Every hotel, café or campus WiFi login you have typed into was probably checked by a RADIUS server. Here is what RADIUS is, how authentication and accounting work, and how to choose between running your own and using a cloud one.
RADIUS (Remote Authentication Dial-In User Service) is the standard way a network device asks a central server "may this user connect, and on what terms?". The device that users connect to - a hotspot router, a WiFi controller, a VPN server - is the RADIUS client. It sends the user's credentials to the RADIUS server, which answers yes or no and, with a yes, sends back that user's limits. The device then reports how the session went. Those three jobs are AAA: authentication, authorization and accounting. See cloud AAA WiFi.
The router's hotspot intercepts the first web request and shows the captive portal. The guest enters a voucher, an OTP or a room number and surname.
The router sends an Access-Request to the RADIUS server over UDP port 1812, containing the username, the password (hidden with the shared secret, or as a CHAP challenge) and the device's MAC and IP address.
The server checks the credentials. If they are valid it answers Access-Accept with attributes such as Session-Timeout, idle timeout, data quota and a rate limit (MikroTik reads its own vendor attribute, Mikrotik-Rate-Limit). Otherwise it answers Access-Reject and the guest sees an error.
The router sends Accounting-Start on UDP 1813 when the session begins, Interim-Updates every few minutes with bytes used, and Accounting-Stop when it ends. This is what makes data limits and session records possible.
When a voucher runs out, a guest checks out or an admin kicks a device, the server can tell the router to end the session (a Disconnect-Message, RFC 5176).
There are two common ways WiFi uses RADIUS. A hotspot (captive portal) lets the device join an open or simple network, then authenticates the person through a web page - the norm for guests, because nothing has to be configured on their phone. WPA2/WPA3-Enterprise (802.1X with EAP) authenticates before the device joins at all, with a personal username and password or a certificate - the norm for staff, students and corporate networks. The same RADIUS server can handle both.
FreeRADIUS on Linux, Windows NPS, or MikroTik's built-in User Manager. Free software, full control - but you keep it patched, backed up and running, and build your own login page, OTP, PMS link and reports.
The server, database and portal run in the cloud; each site's router just points at it. One dashboard for many sites, nothing to maintain on site, and logins keep their records even if a site's router is replaced.
iberry is a cloud RADIUS and captive portal platform for hotspots: vouchers, PINs, SMS OTP and PMS room-and-surname login, per-user speed, data, time and device limits, accounting and session records - on MikroTik, TP-Link Omada and Ubiquiti UniFi. See hotspot billing software and MikroTik services.
To decide centrally who may connect to a network and on what terms, and to record what each user did. WiFi hotspots, enterprise WiFi, VPNs and internet providers' subscriber logins all use it.
UDP 1812 for authentication and UDP 1813 for accounting (older equipment may use 1645 and 1646). Dynamic authorisation - disconnecting or changing a live session - normally uses UDP 3799.
A password configured on both the router and the server. It authenticates the router to the server and hides the user's password in the request. Use a long random one per site; a weak shared secret is a common weakness.
Classic RADIUS over UDP protects the user's password with the shared secret but not the rest of the packet, so it should travel over a trusted network or an encrypted tunnel. iberry sites reach the cloud over an encrypted WireGuard tunnel.
No. iberry is built for WiFi hotspots and guest networks - hotels, cafés, campuses and public WiFi. Internet providers' PPPoE subscriber billing is a different product.
Tell us your router or controller brand, the number of sites and how users should log in. Published plans in India start at ₹30,000 one-time with ₹15,000 yearly maintenance; outside India every project is quoted on its own, because the hardware is usually bought locally.
Ask for a Quote