Port reference
Port 1645 (UDP) – RADIUS Authentication (legacy)
Legacy RADIUS auth port — carries AAA authentication requests, superseded by the official port 1812.
Quick facts
- Transport
- udp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on older RADIUS servers and NAS devices kept for backward compatibility. Should be migrated to port 1812.
What is port 1645 used for?
Port 1645 is the legacy RADIUS authentication port. RADIUS is the protocol that network gear — VPN gateways, Wi-Fi controllers, and switches doing 802.1X — uses to check user logins against a central server such as FreeRADIUS or Microsoft NPS. It was the original auth port (paired with 1646 for accounting) before IANA moved the standard to 1812 and 1813, but many devices still support 1645 for compatibility.
When would you open it?
You'd open 1645 only on a RADIUS server that older network appliances still talk to on this legacy port. For new deployments, use the official port 1812 instead and leave 1645 closed; keep it strictly between your authentication server and trusted network devices.
Is it safe to open?
RADIUS over UDP relies on a shared secret and MD5, so use a long unique secret, restrict it to known devices on a private network, and prefer RadSec (RADIUS over TLS). See the security notes below.
How to check if this port is open
ss -tulpn | grep :1645
nmap -sU -p 1645 <target>netstat -ano | findstr :1645
Test-NetConnection <host> -Port 1645 # TCP onlylsof -i :1645
nmap -sU -p 1645 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1645 to your device's local IP, internal port 1645, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1645/udpsudo firewall-cmd --permanent --add-port=1645/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 1645 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1645" -Direction Inbound -Protocol UDP -LocalPort 1645 -Action AllowSecurity & risks
Common attacks
- Blast-RADIUS MD5 collision forging Access-Accept responses (CVE-2024-3596)
- Shared-secret cracking from captured RADIUS exchanges
- Offline cracking of weak PAP/CHAP credentials
- Man-in-the-middle and replay against unprotected UDP RADIUS
Hardening
- Patch servers and clients against Blast-RADIUS (CVE-2024-3596)
- Enable Message-Authenticator on all RADIUS packets
- Migrate from legacy 1645 to the official port 1812
- Use long, unique shared secrets and tunnel RADIUS over IPsec/TLS (RadSec)
- Restrict RADIUS to trusted NAS devices and management networks
How to block this port
sudo ufw deny 1645/udpsudo firewall-cmd --permanent --remove-port=1645/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 1645 -j DROPNew-NetFirewallRule -DisplayName "Block 1645" -Direction Inbound -Protocol UDP -LocalPort 1645 -Action Blocknmap snippet
nmap -sU -p1645 --script radius-test <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 1645 and 1812?
- Both carry RADIUS authentication. Port 1645 is the original, legacy port; 1812 is the IANA-assigned official port that replaced it. Many devices still support 1645 for compatibility.
- Is RADIUS on port 1645 affected by Blast-RADIUS?
- Yes. Blast-RADIUS (CVE-2024-3596) exploits a weakness in RADIUS's MD5 response authentication over UDP, allowing an on-path attacker to forge Access-Accept responses regardless of which UDP port is used.