RADIUS Explained for ISP Operators

Every generator on this site — PPPoE, Hotspot — asks for a RADIUS server IP and a shared secret. If you're setting up your first WISP, it's worth understanding what that server is actually doing before you pick one, since the choice affects billing, support workload, and how much manual work every subscriber change costs you.

What RADIUS actually is

RADIUS (Remote Authentication Dial-In User Service) is a protocol, not a product — a standard way for a router to ask a separate server three questions about a connecting subscriber, known as AAA:

Without RADIUS, a MikroTik router can still authenticate PPPoE or Hotspot logins — but only against a list stored directly on the router itself. That works for a handful of subscribers. Past that, every plan change, every new subscriber, and every disconnection for non-payment means logging into the router by hand. RADIUS moves subscriber management off the router entirely and onto a platform built for it.

Why accounting is the part that actually matters for billing

Authentication gets the most attention because it's what makes a login work, but for a WISP, accounting is what makes billing possible at all. The RADIUS server logs a Start packet when a session begins, Interim-Update packets at a regular interval (5 minutes is standard) with live byte counts, and a Stop packet with the final total when the session ends. A billing platform reads these logs to know how much data or time a subscriber actually used — without it, you're billing on trust alone.

Three platforms WISPs actually use

SAS4

A commercial billing and RADIUS platform built specifically for WISPs, popular in the Middle East, South Asia, and parts of Africa. SAS4 bundles RADIUS with subscriber management, invoicing, and a customer portal in one package — the appeal is not having to stitch together separate tools. It's a paid product with a licensing cost, but for an operator who wants billing and RADIUS solved together without custom development, it's a common starting point.

GalaxyRAD

Another commercial WISP-focused platform, similar in scope to SAS4 — RADIUS, billing, and subscriber management combined. The choice between the two often comes down to regional support availability, pricing, and which one a WISP's peers are already using — both are mature enough to run production networks reliably.

freeRADIUS

An open-source RADIUS server — just the AAA protocol implementation, with no billing or subscriber-management interface built in. freeRADIUS is free and extremely flexible, but it means building or bolting on your own subscriber database, billing logic, and admin interface (or wiring it to something like a MySQL backend and a custom panel). It suits operators comfortable with Linux administration who want full control, or who are already running other open-source infrastructure and don't want another licensed product.

How to choose

What stays the same no matter which you pick

The RouterOS side of the configuration is identical regardless of platform — all three speak standard RADIUS (RFC 2865/2866), so the same /radius registration, /ppp aaa settings, and accounting interval apply whether the server on the other end is SAS4, GalaxyRAD, or freeRADIUS. The generators on this site don't need to know which platform you're using — just the server's IP and shared secret.

Common mistakes and how to fix them

Best practices

• Use a strong, unique shared secret per RADIUS server — never reuse a router's admin password.
• Set a 5-minute accounting interval unless you have a specific reason to change it — it's the balance most platforms are tuned around.
• Keep a backup RADIUS entry pointing at a secondary server if your platform supports it, so a single server outage doesn't block new logins network-wide.
• Test accounting specifically, not just authentication, after any RADIUS change — a login succeeding doesn't confirm billing data is flowing.