Module · RADIUS Core
The CRM's tables are the RADIUS tables.
FreeRADIUS reads radcheck, radreply and radacct straight from the product database. No sync jobs, no middleware, no second source of truth — when you change a customer in the panel, the network already knows.
What it does
Built in, not bolted on.
Stored-function authorize
fn_authorize_user runs every gate in one round trip: license, credentials, package, status, expiry, port bind, MAC bind. Readable SQL, not vendor magic.
Reply resolution
fn_authorize_reply resolves the session profile — IP pool, rate limit, session attributes — from the customer's current state at the moment of login.
Live accounting
Interim updates land in radacct as they arrive. Online sessions, usage and session history are queries, not estimates.
Change of Authorization
Disable, disconnect or re-profile a live session from the panel. Every CoA request and its NAS response is logged.
Dictionary import
Upload vendor RADIUS dictionaries and use their attributes in policies — Mikrotik, Cisco, Huawei or anything else your BRAS speaks.
Expiry pools, not cutoffs
Expired customers authenticate into a redirect pool instead of being refused — they see a renewal page, you keep the conversation.
Three tables, one truth
AAA without a translation layer.
-- what FreeRADIUS actually readsradcheckwho may authenticate — usernames, passwords,MAC binds. Written by the CRM, read by AAA. radreplywhat a session gets — pools, rate limits,vendor attributes, resolved per state. radacctwhat actually happened — sessions, octets,start/stop, live interim updates. -- one database. zero sync jobs.panel change → next Access-Request sees it- 01
No sync to break
Most billing panels shadow-copy customers into a separate RADIUS store and reconcile on a timer. Here there is nothing to reconcile — the authorize query joins the customer row directly.
- 02
Auditable by an engineer
The entire authorize path is stored SQL you can read, test and trace with radiusd -X. If your network engineer wants to veto a black box, show them the function.
- 03
State drives the session
Active, expired, disabled — each status maps to a pool and profile. Flip the status and the next authorization, or a CoA to the live session, enforces it.
Screenshot coming — the policy editor with radcheck and radreply attributes, captured from the live product.
What it replaces
Retire the workaround.
A cron job that copies customers into FreeRADIUS's database every five minutes — and the outages when it silently stops.
One database. The authorize function reads the customer table itself; there is no copy to go stale.
Hand-edited users files and vendor GUIs where nobody remembers why an attribute is set.
Policies and attributes managed in the panel, versioned by audit log, applied by stored function.
Expired customers hard-cut mid-session, then calling support to ask why the internet died.
Expiry lands them in a redirect pool with a renewal page. The session degrades gracefully; the payment often arrives the same day.
Keep exploring