A RADIUS server answers login questions for your whole network. Its two UDP ports deserve the same protection as the keys to the building: reachable by your own network devices, invisible to everyone else.
Most setup guides end at the words it works, and leave the authentication ports open to any address that can reach the server. This page finishes the job properly: restrict UDP 1812 and 1813 to your LAN with Ubuntu's firewall, then audit the router and the client list so the server stays exactly as private as a login system should be.
FreeRADIUS listens on UDP 1812 (authentication) and 1813 (accounting). Those ports are an open door to your entire login system: anyone who can reach them can attempt logins, probe which usernames exist, and hammer the server. Inside your office LAN, the only things that should ever send packets to these ports are your registered switches, access points and VPN gateways.
There is no legitimate reason for the internet to talk to your RADIUS server directly. Remote sites and home workers reach it through the VPN or site-to-site tunnel — never through a port forward on the router.
Using Ubuntu's built-in firewall, open both ports to your LAN range only:
sudo ufw allow from 192.168.1.0/24 to any port 1812 proto udpsudo ufw allow from 192.168.1.0/24 to any port 1813 proto udpsudo ufw enable then sudo ufw statusReplace 192.168.1.0/24 with your real office subnet. If your network kit lives on its own management VLAN, allow only that narrower range — the tighter the list of who can even ask, the better.
The server firewall is only half the audit. Also check these three places:
clients.conf is a second lock — keep entries to individual device IPs with individual secrets, never 0.0.0.0/0Firewall rule plus strict client list plus a strong secret is three independent locks on the same door. An attacker has to defeat all of them; your users notice none of them.
The complete setup on a real Ubuntu server — install, first client, first user and the live test, all shown step by step in the video.
▶️ Watch Full VideoIt gives the entire internet a login oracle for your network: unlimited password guesses against your user list, probes that reveal which usernames exist, and an old UDP protocol that was never designed to face hostile traffic. Attackers scan for open RADIUS ports specifically because a successful guess can mean WiFi or VPN access to the whole office.
Build a site-to-site VPN between the branch router and the head office, and let the branch access points reach the server through the tunnel using their normal client entries. The RADIUS ports stay closed on every public interface, and the traffic is encrypted by the VPN on the way.
Yes, as part of the same habit. The RADIUS server holds your shared secrets and user configuration, so its SSH port should also be limited to your admin machines or management network with ufw, exactly like the RADIUS ports are limited here. One small firewall policy protects the whole box.