RADIUS Server for WiFi Hotspots & ISP Networks
A reliable RADIUS server is the foundation of centralized user authentication for WiFi hotspots and internet service provider networks. It allows network operators to manage usernames, passwords, access plans, bandwidth policies, session limits, and usage records from one central system instead of configuring every router manually.
For hotspot operators and ISPs, RADIUS also connects network access with billing and customer management. When a customer pays for a plan, the account can be activated through RADIUS. When a package expires, the customer can be restricted or disconnected according to the provider’s rules.
If you are looking for a practical way to connect subscriber authentication with customer and billing management, you can
What is a RADIUS server?
RADIUS stands for Remote Authentication Dial-In User Service. It is a protocol used to provide centralized authentication, authorization, and accounting, often called AAA.
•Authentication verifies who the user is.
•Authorization determines what the user is allowed to access.
•Accounting records information about the user’s session and network usage.
A RADIUS server works with routers, access points, wireless controllers, VPN gateways, MikroTik devices, and other network access servers. When a user connects to a hotspot or ISP network, the network device sends an authentication request to RADIUS. The server checks the account and returns an accept or reject response along with the relevant service attributes.
For example, the response can include a bandwidth limit, IP address, session timeout, data quota, or simultaneous-login policy.
How RADIUS works for WiFi hotspots
A common hotspot workflow begins when a customer joins a wireless network. The customer may be redirected to a captive portal where they enter a username and password, voucher code, or temporary access token.
The hotspot gateway sends those credentials to the RADIUS server. If the account is valid and active, RADIUS returns an authorization response. The hotspot then allows access and applies the customer’s plan.
During the session, the network device can send accounting updates to the RADIUS server. These updates may include:
•User login time
•User logout time
•Session duration
•Upload traffic
•Download traffic
•Assigned IP address
•Access point or hotspot location
•Session termination reason
•Interim usage updates
When the customer disconnects, a final accounting record can be sent. This information helps operators monitor usage, enforce quotas, investigate support cases, and connect access activity with billing records.
A hotspot business that wants to automate this process can
How RADIUS works for ISP networks
Internet providers commonly use RADIUS with PPPoE, DHCP, wireless subscriber access, VPN services, and other access methods. Instead of keeping customer credentials on each router, the provider maintains a centralized subscriber database.
When a PPPoE customer connects, the MikroTik router or broadband access device sends the username and password to RADIUS. The server verifies the account and returns attributes such as:
•Download speed
•Upload speed
•IP address or IP pool
•Session timeout
•Idle timeout
•Maximum simultaneous sessions
•Service type
•Data or uptime limitation
•VLAN or network policy
This structure makes it easier to manage a large number of subscribers across multiple routers, towers, access concentrators, or service areas.
If a customer upgrades from a 20 Mbps plan to a 100 Mbps plan, the provider can update the customer’s service profile in the billing system. The next session, or a controlled reauthorization, can receive the new policy without manually editing every router.
RADIUS and billing system integration
RADIUS does not replace every function of an ISP billing platform. RADIUS is primarily responsible for authentication, authorization, and accounting. A complete billing system normally handles customer registration, service packages, invoices, payments, renewals, notifications, support records, and account status.
The billing system and RADIUS server work together in a typical subscriber lifecycle:
1.The customer creates an account or is registered by an agent.
2.The customer selects an internet or hotspot package.
3.The billing system records the invoice and payment status.
4.After payment is confirmed, the customer account becomes active.
5.RADIUS returns the access policy when the customer connects.
6.Accounting records are collected during the session.
7.The billing system renews, restricts, or suspends the account according to its status.
This integration is useful for prepaid hotspots, monthly broadband services, wireless ISPs, apartment internet, hotels, schools, cafés, and reseller networks.
To centralize customer plans, payment status, and access management,
Important RADIUS features for hotspots and ISPs
Centralized user database
The RADIUS database should provide one source of truth for subscribers. It should store account credentials, service status, package assignment, contact information, and network attributes.
A centralized database reduces duplicate configuration and makes it easier to disable a compromised account, reset a password, or apply a plan change across the network.
Bandwidth control
RADIUS can return speed and queue-related attributes to the network device. This allows the provider to assign different bandwidth policies to different packages.
For example, a residential plan may have a standard download and upload rate, while a business plan has higher priority and a dedicated address. A hotspot voucher may be limited by speed and duration.
Bandwidth policy names and attributes must be tested against the specific router and access method. A value that works for PPPoE may not behave the same way for a different service.
Session and usage accounting
Accounting is essential for providers that need reliable usage records. Without accounting, the operator may know whether a user authenticated but not have a complete view of session duration, traffic, or disconnect events.
Configure interim updates when the business depends on live usage, quotas, or timely session information. The update interval should balance reporting needs with server and network load.
Simultaneous session limits
A RADIUS server can help enforce how many devices or sessions a customer may use at the same time. This is useful for preventing credential sharing and controlling voucher abuse.
A single-device plan may allow one active session. A family plan may allow several devices. A public voucher may be restricted to one device or one concurrent login.
Expiration and time limits
Hotspot and prepaid services often depend on time limits. RADIUS attributes can help enforce session timeouts, total uptime, or plan expiration when the network device and billing system are configured correctly.
Use clear time-zone settings throughout the billing application, RADIUS server, router, and database. Many customer-access problems are caused by inconsistent clocks rather than incorrect account data.
Disconnect and reauthorization
When a customer changes plans or an account expires, the provider may need to terminate an active session or force reauthorization. The exact method depends on the RADIUS implementation and network equipment.
Test this process with active PPPoE and hotspot sessions. Confirm that an account change actually reaches the router and that a suspended user cannot continue using an old authorization state.
RADIUS server deployment options
Self-hosted RADIUS
A self-hosted deployment runs on a virtual machine, physical server, cloud instance, or dedicated network appliance. This approach gives the provider control over the operating system, database, backups, firewall, and integrations.
It also creates responsibility for patching, monitoring, redundancy, certificates, database maintenance, and incident response.
RADIUS on a network device
Some network platforms can run a RADIUS service or provide an integrated user-management module. This can be convenient for small networks, limited hotspot deployments, or testing environments.
However, the device’s storage, CPU, memory, database capacity, backup model, and reporting features should be reviewed before using it for a growing subscriber base.
Hosted or integrated RADIUS
A hosted platform can reduce server maintenance and provide a ready-made customer, billing, and access-management workflow. This is often attractive for small and medium-sized providers that want to focus on network operations rather than maintaining several software components.
Before choosing a hosted service, confirm data ownership, backup procedures, API availability, support response, network connectivity, security controls, and migration options.
Security best practices
RADIUS infrastructure should be protected because it controls access to the network.
Use strong, unique shared secrets for every network access device. Restrict RADIUS authentication and accounting traffic to trusted IP addresses and firewall rules. Do not expose the RADIUS server directly to the public internet unless the design specifically requires it and has appropriate protection.
Use secure administrative access, role-based permissions, strong passwords, and multi-factor authentication where available. Keep router management interfaces separate from customer networks.
For sensitive deployments, evaluate RadSec or another protected transport option supported by the RADIUS server and network equipment. Certificate validation must be configured correctly; encryption without proper certificate management does not create a reliable security model.
Monitor authentication rejects, repeated failures, unusual session patterns, accounting delays, and server response times. Alerts can help identify credential abuse, misconfiguration, or a failing RADIUS service before many customers are affected.
Back up the RADIUS database, billing data, configuration files, and certificates. Store backups separately from the production system and test restoration regularly.
Choosing a RADIUS solution
When comparing RADIUS servers and billing integrations, consider the following requirements:
•Support for your router and access technology
•PPPoE, HotSpot, DHCP, or wireless authentication
•Accounting and interim updates
•Bandwidth and quota attributes
•Voucher support
•Multiple locations and routers
•Customer self-service portal
•Payment and billing integration
•Automatic expiry and suspension
•Session termination or reauthorization
•API support
•Reporting and audit logs
•High availability and backup options
•Technical support and documentation
Do not select a system based only on the login screen. The important questions are whether it can maintain accurate account status, apply the correct policy, record session data, and recover from failures.
For providers that want a connected customer and billing workflow,
Common implementation mistakes
One common mistake is configuring authentication but not accounting. Without accounting records, usage reports and quota enforcement may be incomplete.
Another mistake is using the same shared secret across every router. Unique secrets make it easier to revoke or replace access for one device without affecting the entire network.
Some providers also activate automatic suspension before testing payment delays, grace periods, manual extensions, time zones, and active sessions. Always test these scenarios with a small group first.
A further mistake is failing to create a backup RADIUS path. If the primary server becomes unavailable, customers may be unable to authenticate even though the internet network itself is working.
Finally, do not treat a RADIUS server as a replacement for customer support and operational processes. Staff still need clear procedures for refunds, disputed payments, account recovery, outages, abuse reports, and emergency access.
Conclusion
A RADIUS server gives WiFi hotspot operators and ISPs centralized control over authentication, authorization, and accounting. It helps connect customer accounts and service packages to real network policies, making it easier to manage bandwidth, session limits, quotas, vouchers, and account expiry.
The strongest architecture separates responsibilities clearly: the network device enforces access, RADIUS manages AAA, and the billing or customer-management platform controls commercial status and subscriber workflows.
Start with one router, one access method, and a small set of service plans. Test authentication, accounting, bandwidth enforcement, expiry, payment status, and recovery before expanding across the network.
If you are ready to connect subscriber management and billing with your hotspot or ISP network,
Frequently asked questions
What is a RADIUS server used for?
A RADIUS server provides centralized authentication, authorization, and accounting for network users. It verifies credentials, returns access policies, and records session information.
Can RADIUS work with WiFi hotspots?
Yes. RADIUS can authenticate captive-portal users, vouchers, and hotspot accounts. It can also return speed, session, quota, and access-policy attributes when supported by the hotspot gateway.
Can RADIUS work with MikroTik PPPoE?
Yes. MikroTik RouterOS can use RADIUS for PPP and PPPoE authentication and accounting. The server can return subscriber attributes such as speed policies, IP settings, and session limits.
Is RADIUS the same as an ISP billing system?
No. RADIUS manages network access and session accounting. An ISP billing system normally adds customer management, invoices, payments, renewals, notifications, and business reports. The two systems are commonly integrated.
Does RADIUS support prepaid internet access?
Yes. Prepaid access can be implemented with vouchers, time limits, data quotas, or account expiry. The exact features depend on the RADIUS server, billing platform, and network equipment.
How can I connect RADIUS with billing software?
The billing platform normally updates the subscriber database or communicates with the RADIUS server through an integration or API. The RADIUS server then returns the correct access policy to the router when the customer connects.
If you are ready to connect subscriber management and billing with your hotspot or ISP network,
