RADIUS server: what it does, which ports it uses, and how to run one

RADIUS (Remote Authentication Dial-In User Service) is the protocol behind most network access control: Wi-Fi with 802.1X, VPN concentrators, switches, firewalls and remote access appliances ask a RADIUS server whether a user or device may connect.

Short answer: the server listens on UDP 1812 for authentication and 1813 for accounting, identifies each network device by a shared secret, and checks credentials against a user store. FreeRADIUS is the standard open-source server; Windows Server has NPS; Casdoor can serve RADIUS alongside OIDC and SAML.

What RADIUS does

A network access server (NAS), such as a Wi-Fi controller or VPN gateway, does not know your users. When someone tries to connect, it sends an Access-Request to the RADIUS server containing the user name and credentials, and the server answers Access-Accept, Access-Reject or Access-Challenge.

RADIUS also carries accounting records: when a session starts, updates and stops, so you know who connected, from where and for how long.

Ports and transport

RADIUS runs over UDP, not TCP. Firewall rules must allow UDP in both directions between the NAS and the server, including replies to the source port.

The 802.1X flow

For Wi-Fi and wired 802.1X, three roles are involved:

1. Supplicant: the laptop or phone trying to connect.
2. Authenticator: the switch or access point, which acts as the RADIUS client.
3. Authentication server: the RADIUS server.

The authenticator tunnels EAP messages between the supplicant and the server. Common EAP methods are EAP-TLS (client certificates), PEAP (a TLS tunnel around a username and password) and EAP-TTLS (similar, with more flexible inner methods).

The shared secret

Every network device is configured as a RADIUS client with an IP address and a shared secret. The secret signs and encrypts parts of each packet. If the client and server secrets differ, requests are silently dropped, which is the most common cause of "RADIUS server is not responding".

Use a long random secret per device, not one secret for the whole estate.

Server options

• FreeRADIUS is the most widely deployed open-source server. Configuration lives in clients.conf (network devices), sites-enabled/default (authorization and authentication policy) and mods-enabled/ (EAP, LDAP, SQL and other backends).
• Microsoft Network Policy Server (NPS) is the Windows Server role for RADIUS. It fits organizations that already run AD and Windows Server.
• Cisco ISE and similar products combine RADIUS with device profiling and policy.
• Casdoor can act as a RADIUS server, so Wi-Fi and VPN clients can authenticate against the same user directory it uses for OIDC and SAML applications.

A minimal FreeRADIUS setup

1. Install freeradius and stop the service.
2. Add each NAS to clients.conf with its IP and shared secret.
3. Choose where users come from: the users file for testing, LDAP or SQL for production.
4. Enable the EAP module and configure certificates for PEAP or EAP-TLS.
5. Run freeradius -X in the foreground; it prints every packet and every decision.
6. Test with radtest from another host, not from localhost.

The last point matters: testing from the server itself bypasses firewall rules and hides binding problems.

"RADIUS server is not responding"

Work through these in order:

If authentication fails rather than times out, the request reached the server. The FreeRADIUS debug output shows which module rejected it.

RADIUS is not SSO

RADIUS authenticates a network session. It does not sign a user in to a web application, and it does not issue OIDC tokens. Organizations usually run both:

• RADIUS for Wi-Fi, VPN and network gear.
• SAML or OIDC for applications.

Casdoor covers both sides: RADIUS for network access, OIDC and SAML for applications, with one user directory, MFA and passkeys. Self-host it for free, or run a dedicated instance on Casdoor Cloud from $6.67/month billed yearly. Related reading: RADIUS vs LDAP and LDAP authentication.

FAQ

What port does RADIUS use? UDP 1812 for authentication and UDP 1813 for accounting. Older devices may use UDP 1645 and 1646.

What is the difference between RADIUS and LDAP? RADIUS is an authentication and accounting protocol for network access. LDAP is a directory query protocol. RADIUS servers often check credentials against an LDAP directory behind them.

Why does my RADIUS server not respond? The usual causes are a shared secret mismatch, a firewall blocking UDP, or the NAS not being defined as a client.

Can RADIUS use Active Directory? Yes. FreeRADIUS can authenticate against LDAP or AD, and Windows NPS uses AD directly.

Does RADIUS support MFA? It can carry EAP methods and Access-Challenge flows, so a RADIUS server can enforce a second factor, depending on the server and the network device.