# freeradius/freeradius-server architecture

> Architecture diagram of the GitHub repository freeradius/freeradius-server, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/freeradius/freeradius-server
- Repository: https://github.com/freeradius/freeradius-server

## Overview

FreeRADIUS is a configurable multi-protocol policy server. The principal workflow is a network device or test client sending a request to a server listener, where policy and authentication modules determine a response. The README documents supported protocols, backend integrations, and the recommended radclient testing loop. The sampled excerpts provide detailed evidence for selected client, Redis, BFD, LDAP-sync, MS-CHAP, and SIGTRAN components; internal connections among unsampled runtime stages are therefore left unasserted.

Main entry points: [`src/bin/radiusd.c`](https://github.com/freeradius/freeradius-server/blob/master/src/bin/radiusd.c) (FreeRADIUS server), [`src/lib/server/module.c`](https://github.com/freeradius/freeradius-server/blob/master/src/lib/server/module.c) (Module runtime), [`src/modules`](https://github.com/freeradius/freeradius-server/tree/master/src/modules) (Backend modules), [`src/listen/radius/proto_radius.c`](https://github.com/freeradius/freeradius-server/blob/master/src/listen/radius/proto_radius.c) (RADIUS listener)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_server["Server runtime"]
  node_radiusd["FreeRADIUS server<br/>[radiusd.c]"]
  node_listeners["Protocol listeners"]
  node_radius_listener["RADIUS listener<br/>[proto_radius.c]"]
  node_dhcp_listeners["DHCP listeners<br/>[proto_dhcpv4.c]"]
  node_dns_listener["DNS listener<br/>[proto_dns.c]"]
  node_tacacs_listener["TACACS listener<br/>[proto_tacacs.c]"]
  node_vmps_listener["VMPS listener<br/>[proto_vmps.c]"]
end

subgraph group_policy["Policy and authentication"]
  node_policy_engine["Unlang policy engine<br/>[interpret.c]"]
  node_module_runtime["Module runtime<br/>[module.c]"]
  node_mschap["MS-CHAP authentication<br/>[mschap.h]"]
  node_eap["EAP authentication<br/>[rlm_eap.c]"]
end

subgraph group_integrations["Protocol and backends"]
  node_backend_modules["Backend modules"]
  node_redis_pipeline["Redis command pipeline<br/>[pipeline.c]"]
  node_ldap_sync["LDAP synchronization"]
  node_bfd_session["BFD session state<br/>[session.c]"]
  node_sigtran_client["SIGTRAN client<br/>[client.c]"]
end

subgraph group_tools["Client tools"]
  node_radclient["RADIUS test client<br/>[radclient.c]"]
  node_radclient_ng["Next-gen RADIUS client<br/>[radclient-ng.c]"]
  node_dhcpclient["DHCP client<br/>[dhcpclient.c]"]
end

node_operator(("Operator or NAS"))

node_operator -->|"tests with"| node_radclient
node_operator -.->|"tests with"| node_radclient_ng
node_operator -->|"sends packets"| node_radius_listener
node_radiusd -->|"supports protocols"| node_listeners
node_radiusd -.->|"serves RADIUS"| node_radius_listener
node_radiusd -.->|"serves DHCP"| node_dhcp_listeners
node_radiusd -.->|"serves DNS"| node_dns_listener
node_radiusd -.->|"serves TACACS+"| node_tacacs_listener
node_radiusd -.->|"serves VMPS"| node_vmps_listener
node_policy_engine -.->|"dispatches modules"| node_module_runtime
node_module_runtime -.->|"invokes authentication"| node_mschap
node_module_runtime -.->|"invokes authentication"| node_eap
node_module_runtime -.->|"invokes backends"| node_backend_modules
node_backend_modules -.->|"uses Redis commands"| node_redis_pipeline

click node_radiusd "https://github.com/freeradius/freeradius-server/blob/master/src/bin/radiusd.c"
click node_listeners "https://github.com/freeradius/freeradius-server/tree/master/src/listen"
click node_radius_listener "https://github.com/freeradius/freeradius-server/blob/master/src/listen/radius/proto_radius.c"
click node_dhcp_listeners "https://github.com/freeradius/freeradius-server/blob/master/src/listen/dhcpv4/proto_dhcpv4.c"
click node_dns_listener "https://github.com/freeradius/freeradius-server/blob/master/src/listen/dns/proto_dns.c"
click node_tacacs_listener "https://github.com/freeradius/freeradius-server/blob/master/src/listen/tacacs/proto_tacacs.c"
click node_vmps_listener "https://github.com/freeradius/freeradius-server/blob/master/src/listen/vmps/proto_vmps.c"
click node_policy_engine "https://github.com/freeradius/freeradius-server/blob/master/src/lib/unlang/interpret.c"
click node_module_runtime "https://github.com/freeradius/freeradius-server/blob/master/src/lib/server/module.c"
click node_mschap "https://github.com/freeradius/freeradius-server/blob/master/src/modules/rlm_mschap/mschap.h"
click node_eap "https://github.com/freeradius/freeradius-server/blob/master/src/modules/rlm_eap/rlm_eap.c"
click node_backend_modules "https://github.com/freeradius/freeradius-server/tree/master/src/modules"
click node_redis_pipeline "https://github.com/freeradius/freeradius-server/blob/master/src/lib/redis/pipeline.c"
click node_ldap_sync "https://github.com/freeradius/freeradius-server/tree/master/src/listen/ldap_sync"
click node_bfd_session "https://github.com/freeradius/freeradius-server/blob/master/src/listen/bfd/session.c"
click node_sigtran_client "https://github.com/freeradius/freeradius-server/blob/master/src/modules/rlm_sigtran/client.c"
click node_radclient "https://github.com/freeradius/freeradius-server/blob/master/src/bin/radclient.c"
click node_radclient_ng "https://github.com/freeradius/freeradius-server/blob/master/src/bin/radclient-ng.c"
click node_dhcpclient "https://github.com/freeradius/freeradius-server/blob/master/src/bin/dhcpclient.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_radiusd,node_listeners,node_radius_listener,node_dhcp_listeners,node_dns_listener,node_tacacs_listener,node_vmps_listener toneBlue
class node_policy_engine,node_module_runtime,node_mschap,node_eap toneAmber
class node_backend_modules,node_redis_pipeline,node_ldap_sync,node_bfd_session,node_sigtran_client toneMint
class node_radclient,node_radclient_ng,node_dhcpclient toneRose
class node_operator toneIndigo
```

## Components

### Server runtime

- [FreeRADIUS server](https://github.com/freeradius/freeradius-server/blob/master/src/bin/radiusd.c): `src/bin/radiusd.c`
- [Protocol listeners](https://github.com/freeradius/freeradius-server/tree/master/src/listen): `src/listen`
- [RADIUS listener](https://github.com/freeradius/freeradius-server/blob/master/src/listen/radius/proto_radius.c): `src/listen/radius/proto_radius.c`
- [DHCP listeners](https://github.com/freeradius/freeradius-server/blob/master/src/listen/dhcpv4/proto_dhcpv4.c): `src/listen/dhcpv4/proto_dhcpv4.c`
- [DNS listener](https://github.com/freeradius/freeradius-server/blob/master/src/listen/dns/proto_dns.c): `src/listen/dns/proto_dns.c`
- [TACACS listener](https://github.com/freeradius/freeradius-server/blob/master/src/listen/tacacs/proto_tacacs.c): `src/listen/tacacs/proto_tacacs.c`
- [VMPS listener](https://github.com/freeradius/freeradius-server/blob/master/src/listen/vmps/proto_vmps.c): `src/listen/vmps/proto_vmps.c`

### Policy and authentication

- [Unlang policy engine](https://github.com/freeradius/freeradius-server/blob/master/src/lib/unlang/interpret.c): `src/lib/unlang/interpret.c`
- [Module runtime](https://github.com/freeradius/freeradius-server/blob/master/src/lib/server/module.c): `src/lib/server/module.c`
- [MS-CHAP authentication](https://github.com/freeradius/freeradius-server/blob/master/src/modules/rlm_mschap/mschap.h): `src/modules/rlm_mschap/mschap.h`
- [EAP authentication](https://github.com/freeradius/freeradius-server/blob/master/src/modules/rlm_eap/rlm_eap.c): `src/modules/rlm_eap/rlm_eap.c`

### Protocol and backends

- [Backend modules](https://github.com/freeradius/freeradius-server/tree/master/src/modules): `src/modules`
- [Redis command pipeline](https://github.com/freeradius/freeradius-server/blob/master/src/lib/redis/pipeline.c): `src/lib/redis/pipeline.c`
- [LDAP synchronization](https://github.com/freeradius/freeradius-server/tree/master/src/listen/ldap_sync): `src/listen/ldap_sync`
- [BFD session state](https://github.com/freeradius/freeradius-server/blob/master/src/listen/bfd/session.c): `src/listen/bfd/session.c`
- [SIGTRAN client](https://github.com/freeradius/freeradius-server/blob/master/src/modules/rlm_sigtran/client.c): `src/modules/rlm_sigtran/client.c`

### Client tools

- [RADIUS test client](https://github.com/freeradius/freeradius-server/blob/master/src/bin/radclient.c): `src/bin/radclient.c`
- [Next-gen RADIUS client](https://github.com/freeradius/freeradius-server/blob/master/src/bin/radclient-ng.c): `src/bin/radclient-ng.c`
- [DHCP client](https://github.com/freeradius/freeradius-server/blob/master/src/bin/dhcpclient.c): `src/bin/dhcpclient.c`

### Other components

- **Operator or NAS**

## Connections

- Operator or NAS → RADIUS test client: tests with (evidence: `README.md`)
- Operator or NAS → Next-gen RADIUS client: tests with
- Operator or NAS → RADIUS listener: sends packets (evidence: `README.md`)
- FreeRADIUS server → Protocol listeners: supports protocols (evidence: `README.md`)
- FreeRADIUS server → RADIUS listener: serves RADIUS
- FreeRADIUS server → DHCP listeners: serves DHCP
- FreeRADIUS server → DNS listener: serves DNS
- FreeRADIUS server → TACACS listener: serves TACACS+
- FreeRADIUS server → VMPS listener: serves VMPS
- Unlang policy engine → Module runtime: dispatches modules
- Module runtime → MS-CHAP authentication: invokes authentication
- Module runtime → EAP authentication: invokes authentication
- Module runtime → Backend modules: invokes backends
- Backend modules → Redis command pipeline: uses Redis commands