Radiator Server Documentation — v10.34.1

backends.radius-dns-sd

Table of Contents

radius-dns-sd (RADIUS DNS Service Discovery Backend)

The radius-dns-sd backend discovers upstream RADIUS servers dynamically using DNS Service Discovery (typically a choreography of NAPTR -> SRV -> A/AAAA lookups), then proxies authentication / authorization (and potentially accounting) requests to currently resolvable endpoints. It removes the need to hard-code server IPs and supports elastic / multi-region or rotating infrastructure.

When to Use

Scenario	Benefit
Large distributed RADIUS deployment	Automatic endpoint rotation & scaling
Roaming / federation environment	Seamless partner endpoint changes via DNS
Zero/low manual reconfiguration	Updates propagate through DNS TTL changes
Multi-protocol migrations (e.g. adding RadSec)	Controlled adoption by publishing new NAPTR records

Core Elements

Statement / Block	Required	Description
`naptr-service "...";`	Yes	NAPTR service pattern (e.g. `_radius._udp`, `_radsec._tcp`). Repeat for multiple patterns.
`challenge-timeout <duration>;`	No	Wait for the client continuation after forwarding Access-Challenge. Default: `60s`. See duration syntax.
`require_message_authenticator <boolean>;`	No	Require Message-Authenticator in supported RADIUS/1.0 responses. Default: `false`.
`proxy_unknown_attributes <boolean>;`	No	Forward dictionary-unknown attributes when their wire representation can be preserved safely. Default: `true`.
`server-template { ... }`	Yes	Default parameters (shared secret, timeouts, retries, status, etc.) applied to discovered endpoints.
`max-incoming-packet-size <integer>;`	No	Maximum packet accepted from each discovered endpoint. Default: `4096`.
`max-outgoing-packet-size <integer>;`	No	Maximum packet sent to each discovered endpoint. Default: `4096`.
`@pre-proxying { ... }`	No	Modify the request before upstream forwarding. See RADIUS proxying.
`@post-proxying { ... }`	No	Modify the reply before returning it downstream. See RADIUS proxying.
`statistics { ... }`	No	Optional metrics configuration if supported.

A discovered server inherits every applicable setting from server-template. If a dynamic endpoint later disappears from DNS, new requests will stop being routed to it once caches expire.

The template connect block can set independent deadlines for dns-timeout, connection-timeout, and TLS handshake-timeout. Each defaults to 5s.

The secret is required when DNS discovery can select the transport or when the template permits RADIUS/1.0. It may be omitted only when connect explicitly sets protocol tls; and its tls block sets exactly radius_versions 1.1;. This restriction prevents a discovered RADIUS/1.0 endpoint from being used without the shared secret required for packet authentication and attribute transforms.

Discovery Flow (Conceptual)

Iterate naptr-service entries in order:
- Perform NAPTR query for each pattern.
- For each resulting service, perform SRV lookups obtaining priority/weight/port/target.
Resolve target hostnames to A/AAAA addresses.
Construct candidate endpoint list (host/IP + port + transport protocol implied by pattern).
Apply load selection or fallback strategy implicitly (for DNS-SD backend the strategy is governed by current DNS answers; explicit server-selection is replaced by DNS weighting).
Proxy the request to a chosen endpoint.

Example

backends {
    radius-dns-sd "RADIUS_ROAMING" {
        naptr-service "_radius._udp";
        naptr-service "_radsec._tcp";
        challenge-timeout 5s;

        server-template {
            secret "FederationSecret2024!";
            timeout 4000;
            retries 1;
            status true;
            connections {
                max 8;
                min 1;
                idle-timeout 300;
            }
            # Optionally override transport if discovery lacks explicit hints:
            # connect { protocol tls; }
        }

        @pre-proxying {
            filter {
                # Remove sensitive local-only attributes if needed
                # Tunnel-Password;
            }
            modify {
                # Example (pseudo):
                # radiusproxy.request.attr.Operator-Name := "EXAMPLE_REALM";
            }
        }

        @post-proxying {
            filter {
                # Strip vendor attributes not permitted downstream
                # vendor-specific;
            }
        }
    }
}

The @ prefix is required for pipeline blocks. The legacy syntax without @ is deprecated and emits warnings.

`naptr-service`

Ordered preference. First successful pattern anchors subsequent SRV queries. A common deployment might start with secure transport (_radsec._tcp) and fall back to _radius._udp if secure endpoints are not yet published. Repeat the statement for each pattern:

naptr-service "_radsec._tcp";
naptr-service "_radius._udp";

Server Template Fields

Field	Purpose
`secret`	Shared secret used for RADIUS/1.0 packet authentication and attribute transforms. Optional only for an explicit strict RADIUS/1.1 TLS template.
`timeout`	Milliseconds to wait per request (excluding retries).
`retries`	How many retransmissions before marking attempt failed.
`connection-status { ... }`	Enables Status-Server polling independently for each discovered connection.
`status`	Compatibility syntax that enables Status-Server polling with default settings.
`connections { ... }`	Connection pool settings. Use `max`, `min`, and `idle-timeout` inside it.
`connect { ... }`	Optional transport override (`protocol`, `buffer`, `tls`) if DNS data insufficient.

If DNS returns transport explicitly (e.g. from the NAPTR service pattern), those should take precedence internally; the connect override is a fallback hint.

The connect block accepts:

protocol - Transport protocol: udp, tcp, or tls.
buffer - Requested receive and send socket buffer size in bytes. The default is 1048576.
tls { ... } - TLS configuration block (when using tls protocol).

Configure eap-message-validation in server-template to control unchanged malformed terminal EAP forwarding for discovered servers. The downstream server must also permit forwarding.