Port 1812 – RADIUS Authentication

UDP

Port 1812 is the RADIUS authentication port where network access servers (NAS) send authentication requests. RADIUS centralizes network access control for Wi-Fi (WPA2-Enterprise), VPN, and switch port authentication (802.1X). The shared secret between NAS and RADIUS server uses MD5 – use RadSec (RADIUS over TLS) for untrusted networks.

Port Number

1812

Protocol

UDP

Service

Remote Authentication Dial-In User Service

Range

IANA Registered (1024–49151)

Description

RADIUS on UDP port 1812 handles authentication decisions for network access. When a user connects to WPA2-Enterprise Wi-Fi, a VPN, or a managed switch port, the network device sends an Access-Request to the RADIUS server. The server responds with Access-Accept (with attributes like VLAN assignment) or Access-Reject. RADIUS uses a shared secret with MD5-based packet authentication – this is vulnerable to offline attacks if an attacker captures packets between the NAS and RADIUS server. RadSec (RFC 6614) wraps RADIUS in TLS on TCP port 2083, eliminating the shared secret weakness. FreeRADIUS is the dominant open-source implementation. Port 1812 replaced the legacy port 1645 per RFC 2865.

Security risks

1CVE-2024-3596 (Blast-RADIUS): MD5 collision attack on RADIUS protocol – attacker with network position can forge Access-Accept responses, bypassing authentication entirely (disclosed July 2024, affects ALL RADIUS implementations)
2Shared secret weakness: RADIUS uses MD5(shared_secret + authenticator) for packet authentication. Short or guessable shared secrets allow offline brute-force of captured packets
3User-Password attribute uses reversible encryption (MD5-based XOR) – if shared secret is known, any captured Access-Request reveals the user's plaintext password
4No encryption of accounting data: RADIUS Accounting (port 1813) sends session details, usernames, and network assignments in cleartext with only MD5 authentication
5Rogue Access Point attack: if an attacker captures the RADIUS exchange between AP and server, they can offline-crack the shared secret and then forge authentication responses

Firewall guidance

Restrict port 1812/UDP to known NAS devices (access points, VPN concentrators, switches). The shared secret must be unique per-NAS and at least 22 random characters. For links traversing untrusted networks: use RadSec (RADIUS over TLS, port 2083) or IPsec tunnels between NAS and RADIUS server. Apply Blast-RADIUS mitigations (Message-Authenticator attribute required on all packets).

Diagnosis commands

Test RADIUS authentication (Access-Accept = working)

shell

radtest user password radiusserver 0 sharedsecret

Test 802.1X EAP authentication end-to-end

shell

eapol_test -c eapol_test.conf -s sharedsecret -a radiusserver

Verify RADIUS server is listening

shell

ss -ulnp | grep 1812

FreeRADIUS debug mode – see auth requests in real-time

shell

radiusd -X 2>&1 | tail -20

Usage examples

Port 1812 – RADIUS Authentication

shell

radtest user password radius-server 0 shared-secret
radiusd -X
eapol_test -c test.conf -s shared-secret

Common services on this port

FreeRADIUSMicrosoft NPS (Network Policy Server)Cisco ISEAruba ClearPassPacketFence

Related ports

1812

RADIUS Authentication (this port)

1813

RADIUS Accounting

1645

RADIUS Auth (legacy, pre-RFC)

1646

RADIUS Acct (legacy, pre-RFC)

2083

RadSec (RADIUS over TLS)

History

RADIUS (Remote Authentication Dial-In User Service) was created by Livingston Enterprises in 1991 for dial-up modem authentication. RFC 2865 (2000) standardized it on port 1812. RADIUS became the universal backend for network authentication: Wi-Fi (WPA2-Enterprise), VPN, 802.1X, and ISP login. The protocol's reliance on MD5 was acceptable in 1991 but is now cryptographically broken. RadSec (RFC 6614, 2012) wraps RADIUS in TLS but adoption remains low. The Blast-RADIUS attack (2024) forced urgent industry response.

FAQ

How do I mitigate the Blast-RADIUS (CVE-2024-3596) attack?

1. Require Message-Authenticator attribute in ALL Access-Request packets (FreeRADIUS: require_message_authenticator = yes). 2. Upgrade RADIUS server and NAS firmware to versions that enforce Message-Authenticator. 3. Use RadSec (RADIUS over TLS) for any link crossing untrusted networks. 4. Long random shared secrets (32+ chars) make the attack harder but don't eliminate it. 5. Long-term: migrate to RADIUS/TLS (radsec) or explore RADIUS successor protocols.

RADIUS vs TACACS+ – when to use which?

RADIUS (port 1812): encrypts only password field, combines authN+authZ, UDP-based, standard across all vendors. Best for: Wi-Fi (802.1X), VPN, ISP, anything multi-vendor. TACACS+ (port 49): encrypts entire packet body, separates authN/authZ/accounting, TCP-based, Cisco-proprietary. Best for: network device administration (switch/router CLI access) where you need per-command authorization. Most environments use both: RADIUS for user access, TACACS+ for admin access.

Specification

RFC 2865 – Port 1812 specification →