Mpd can use the Access Control Lists (ACLs) taken from the RADIUS server. This ACLs may include ipfw rules, dummynet pipes and dummynet queues. To use this feature you should add to your RADIUS server such dictionary:
#----------------------------------------------------------
# dictionary.mpd
VENDOR mpd 12341
ATTRIBUTE mpd-rule 1 string mpd
ATTRIBUTE mpd-pipe 2 string mpd
ATTRIBUTE mpd-queue 3 string mpd
#----------------------------------------------------------
After this you can write in your RADIUS configuration something like:
mpd-pipe += "1=bw 10Kbyte/s",
mpd-pipe += "5=bw 20Kbyte/s",
mpd-rule += "1=pipe %p1 all from any to any in",
mpd-rule += "2=pipe %p5 all from any to any out",
mpd-rule += "100=allow all from any to any",
When mpd receives these parameters it will
ipfw(8)
to create firewall rules, pipes and queues with unique numbers starting from 10000. To the end of each rule will be added "via ngX" to make the rule apply only to that client's networking interface.
As a result of this example we would get these commands executed:
ipfw pipe 10000 config bw 10Kbyte/s
ipfw pipe 10001 config bw 20Kbyte/s
ipfw add 10000 pipe 10000 all from any to any in via ng0
ipfw add 10001 pipe 10001 all from any to any out via ng0
ipfw add 10002 allow all from any to any via ng0
When the link goes down, all created rules will be removed.