RadiusForge — FreeRADIUS, made manageable

Up and running in an afternoon

One install script sets up FreeRADIUS, MySQL, the web app and a hardened service. No stack of config files to hand-edit.

Plain language, not RADIUS attributes

Set a plan's download and upload speed in Mbps. RadiusForge writes the correct vendor attributes behind the scenes.

Move your old server in safely

Bring across subscribers, plans and routers from an existing FreeRADIUS box. The old server is only read, never changed.

See it in action

From a bare server to a running console.

Take the quick tour, then watch a real install happen end to end — nothing cut, just sped up.

A quick tour of the console.

A real install on a fresh Ubuntu server — one command, start to finish.

Prepaid Wi-Fi

Hotspot vouchers, built in.

For campsites, cafés, caravan parks and guest Wi-Fi: mint prepaid codes with time and data limits, hand them out, and let RadiusForge enforce them.

Mint a batch

Generate unique voucher codes on any speed plan, with a time limit, a data cap, or both.

Print and go

One click produces a tidy printable sheet of codes, ready for reception or the counter.

Enforced automatically

Codes activate on first login and expire on time, or when the data runs out — no manual clean-up.

Turn it on per Organisation. Proven on the wire with MikroTik hotspot.

What's in the box

Everything a small operator needs, nothing they don't.

The day-to-day screens are built for people who run a network, not people who memorise dictionaries of RADIUS attributes.

Subscribers & plans

Add a subscriber, pick a speed plan, done. Suspend, re-enable or change a password in a click.

Live sessions

See who's connected right now, through which router, and disconnect a session when you need to.

Honest dashboards

Logins accepted and refused, data used, top users, and a connection log that records why a login failed.

Multiple organisations

Run several networks side by side, each walled off in its own Organisation, from one install.

Staff roles & 2FA

Owner, Administrator and read-only Support roles, with two-factor authentication for every login.

One-command install

A tested installer for RHEL 8/9, Rocky Linux, AlmaLinux and Ubuntu 22.04 / 24.04 LTS, including the TLS and security-hardening steps.

Hotspot & vouchers

Mint prepaid Wi-Fi voucher codes with time and data limits, print a sheet, and let RadiusForge enforce them. Ideal for guest and public Wi-Fi.

REST API

A full HTTP API with scoped keys and OpenAPI docs built in. Create a subscriber when an invoice is paid, suspend one when it isn't, pull usage for billing — from the systems you already run.

Full IPv6, done safely

Hand out WAN /64s and delegated /56s, or a pool per plan. RadiusForge checks every block for overlaps before it saves, so you never create a silent routing clash.

High availability

Grow from one server to three that mirror each other, so authentication keeps running even when a node is down for maintenance.

Backed up & safe to upgrade

A consistent snapshot every night, plus one-click backup on demand. Upgrades take a fresh backup first and roll themselves back automatically if anything looks wrong.

Modern RADIUS security

Message-Authenticator on every exchange closes the BlastRADIUS hole automatically, and optional RadSec wraps RADIUS in TLS when a router reaches you across the open internet.

Automate it

A REST API, so RadiusForge fits the systems you already run.

Everything the console does, your billing system or your own scripts can do too — over a clean HTTP API with an OpenAPI reference built in. No add-on, no extra licence: it ships in the box.

Drive it from your billing

# create a subscriber the moment an invoice is paid
curl -X POST https://your-server/api/v1/subscribers \
  -H "Authorization: Bearer rfk_live_…" \
  -H "Content-Type: application/json" \
  -d '{"username":"jsmith",
       "plan":"Home 50/10",
       "password":"…"}'

Create and change subscribers, suspend and reactivate, reset passwords, disconnect a live session, and pull everyone's usage for a billing period — all as plain JSON.

Built for real integrations

Scoped keys — read-only or read-and-write, one Organisation each
Secure by default — keys hashed at rest, shown once, sent as a Bearer token over HTTPS
Hard to misuse — rate-limited, and unknown fields are refused by name so a typo is never silently ignored
Always consistent — the API runs the same checks as the web console, so the two can never disagree
Documented in the box — a complete reference at /api/v1/docs: every endpoint, field and error

Move from your old server

Switch across without touching the server you're switching from.

Migrating a live RADIUS server is where most tools make you nervous. RadiusForge reads your old one, never writes to it, and lets it keep serving customers until you choose to cut over.

1

Read-only assessment

A single script inspects your old FreeRADIUS server. It makes no changes — the server is left byte-for-byte as it was.

2

Encrypted move file

Everything it found is packed into one encrypted file, protected by a passphrase only you know.

3

Import in minutes

Upload the file to your new RadiusForge server. Subscribers, plans and routers arrive as a new Organisation, passwords preserved.

4

Cut over when ready

Check logins, then move routers across one at a time. Your old server keeps running until the last one is switched.

Nothing on your live server is ever changed. The assessment is read-only and fingerprint-identical, and no passwords or secrets leave the old server except inside the encrypted move file.

What it runs on

Honest about what's ready today.

RadiusForge is new. Here's exactly what's supported now, and what's next — so you can tell whether it fits your network before you commit.

Ready now

MikroTik routers — full speed-tier support, set in plain Mbps.
Juniper (MX & SRX) — RADIUS auth plus CoS profile and per-subscriber static IP, validated on live Junos.
Fortinet (FortiGate) — RADIUS auth with user-group assignment, validated on live FortiOS.
Cisco (IOS) — RADIUS auth, accounting and live disconnect (CoA), validated on live IOS. Per-subscriber speed via named QoS policy on ISG-class platforms.
RHEL 8 & 9, Rocky Linux, AlmaLinux — one-script install, tested end to end.
Ubuntu 22.04 & 24.04 LTS — same one-command install, validated end to end on FreeRADIUS 3.0 and 3.2.
Migration from existing FreeRADIUS — read-only, encrypted move file.
LDAP / Active Directory — check subscriber passwords against your existing directory, over LDAPS or StartTLS.
Hotspot vouchers — prepaid codes with time and data limits, printable sheets, enforced automatically. Toggle on per Organisation.
REST API — full HTTP API with scoped keys and an OpenAPI reference, for billing and automation.
Customer self-service portal — subscribers see their own plan and usage and change their password. Toggle on per Organisation.
Two-factor & brute-force protection — TOTP on every login, with lockout on repeated wrong attempts.
Data & time allowances — per-plan caps that slow a subscriber down or cut them off automatically when reached.
Modern RADIUS hardening — Message-Authenticator on every reply (BlastRADIUS / CVE-2024-3596 defence) and live disconnect (CoA).
Full dual-stack IPv6 — WAN /64, delegated /56 and per-plan IPv6 pools, with automatic overlap checks so you can't create a routing clash.
High availability — run across three mirrored servers (Percona XtraDB Cluster) so authentication never stops.
Automatic nightly backups — consistent snapshots on a schedule, one-click backup on demand, and a guided restore.
Safe upgrades — every upgrade backs up first, health-checks itself, and rolls back automatically if anything is wrong.
RadSec (RADIUS over TLS) — encrypt RADIUS to routers across the open internet; optional and off by default.
HTTPS out of the box — self-signed on install, with one-command Let's Encrypt or your own certificate.
Activity & audit log — a read-only record of who changed what and when, exportable as CSV.

Coming soon

Palo Alto (PAN-OS) — on the roadmap.
Optional billing module — toggleable per Organisation, for operators who want it.

Get RadiusForge

Self-hosted, installed in one command.

Download RadiusForge and run it on your own server. It installs in a single pass and starts a 30-day trial automatically — no licence key needed to begin. Your subscriber data never leaves your hardware.

Install in one command

curl -LO https://radiusforge.co.uk/download/radiusforge-2026.11.11.tar.gz
sudo mkdir -p /opt/radiusforge
sudo tar -C /opt/radiusforge --strip-components=1 \
  -xzf radiusforge-2026.11.11.tar.gz
cd /opt/radiusforge
sudo bash install.sh      # detects your OS, then asks: single server or cluster node

Runs on RHEL 8/9, Rocky Linux, AlmaLinux or Ubuntu 22.04 / 24.04 LTS. Ends with a live console on port 80 — no extra steps.

Verify before installing — SHA-256 (v2026.11.11):
6a9e5a5ac98a7a0e3084daf25bb777bb2f67a745728c33d77074d8448176930f

Download & start free

Get the latest release and install it on your own server. The 30-day trial starts automatically — no licence key needed to begin.

Download v2026.11.11 · .tar.gz (≈24 MB)

Full install & user guides included in the box
30-day trial — no licence needed to start
Migrate from your existing FreeRADIUS server

Need a licence to continue past the trial? Get in touch.

Documentation

Guides for every step — in plain language.

Beginner-friendly guides covering installation, your first setup, every screen (including hotspot vouchers) and production deployment — for both RHEL / Rocky / AlmaLinux and Ubuntu. Read them online or download to keep.

The complete manual

All six guides in one PDF, with a cover and contents — the easiest place to start.

Download the full manual (PDF)

18 pages · install, operation, hotspot vouchers & deployment

Individual guides

Quick Start — download to a working console, fast
Install Guide — step by step, with every check
Getting Started — the concepts, then your first setup
User Guide — every screen, incl. hotspot vouchers
Deployment Guide — HTTPS, production & upgrades
Overview — what it is and where to start

Questions

The things operators ask first.

Will it change anything on my current RADIUS server?

No. The migration assessment only reads your old server and is fingerprint-identical — it leaves the machine exactly as it found it. Your old server keeps serving customers until you decide to cut over, router by router.

What do I need to run it?

A server running RHEL 8/9, Rocky Linux, AlmaLinux or Ubuntu 22.04 / 24.04 LTS. The installer sets up FreeRADIUS, MySQL, the web console and a hardened system service for you. RadiusForge is self-hosted, so your subscriber data stays on your own machine.

Which routers are supported?

MikroTik, Juniper (MX & SRX), Fortinet (FortiGate) and Cisco (IOS) are supported today — MikroTik with speed tiers in plain Mbps, Juniper with CoS profiles and per-subscriber static IP, Fortinet with user-group assignment, and Cisco with RADIUS auth, accounting and live disconnect (CoA), all validated against live gear. Palo Alto (PAN-OS) is on the roadmap. Any router or firewall that speaks standard RADIUS can already authenticate against RadiusForge today.

Does it support IPv6?

Yes — full dual-stack. You can hand each subscriber a WAN /64 and a delegated /56 (or draw them from a per-plan pool), exactly the way you set a static IPv4 address. RadiusForge checks every IPv6 block for overlaps before it saves, so you can't accidentally hand out clashing prefixes. If you only sell IPv4 today, none of it gets in your way.

Can it run without downtime, and how are backups handled?

A single server suits most operators, but RadiusForge can run across three mirrored servers (a Percona XtraDB Cluster) so authentication keeps going even if one is down for maintenance. Either way it backs itself up every night as a consistent snapshot, you can take a backup on demand in one click, and upgrades take a fresh backup first and roll themselves back automatically if anything goes wrong.

What does it cost?

You can download RadiusForge and run it free for 30 days — no licence needed to start. For pricing and a licence to continue past the trial, get in touch and we'll talk through your network.

Can I move off it later?

Yes. It's a standard FreeRADIUS + MySQL backend underneath, so your data isn't locked into a proprietary format.

Be one of the first RadiusForge operators.

We're working with a small group of ISPs and network operators through early access. Tell us about your network and we'll help you try it.

info@radiusforge.co.uk

Or send us a message

We'll get back to you about early access. No marketing list, no spam.

Run a FreeRADIUS network without being a RADIUS expert.