How to set up a RADIUS server step by step

A RADIUS server cent­ral­ises au­then­tic­a­tion and access control across your network, for example for Wi-Fi, VPN and switches. To set it up properly, you need the right server, secure au­then­tic­a­tion methods, clean user man­age­ment and a stable network setup.

What are the re­quire­ments and how do you choose the right server type?

A RADIUS server handles au­then­tic­a­tion, au­thor­isa­tion and access logging. You can run it using software like FreeRA­DI­US on your own system. Network devices such as access points or VPN gateways send login requests to the server, which checks the cre­den­tials and decides whether to allow access.

Technical re­quire­ments:

• A Linux or Windows server with a static IP address
• Network devices that support RADIUS (such as access points, routers or switches)
• Access to firewall and network settings

A RADIUS server needs to run reliably, perform well, and remain stable. The choice of the right server type for hosting affects not only per­form­ance, but also scalab­il­ity, costs and main­ten­ance. VPS and dedicated servers are among the best solutions:

• VPS (Virtual Private Server): A good fit for small to mid-sized en­vir­on­ments, such as company Wi-Fi, VPN access or test setups. A VPS is usually enough unless you expect very high au­then­tic­a­tion loads or need high avail­ab­il­ity.
• Dedicated server: Best if you expect a lot of sim­ul­tan­eous au­then­tic­a­tions requests, have strict security re­quire­ments, or need high avail­ab­il­ity and re­dund­ancy. A dedicated server is also often the better option for en­vir­on­ments that handle sensitive data or that have strict com­pli­ance re­quire­ments.

How to set up a RADIUS server

The following example uses a typical Linux setup, such as Ubuntu or Debian. The setup process is similar on other systems.

Step 1: Install RADIUS server software

Start by in­stalling a RADIUS server ap­plic­a­tion. This is the component that actually handles au­then­tic­a­tion and processes requests from your network devices. FreeRA­DI­US is the most widely used option. It supports common au­then­tic­a­tion methods and can connect to directory services like LDAP or Active Directory.

On Debian or Ubuntu, you can install FreeRA­DI­US using the package manager:

sudo apt update 
sudo apt install freeradius freeradius-utils

After in­stall­a­tion, FreeRA­DI­US starts auto­mat­ic­ally and runs in the back­ground. At this point, it’s up and running, but not ready for pro­duc­tion yet since the required con­fig­ur­a­tion is still missing.

Step 2: Basic con­fig­ur­a­tion of the RADIUS server

After in­stall­a­tion, the RADIUS server is running, but it doesn’t know who is allowed to log in, which devices can send requests or how those requests should be validated. You define all of this during the initial con­fig­ur­a­tion. In FreeRA­DI­US, almost all settings are stored in text files that you can edit with tools like nano, vim or Notepad++. The key things you’ll configure include:

• Defining clients: Add network devices that are allowed to au­then­tic­ate with the RADIUS server. Each device is con­figured with its IP address and a shared secret.
• Setting au­then­tic­a­tion methods: Depending on your use case, you can choose between simple password-based methods or more secure, encrypted options for Wi-Fi or VPN access.
• Adding users or con­nect­ing a directory: To get started, users can be created locally on the RADIUS server, for example for testing. In pro­duc­tion en­vir­on­ments, the server is often connected to a central directory such as LDAP or Active Directory.

Step 3: Configure network devices as RADIUS clients

Now set up the devices that will use the RADIUS server. These are typically Wi-Fi access points, switches or VPN gateways.

You’ll need to enter the follow details:

• RADIUS server IP address: This is the network address where the RADIUS server can be reached. The device (for example, an access point or VPN gateway) uses it to send au­then­tic­a­tion requests to the correct server.
• Port: Defines which network port is used to com­mu­nic­ate with the RADIUS server. By default, UDP port 1812 is used for au­then­tic­a­tion and port 1813 for ac­count­ing. Other ports can be con­figured if needed, depending on your setup.
• Shared secret: This is a secret key con­figured on both the RADIUS server and the network device. It must match exactly on both sides. It secures com­mu­nic­a­tion and ensures that only au­thor­ised devices can send requests.

Step 4: Perform a func­tion­al­ity test

Before putting the server into pro­duc­tion, run a few tests to make sure everything works as expected. Typical tests include:

• Logging in with a test user account: This helps confirm that the RADIUS server is reachable, cre­den­tials are processed correctly, and access is granted when valid login details are used.
• Reviewing logs for errors or re­jec­tions: Logs show whether the request came from the correct device, which au­then­tic­a­tion method was used, and why access was allowed or denied.
• Testing with incorrect login cre­den­tials: Try logging in with the wrong username or password. This makes sure access is denied as expected and that nothing breaks or behaves un­ex­pec­tedly.
• Testing with different devices or au­then­tic­a­tion methods: Try a few different devices or login methods to make sure everything works reliably across your setup, not just in one specific case.

Step 5: Move to pro­duc­tion and secure your setup

After testing confirms everything works, you can move your RADIUS server into pro­duc­tion. Before you do, take a few extra steps to lock things down:

• Set firewall rules: Don’t leave your RADIUS server open to every network. Use firewall rules to control which devices and networks are allowed to com­mu­nic­ate with it.
• Use encrypted au­then­tic­a­tion: Standard RADIUS relies on a shared secret, but it doesn’t fully protect all login data. In pro­duc­tion, you should use secure methods like EAP with TLS.
• Keep the system updated: Regular updates fix known security issues, improve stability, and make sure your server stays com­pat­ible with newer clients and en­cryp­tion methods.
• Back up your con­fig­ur­a­tion: Make regular backups of your config files. That way, you can quickly restore the server if something goes wrong, gets mis­con­figured, or needs to be migrated.

What should you keep in mind when setting up a RADIUS server?

A RADIUS server sits at the centre of your access control. That’s why it’s worth getting a few basics right from the start.

Clear au­then­tic­a­tion and au­thor­isa­tion rules

Decide who should be able to log in and what level of access they get. This can be as simple as Wi-Fi access or more granular per­mis­sions for different user groups. The clearer your rules are, the easier it is to manage and scale your setup later.

Security

Make sure com­mu­nic­a­tion between the RADIUS server and your network devices is protected. Use strong shared secrets and modern, encrypted au­then­tic­a­tion methods. You should also keep your operating system and RADIUS software up to date to fix known vul­ner­ab­il­it­ies and reduce the risk of security breaches.

User man­age­ment

For smaller setups, local user accounts are often enough. In larger en­vir­on­ments, it makes sense to connect to a central directory like LDAP or Active Directory. This helps you avoid duplicate work and keeps user man­age­ment con­sist­ent as people join or leave.

Logging and mon­it­or­ing

Turn on logging from the start. Logs show who logged in, when, and whether any attempts failed. This is useful for troubleshoot­ing, but also for security mon­it­or­ing and com­pli­ance.

Avail­ab­il­ity

If your RADIUS server goes down, users may not be able to log in at all. Plan for this early. For example, you can set up a second RADIUS server or keep regular con­fig­ur­a­tion backups. This improves re­li­ab­il­ity and makes recovery much easier if something goes wrong.