means no limit. The default value is 0.

- **user-max-sessions** *number*

  Specify the maximum number of sessions per a user. ‘0’ means no limit. The default value is 0.

- **start-wait** *seconds*

  Specify the seconds waiting for the RADIUS Accounting Start for the session after Access-Accept. **radiusd\_ipcp** preserves the assigned IP address for that period. The default value is 60 seconds.

## FILES

- */usr/libexec/radiusd/radiusd\_ipcp*

  “ipcp” module executable.

## EXAMPLES

An example with **radiusd\_ipcp** working with [npppd(8)](/npppd/8.md):

*/etc/radiusd.conf*:

```
listen on 127.0.0.1
listen on 127.0.0.1 accounting
client 127.0.0.1/32 {
	secret "SECRET"
}
module radius {
    set secret "SECRET2"
    set server 192.168.0.4:1812
}
module ipcp {
    set address pool      192.168.1.0/24
    set name-server       192.168.0.4
    set max-sessions      128
    set user-max-sessions 2
    set dae server        127.0.0.1 "SECRET3"
    set session-timeout   radius
}
authenticate * by radius decorate-by ipcp
account      * to ipcp
```

*/etc/npppd/npppd.conf*:

```
tunnel L2TP protocol l2tp {
    listen on 192.0.2.51
}
ipcp IPCP {
    pool-address 192.168.1.2-192.168.1.255 for dynamic
}
interface pppac0 address 192.168.1.1 ipcp IPCP
authentication RADIUS type radius {
    authentication-server {
	address 127.0.0.1 secret "SECRET"
    }
    accounting-server {
	address 127.0.0.1 secret "SECRET"
    }
}
bind tunnel from L2TP authenticated by RADIUS to pppac0
radius dae listen on 127.0.0.1
radius dae client 127.0.0.1 secret "SECRET3"
```

## SEE ALSO

authenticate(3), [radiusd.conf(5)](/radiusd.conf/5.md), [npppd(8)](/npppd/8.md), [radiusctl(8)](/radiusctl/8.md), [radiusd(8)](/radiusd/8.md)

## HISTORY

The **radiusd\_ipcp** module first appeared in OpenBSD 7.6.