No radius requests sent from CHR to radius server

RouterOS General
1

Hi team,

We’re setting up a CHR as a VPN server for L2TP/IPSec and SSTP, we’ve set this up correctly, and confirmed it is working with RouterOS’s internal radius server (secrets) list, however requests to the remote radius server aren’t sent. I’ve tested that the radius server is accepting and receiving request from other hosts. We’ve done packet trace on both the CHR and the Radius server, no packets are sent/received. Both devices are on the same subnet, basic firewall rules are configured for IPv4 on the CHR, no firewall rules are configured for IPv6. I’ve tried both IPv4 and IPv6, no radius request packets are sent to the radius server. I’m able to ping the devices obviously on both v4 and v6. CHR is on a free license. The logs show that the radius request times out.

What could this be?

Here are some code snippets:

/ip pool
add name=vpn-clients ranges=10.88.1.101-10.88.1.199
/ppp profile
set *FFFFFFFE bridge=vpn-clients local-address=10.88.1.254 remote-address=\
    vpn-clients
/interface l2tp-server server
set enabled=yes use-ipsec=required
/ip address
add address=10.x.x.14/25 comment="Public network" interface=ether1 network=10.x.x.0
/ppp aaa
set accounting=no use-radius=yes
/ppp secret
add name=ppp-test profile=default-encryption
/radius
add address=10.x.x.17 called-id=oob-router comment="Freeradius Server" domain=test service=ppp,ipsec src-address=10.x.x.14 timeout=3s
2

Did you try to add a “debug,radius” rule to /system logging and see what it does?

3

Thanks for the suggestion pe1chl,

See below the output:

Screenshot 2025-11-04 at 11.21.43
Screenshot 2025-11-04 at 11.21.43943×128 4.7 KB

4

You need to clear (make it grey in WinBox) the domain parameter of the /radius entry (that is currently set to test). Otherwise, if the clients do not supply the domain part as test at login then that /radius entry will not be used. As a result, no suitable /radius entry can be found, and you get the "no radius server found" log message.

5

I ran into the same issue before when my CHR wasn’t sending any RADIUS requests. In my case everything looked fine, but the source IP used by the router didn’t match the one set in /radius src-address. NAT was quietly rewriting it. After I excluded RADIUS traffic from NAT and confirmed the correct source address, the remote server started responding normally.

If you’ve already enabled debug,radius and still don’t see any packets going out, it’s worth checking your NAT and firewall rules because even an old masquerade rule can silently drop authentication traffic.

Docs worth checking:
Netgate RADIUS guide
AAA overview

6

Thanks CGGXANNX, that was it. Once I removed the domain from the /radius entry the requests started to go out to the radius server!