FreeRADIUS Billing for ISPs, Explained

FreeRADIUS is the open-source RADIUS server that most ISPs use to authenticate subscribers onto the network and control what each one is allowed to do. "RADIUS billing" is what happens when that authentication layer is wired to your billing system — so a customer's package, payment status and speed limits are enforced automatically at the moment they connect.

This guide explains, without the jargon, how RADIUS fits into an ISP, what "billing" adds on top, and where a management platform sits in the picture.

What RADIUS actually does

RADIUS handles three things, often called the "AAA" model:

• Authentication — is this subscriber who they say they are? (username/password, or MAC address.)
• Authorization — what are they allowed? Their speed profile, data limits, static IP, session limits.
• Accounting — how much did they use? Start/stop times and data counters for each session.

When a subscriber's router or your NAS (Network Access Server) receives a connection, it asks the RADIUS server. The server checks the subscriber's status and replies with either a rejection or an "accept" plus the attributes that define their service.

Where "billing" comes in

FreeRADIUS on its own knows nothing about money. It authenticates against whatever data you point it at. RADIUS billing is the connection between that data and your commercial reality:

• A subscriber's package (speed, duration, price) becomes the RADIUS reply attributes that shape their connection.
• A subscriber whose payment has expired is automatically rejected — or dropped to a captive portal — without anyone touching a router.
• Session accounting data flows back so usage and online status are visible in the same place you manage the customer.

Done well, defining a package once pushes it straight to RADIUS and to billing at the same time — you never configure a speed limit in two places.

The multi-vendor reality

Here's what trips up ISPs building this themselves: different hardware vendors expect different RADIUS attributes. A rate limit that works on MikroTik isn't sent the same way to Cisco, Huawei or Juniper. If you mix hardware — or switch vendors as you grow — you have to handle each one's vendor-specific replies correctly.

This is a common reason operators move from a hand-rolled FreeRADIUS setup to a managed platform: the platform knows each vendor's dialect and sends the right attributes automatically, so you can run mixed hardware without maintaining vendor-specific configuration by hand.

Do I need to be a FreeRADIUS expert?

To run a raw FreeRADIUS install: yes, quite a bit — config files, dictionaries, SQL schemas and vendor attributes. To run an ISP platform that uses FreeRADIUS underneath: no. The platform manages the RADIUS layer for you, exposes packages and subscribers as simple records, and gives you a cross-vendor "test auth" to confirm a subscriber would connect correctly — so you get the reliability of FreeRADIUS without hand-editing its internals.

Common questions

Does FreeRADIUS work with MikroTik?

Yes — MikroTik is one of the most common NAS devices used with FreeRADIUS. The MikroTik router acts as the RADIUS client and enforces the speed and session attributes the server returns.

Can RADIUS cut off non-paying subscribers automatically?

Yes. When billing status is tied to authentication, an expired or unpaid subscriber is rejected (or redirected) on their next connection attempt with no manual step — which is the whole point of RADIUS billing.

Is FreeRADIUS enough on its own?

For pure authentication, it's excellent. For running a business — packages, invoices, payments, accounting, franchise commissions and reporting — it's one layer of a larger system. That's the gap an ISP management platform fills.

Where Radyxen fits

Radyxen uses FreeRADIUS under the hood and handles the multi-vendor complexity for you — MikroTik, Cisco, Huawei, Juniper and more — while tying authentication directly to billing, accounting and your network view. For the bigger picture, read our guide on ISP management software, or see the full platform.