The short answer
RADIUS (Remote Authentication Dial-In User Service) is how a router asks a central server “may this customer connect, and with what limits?” The server answers Accept or Reject, sends speed limits and session times with an Accept, and receives accounting updates about how long the customer was online and how much data they used.
The three jobs RADIUS does
- Authentication: is this really customer jane.k? (username and password, voucher or device MAC)
- Authorisation: what are they allowed? (speed limits, session length, IP address)
- Accounting: what did they use? (time online, data downloaded and uploaded)
The router (called the NAS, network access server) asks the questions; the RADIUS server answers them. They share a secret so the server only trusts your routers.
How a RADIUS login works
- A customer connects by PPPoE, logs in on the hotspot page, or their device asks for an IP by DHCP.
- The router sends an Access-Request to the RADIUS server.
- The server checks the customer’s account, plan and expiry date.
- It replies Access-Accept with the customer’s limits (for example a rate limit and a session timeout) or Access-Reject.
- While the customer is online, the router sends Accounting messages: start, interim updates and stop, with time and data used.
| Message | Sent by | Means |
|---|---|---|
| Access-Request | Router | May this user connect? |
| Access-Accept | Server | Yes, with these limits |
| Access-Reject | Server | No |
| Accounting-Request (Start / Interim / Stop) | Router | Session started, still running, ended |
RADIUS normally uses UDP port 1812 for authentication and 1813 for accounting.
Why ISPs use RADIUS instead of router user lists
- One list of customers for every router, instead of copies that drift apart.
- Plans, speeds and expiry come from the billing system, so a payment works immediately.
- Accounting shows who is online and how much they use, across the whole network.
- Moving a customer between routers needs no reconfiguration.
How Wave uses RADIUS
Wave runs FreeRADIUS, the most widely used open-source RADIUS server, and connects it to the billing data through its REST module. Every login is checked against the customer’s current plan, and accounting feeds the live sessions and fair usage pages. Requests to Wave are protected with a shared API key. See RADIUS & live sessions.
Frequently asked questions
What ports does RADIUS use?
UDP 1812 for authentication and UDP 1813 for accounting. Some older equipment uses 1645 and 1646.
Does MikroTik support RADIUS?
Yes. RouterOS can use RADIUS for PPPoE, hotspot and DHCP, and accepts MikroTik-specific attributes such as rate limits.
Is RADIUS the same as a billing system?
No. RADIUS answers login questions and records usage. A billing system decides what each customer has paid for and keeps the RADIUS answers up to date. Wave does both.