A RADIUS server centralises authentication and access control across your network, for example for Wi-Fi, VPN and switches. To set it up properly, you need the right server, secure authentication methods, clean user management and a stable network setup.

What are the requirements and how do you choose the right server type?

A RADIUS server handles authentication, authorisation and access logging. You can run it using software like FreeRADIUS on your own system. Network devices such as access points or VPN gateways send login requests to the server, which checks the credentials and decides whether to allow access.

Technical requirements:

  • A Linux or Windows server with a static IP address
  • Network devices that support RADIUS (such as access points, routers or switches)
  • Access to firewall and network settings

A RADIUS server needs to run reliably, perform well, and remain stable. The choice of the right server type for hosting affects not only performance, but also scalability, costs and maintenance. VPS and dedicated servers are among the best solutions:

  • VPS (Virtual Private Server): A good fit for small to mid-sized environments, such as company Wi-Fi, VPN access or test setups. A VPS is usually enough unless you expect very high authentication loads or need high availability.
  • Dedicated server: Best if you expect a lot of simultaneous authentications requests, have strict security requirements, or need high availability and redundancy. A dedicated server is also often the better option for environments that handle sensitive data or that have strict compliance requirements.

How to set up a RADIUS server

The following example uses a typical Linux setup, such as Ubuntu or Debian. The setup process is similar on other systems.

Step 1: Install RADIUS server software

Start by installing a RADIUS server application. This is the component that actually handles authentication and processes requests from your network devices. FreeRADIUS is the most widely used option. It supports common authentication methods and can connect to directory services like LDAP or Active Directory.

On Debian or Ubuntu, you can install FreeRADIUS using the package manager:

sudo apt update 
sudo apt install freeradius freeradius-utils
bash

After installation, FreeRADIUS starts automatically and runs in the background. At this point, it’s up and running, but not ready for production yet since the required configuration is still missing.

Step 2: Basic configuration of the RADIUS server

After installation, the RADIUS server is running, but it doesn’t know who is allowed to log in, which devices can send requests or how those requests should be validated. You define all of this during the initial configuration. In FreeRADIUS, almost all settings are stored in text files that you can edit with tools like nano, vim or Notepad++. The key things you’ll configure include:

  • Defining clients: Add network devices that are allowed to authenticate with the RADIUS server. Each device is configured with its IP address and a shared secret.
  • Setting authentication methods: Depending on your use case, you can choose between simple password-based methods or more secure, encrypted options for Wi-Fi or VPN access.
  • Adding users or connecting a directory: To get started, users can be created locally on the RADIUS server, for example for testing. In production environments, the server is often connected to a central directory such as LDAP or Active Directory.

Step 3: Configure network devices as RADIUS clients

Now set up the devices that will use the RADIUS server. These are typically Wi-Fi access points, switches or VPN gateways.

You’ll need to enter the follow details:

  • RADIUS server IP address: This is the network address where the RADIUS server can be reached. The device (for example, an access point or VPN gateway) uses it to send authentication requests to the correct server.
  • Port: Defines which network port is used to communicate with the RADIUS server. By default, UDP port 1812 is used for authentication and port 1813 for accounting. Other ports can be configured if needed, depending on your setup.
  • Shared secret: This is a secret key configured on both the RADIUS server and the network device. It must match exactly on both sides. It secures communication and ensures that only authorised devices can send requests.

Step 4: Perform a functionality test

Before putting the server into production, run a few tests to make sure everything works as expected. Typical tests include:

  • Logging in with a test user account: This helps confirm that the RADIUS server is reachable, credentials are processed correctly, and access is granted when valid login details are used.
  • Reviewing logs for errors or rejections: Logs show whether the request came from the correct device, which authentication method was used, and why access was allowed or denied.
  • Testing with incorrect login credentials: Try logging in with the wrong username or password. This makes sure access is denied as expected and that nothing breaks or behaves unexpectedly.
  • Testing with different devices or authentication methods: Try a few different devices or login methods to make sure everything works reliably across your setup, not just in one specific case.

Step 5: Move to production and secure your setup

After testing confirms everything works, you can move your RADIUS server into production. Before you do, take a few extra steps to lock things down:

  • Set firewall rules: Don’t leave your RADIUS server open to every network. Use firewall rules to control which devices and networks are allowed to communicate with it.
  • Use encrypted authentication: Standard RADIUS relies on a shared secret, but it doesn’t fully protect all login data. In production, you should use secure methods like EAP with TLS.
  • Keep the system updated: Regular updates fix known security issues, improve stability, and make sure your server stays compatible with newer clients and encryption methods.
  • Back up your configuration: Make regular backups of your config files. That way, you can quickly restore the server if something goes wrong, gets misconfigured, or needs to be migrated.

What should you keep in mind when setting up a RADIUS server?

A RADIUS server sits at the centre of your access control. That’s why it’s worth getting a few basics right from the start.

Clear authentication and authorisation rules

Decide who should be able to log in and what level of access they get. This can be as simple as Wi-Fi access or more granular permissions for different user groups. The clearer your rules are, the easier it is to manage and scale your setup later.

Security

Make sure communication between the RADIUS server and your network devices is protected. Use strong shared secrets and modern, encrypted authentication methods. You should also keep your operating system and RADIUS software up to date to fix known vulnerabilities and reduce the risk of security breaches.

User management

For smaller setups, local user accounts are often enough. In larger environments, it makes sense to connect to a central directory like LDAP or Active Directory. This helps you avoid duplicate work and keeps user management consistent as people join or leave.

Logging and monitoring

Turn on logging from the start. Logs show who logged in, when, and whether any attempts failed. This is useful for troubleshooting, but also for security monitoring and compliance.

Availability

If your RADIUS server goes down, users may not be able to log in at all. Plan for this early. For example, you can set up a second RADIUS server or keep regular configuration backups. This improves reliability and makes recovery much easier if something goes wrong.

Go to Main Menu