How to Set Up a Local RADIUS Server: The Easy Alternative to NPS and FreeRADIUS

Keytos Team | August 19, 2026

Introduction - Why is a RADIUS Server Required for Network Authentication?

When you’re setting up your wired ethernet or Wi-Fi networks, you want to make sure that not anybody can just walk up and connect to your resources. While your ethernet jacks are usually behind locked doors and Wi-Fi networks can have a password, these protections are easily bypassed by tailgaters into your building or a leaked Wi-Fi password. This is where a RADIUS (Remote Authentication Dial-In User Service) server comes in, where you can implement strong 802.1X authentication that requires your devices to log in to your network before gaining access.

While this blog post won’t go in depth on how RADIUS works, you can check our previous blog post for a detailed explanation. This post will instead focus on the different ways to host a RADIUS server locally, including using EZRADIUS for a simple and efficient setup.

How Do Organizations Typically Host Their Own RADIUS Servers?

If you Google “RADIUS servers”, you typically see the top two self-hostable solutions: Microsoft’s Network Policy Server (NPS) and FreeRADIUS. While both are popular options for hosting a RADIUS server locally, they come with their own complexities, limitations, and maintenance requirements.

NPS is a Windows Server-based solution that integrates tightly with Active Directory, making it a convenient choice for organizations already using Windows infrastructure. If you’re already running an on-premises Active Directory, NPS can be a straightforward option for implementing RADIUS authentication. However, it doesn’t support cloud-only Entra ID accounts without manual workarounds and “ghost accounts”, since NPS can only match against on-premises Active Directory accounts.

FreeRADIUS, on the other hand, is an open-source RADIUS server that runs on various operating systems. It’s a great option if you want to get your hands dirty and are comfortable with community-supported modules for Entra ID support, as FreeRADIUS doesn’t have built-in Entra ID support.

Both options require a certain level of technical expertise and ongoing maintenance, and they require multiple systems outside of the RADIUS server itself, such as ghost account syncing for NPS and community-supported OAuth modules for FreeRADIUS. It’s for this reason that a lot of organizations have looked for cloud-hosted solutions or hybrid solutions that don’t require managing all these additional components themselves.

Do I Even Need a Local RADIUS Server?

If you’re looking for a RADIUS server that can authenticate your Entra ID users either through their username and password, or through certificate-based authentication, EZRADIUS by Keytos is a popular option that provides both a cloud-hosted solution as well as a free local deployment add-on for organizations looking for minimal latency and maximum availability without the need to manage complex infrastructure.

But before we get into how to set up an on-premises EZRADIUS service, it’s important to evaluate whether you truly need a local RADIUS server. For most organizations, a cloud-hosted RADIUS solution like EZRADIUS can cover 100% of your needs without the added complexity of managing local infrastructure. EZRADIUS was built from the ground up by ex-Microsoft engineers with latency and availability in mind, with:

• 20+ regions worldwide to choose from, ensuring your global workforce has a RADIUS server nearby for low latency connections
• 99.95% uptime enterprise-tier SLA to guarantee reliable access to your RADIUS services
• Geo + zonal redundancy to ensure high availability and resilience against regional failures
• RADIUS + RadSec Support for secure and reliable authentication over both traditional and encrypted channels
• No infrastructure or servers to manage. We take care of all the hosting, patching, and maintenance for you

However, there are a few scenarios where a local RADIUS server might still be necessary, such as:

• Remote locations with spotty internet connectivity, where relying on a cloud-hosted RADIUS server could lead to authentication failures.
• Legacy systems that rely on older authentication protocols and cannot use RadSec for secure authentication.
• Highly available environments that require additional redundancy and failover capabilities for critical authentication services.

In these cases it makes sense to deploy a local RADIUS server which proxies, caches, and handles authentication requests locally, ensuring continued access even when connectivity to the cloud-hosted RADIUS server is unreliable. This hybrid approach allows organizations to benefit from the reliability and scalability of a cloud-hosted RADIUS service while maintaining local control and redundancy for critical authentication scenarios.

How to Set Up a Local RADIUS Proxy with EZRADIUS

A local RADIUS proxy runs within your network and processes authentication requests locally. It syncs with your cloud RADIUS policies to ensure consistent authentication rules and policies across both local and cloud environments, but it can operate independently when connectivity to the cloud-hosted RADIUS server is unavailable.

Prerequisites for Deploying a Local RADIUS Server

Before we get into the specific set up steps, let’s review the prerequisites and considerations for deploying a local RADIUS proxy with EZRADIUS. Since the local proxy runs as a Docker container, you’ll need a Linux server with the following specifications:

• Operating System: Linux (Ubuntu 24.04 or later is recommended)
• CPU: 2 cores minimum
• RAM: 4 GB minimum
• Software: Docker Engine (20.10 or later)

Docker on Windows is not currently supported due to issues with the IP address of the client not being correctly passed to the container.

On your network side, you’ll need:

• Outbound Internet Access: The local RADIUS proxy needs to communicate with the EZRADIUS and the Entra ID cloud servers. Ensure that the server has outbound internet access on port 443 (HTTPS). Inbound access is not required.
• Ports: Ensure that your network devices (like VPNs, Wi-Fi access points, and firewalls) can send RADIUS authentication requests to the local RADIUS proxy on UDP ports 1812 (authentication) and 1813 (accounting) for RADIUS and/or 2083 (RadSec). These do not need to be open to the internet, only between your devices and the local proxy.

Step 1: Create Your EZRADIUS Cloud RADIUS Profile

Your local EZRADIUS proxy container syncs with your EZRADIUS cloud network profiles to pull down its configuration. The first step is to create an EZRADIUS subscription and set up a cloud RADIUS network profile. The network profile will configure things like who can authenticate, which authentication methods are allowed, and the RADIUS clients that are permitted to communicate with the local proxy.

Visit the EZRADIUS getting started guide for a step-by-step walkthrough on creating your EZRADIUS subscription and setting up your cloud RADIUS network profile.

Step 2: Create an Entra ID App Registration for Your Local Proxy

To allow your local RADIUS proxy to authenticate directly against Entra ID and Intune without a dependency on the EZRADIUS cloud service, you’ll register a separate Entra ID application for your proxy which will handle the authentication requests from the local proxy to Entra ID.

Step 3 - How to Register a New Local RADIUS Proxy in EZRADIUS

Now that you have your Entra ID application set up for the local RADIUS proxy, you can proceed to register the new local RADIUS proxy in your EZRADIUS instance. This will allow you to download the configuration files needed to set up the local proxy container on your Linux machine.

Step 4 - How to Run Your Local RADIUS Proxy for Cloud RADIUS

Now that you have registered your local RADIUS proxy in EZRADIUS and set up the necessary Entra ID application, you can proceed to run the local RADIUS proxy container on your Linux machine using the configuration files you downloaded from EZRADIUS.

docker run --detach --restart=always --pull=always \
	--publish 1812:1812/udp --publish 1813:1813/udp --publish 2083:2083/tcp --publish 8080:8080 \
	--env LocalServer__providerEndpointUrl=https://local.<region>.ezradius.io/ \
	--env LocalServer__certificateFilePath=/app/certificate.pem \
	--env AppDetails__ClientID=<YourClientID> \
	--env AppDetails__AppID=<YourAppID> \
	--env AppDetails__HomeTenant=<YourHomeTenant> \
    --env APPLICATIONINSIGHTS_CONNECTION_STRING="<YourApplicationInsightsConnectionString>" \
	--volume <YourCertificateFile>.pem:/app/certificate.pem:rw \
	keytos-eqgzasb8bufxa0cd.azurecr.io/ezradius/local-server:latest

name: ezradius

services:
  local-server:
    image: keytos-eqgzasb8bufxa0cd.azurecr.io/ezradius/local-server:latest
    restart: always
    pull_policy: always
    ports:
      - "1812:1812/udp" # RADIUS authentication
      - "1813:1813/udp" # RADIUS accounting
      - "2083:2083/tcp" # RADIUS Over TLS (RadSec)
      - "8080:8080/tcp" # Health checks and management API
    environment:
      LocalServer__providerEndpointUrl: "https://local.<region>.ezradius.io/"
      LocalServer__certificateFilePath: "/app/certificate.pem"
      AppDetails__ClientID: "<YourClientID>"
      AppDetails__AppID: "<YourAppID>"
      AppDetails__HomeTenant: "<YourHomeTenant>"
      APPLICATIONINSIGHTS_CONNECTION_STRING: "<YourApplicationInsightsConnectionString>"
    volumes:
      - type: bind
        source: ./data/setup/<YourCertificateFile>.pem
        target: /app/certificate.pem
        read_only: false

Your local RADIUS proxy should now be up and running.

Step 5 - Connect Your Network Devices to Your Local RADIUS Proxy

Now that your local RADIUS proxy is up and running, you need to configure your network devices to point to it for authentication requests. This typically involves updating the RADIUS server settings on your devices to use the IP address of your local RADIUS proxy. Visit our set of network device configuration guides for detailed instructions on how to configure various types of network devices.

We also recommend setting your backup/secondary RADIUS server to point to the EZRADIUS cloud servers. This ensures that if your local RADIUS proxy becomes unavailable, authentication requests can still be processed by the cloud servers, maintaining uninterrupted access for your users.

Have Questions About Setting Up a Local RADIUS Server?

If you have any questions or need further assistance with setting up your local RADIUS server, feel free to reach out to our team of cloud PKI and identity experts who can provide guidance and support tailored to your specific network environment.