Port reference
Port 1812 (UDP) – RADIUS Authentication
RADIUS authentication — centralized AAA for network access, VPNs, Wi-Fi, and admin logins.
Quick facts
- Transport
- udp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on RADIUS servers (NPS, FreeRADIUS, ISE) serving NAS clients such as switches, APs, and VPNs, often with reused shared secrets.
What is port 1812 used for?
Port 1812 is the standard RADIUS authentication port, the backbone of centralized login (AAA). When a user signs in to Wi-Fi (WPA2/WPA3-Enterprise), a VPN, or 802.1X-protected switch ports, the network device forwards the credentials to a RADIUS server such as FreeRADIUS, Microsoft NPS, or Cisco ISE, which approves or denies access. Accounting runs alongside on port 1813.
When would you open it?
Open 1812 on the RADIUS server so your access points, switches, and VPN gateways can reach it. It's a server-to-network-device port that belongs on your internal or management network — there's no reason to expose it to the public internet.
Is it safe to open?
RADIUS relies on a shared secret and MD5, so use a long unique secret per device, keep it on a trusted private network, and prefer RadSec (RADIUS over TLS). See the security notes below.
How to check if this port is open
ss -tulpn | grep :1812
nmap -sU -p 1812 <target>netstat -ano | findstr :1812
Test-NetConnection <host> -Port 1812 # TCP onlylsof -i :1812
nmap -sU -p 1812 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1812 to your device's local IP, internal port 1812, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1812/udpsudo firewall-cmd --permanent --add-port=1812/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 1812 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1812" -Direction Inbound -Protocol UDP -LocalPort 1812 -Action AllowSecurity & risks
Common attacks
- Blast-RADIUS MD5 protocol attack (CVE-2024-3596)
- Offline cracking of weak shared secrets
- Credential brute force and password spraying via NAS
- Sniffing of cleartext attributes on UDP RADIUS
Hardening
- Patch for Blast-RADIUS and enable Message-Authenticator everywhere
- Use long, unique shared secrets per NAS client
- Prefer RADSEC (RADIUS over TLS) or IPsec for transport
- Restrict RADIUS to a management network and trusted NAS IPs
- Use EAP methods with mutual TLS; enforce MFA
How to block this port
sudo ufw deny 1812/udpsudo firewall-cmd --permanent --remove-port=1812/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 1812 -j DROPNew-NetFirewallRule -DisplayName "Block 1812" -Direction Inbound -Protocol UDP -LocalPort 1812 -Action Blocknmap snippet
nmap -sU -p1812 --script radius-test <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 1812 and 1645?
- 1812 is the modern IANA-assigned RADIUS authentication port; 1645 is the legacy port still seen on older gear. Both carry RADIUS auth, but 1645 should be retired.
- What is Blast-RADIUS (CVE-2024-3596)?
- A 2024 protocol flaw abusing RADIUS's MD5-based Response Authenticator to forge responses via a chosen-prefix collision, allowing an on-path attacker to bypass authentication. Mitigated by Message-Authenticator and patches.