Ports 1812 and 1813RADIUS

What ports 1812 and 1813 are used for

RADIUS centralises authentication for network access. The device the user connects to (access point, switch, VPN gateway) is the RADIUS client; it forwards the user's credentials or EAP messages to the RADIUS server on UDP 1812 and receives Accept, Reject or Challenge. Session start/stop and usage records go to UDP 1813.

Uses include WPA2/WPA3-Enterprise Wi-Fi (802.1X with EAP-TLS or PEAP), wired 802.1X, VPN logins, and administrative access to routers and switches (though TACACS+ on TCP 49 is more common for that).

Security considerations

• The shared secret is the only protection. Use a long random secret per client device, and rotate it when devices are retired.
• Keep RADIUS on a management network. Because attributes are unencrypted, an observer learns usernames, device details and session data.
• Use EAP-TLS where possible. Certificate-based Wi-Fi authentication avoids sending passwords at all; PEAP-MSCHAPv2 depends on clients validating the server certificate.
• RadSec for anything crossing untrusted links, such as eduroam-style federations or cloud-hosted RADIUS.

Checking

On a Windows NPS server:

netstat -ano -p udp | findstr ":1812 :1813 :1645 :1646"

NPS logs authentication results in the Security event log (event IDs 6272 accept, 6273 reject), which is the fastest way to see whether requests arrive.

Firewall considerations

RADIUS servers need inbound UDP 1812/1813 (and optionally 1645/1646) from the network devices that act as clients, and nothing else. Never from the internet.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 1812 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.