RADIUS Authentication

RADIUS (Remote Authentication Dial-In User Service) is a network protocol that provides centralised authentication, authorisation and accounting - the "AAA" functions - for users connecting to a network. Designed in the dial-up era and standardised in RFC 2865 (authentication and authorisation) and RFC 2866 (accounting), it remains the backbone of enterprise WiFi, VPN and hotspot access control today.

How a RADIUS exchange works

1. The network access server - in WiFi, the access point or controller - sends an Access-Request to the RADIUS server (UDP port 1812) containing the user's credentials or identifiers.
2. The server checks them against its user store and replies with Access-Accept, Access-Reject, or Access-Challenge (for multi-step methods).
3. An Access-Accept can carry attributes that shape the session: time limits, bandwidth caps, data quotas, or a dynamic VLAN assignment.
4. Accounting packets (UDP port 1813) record session start, stop and usage - the trail behind billing and fair-use policies.

RADIUS in guest WiFi

Many captive portal platforms use RADIUS behind the scenes: the guest signs in on the splash page, the portal authorises the device via RADIUS, and session length, speed tiers for paid WiFi, and voucher limits are enforced through RADIUS attributes and accounting. FreeRADIUS, the most widely deployed implementation, powers a large share of these systems.

Related standards

For staff and corporate networks, RADIUS pairs with IEEE 802.1X and EAP as WPA2/WPA3-Enterprise: each user gets individual credentials instead of one shared password, and access is revoked per person. Passpoint roaming also authenticates against RADIUS infrastructure. In short: if network access is being decided per user rather than per shared password, RADIUS is usually doing the deciding.