FreeRADIUS clients.conf Generator

Generate clients.conf blocks for one NAS or a whole subnet, with a strong shared secret, sensible limits and matching NAS-side configuration.

Config generator RADIUS & AAA Runs in your browser
A single address or a CIDR block.
Try:

Result

Generated in your browser
This tool produces random values, so nothing is pre-generated here. Values appear as soon as the page loads and are never sent anywhere.

About FreeRADIUS clients.conf Generator

FreeRADIUS silently ignores packets from any source not listed in clients.conf - the most common cause of "the server is not responding". This generates a correct client block, a strong per-NAS secret, and the matching configuration for the NAS itself.

Per-NAS secrets

Use a unique secret per NAS. The shared secret protects the Response Authenticator and the User-Password obfuscation; one reused secret across an estate means one compromised device unlocks every RADIUS conversation. Rotate on device replacement, and store secrets somewhere that is not the configuration backup.

Subnet clients

A CIDR client entry lets you onboard a whole access layer at once, but it inherently means a shared secret. It is a reasonable trade for hundreds of switches doing 802.1X; it is a poor trade for three BNGs carrying subscriber sessions.

Common use cases

  • Onboarding a new BNG or access switch onto an existing FreeRADIUS server.
  • Generating a strong secret without reaching for a password site.
  • Producing matching NAS and server configuration in one step for a change request.

Edge cases and gotchas

  • Never commit clients.conf to a public repository - it contains live credentials.
  • CoA and Disconnect messages arrive on UDP 3799 and need the NAS to accept them (RouterOS: /radius incoming).
  • require_message_authenticator should be set to yes once every NAS supports it - it mitigates the BlastRADIUS class of attack.

Frequently asked questions

Why does the server ignore my NAS completely?
The source address is not covered by any client block, so FreeRADIUS drops the packet without a reply - deliberate, so the server cannot be used as an oracle. Check the NAS source address, which is often a loopback rather than the interface you expect.
Can one NAS have two entries?
Yes, for example separate blocks for its loopback and management addresses. Each needs its own client stanza with a distinct name.