Authentication

Roaming Out - Use GW authentication. RADIUS server - Use GW as a proxy.

After Users login, user traffics will enter into USERS chain and match its group iptables -t filter -vnL FORWARD iptables -t filter -vnL USERS

or if user traffic enter into USER_CTL chain, traffic will be dropped