Authenticate.
Account.
Disconnect.
FreeRADIUS-backed AAA wired into your billing. PPPoE, hotspot, and static IP profiles, with CoA enforcement that ends the session the second a payment lapses.
The AAA layer you don't have to operate.
ISPStack ships a production-grade RADIUS stack — authentication, accounting, and dynamic auth — wired to your subscriptions, your payments, and your audit log.
PPPoE · Hotspot · Static IP
Subscriber dial-in, voucher-based hotspot, and reserved-IP profiles all served from one FreeRADIUS layer — backed by the same database as your billing.
CoA-Disconnect on lapse
RFC 5176 dynamic-auth pushes a disconnect packet the moment a payment lapses or an admin suspends. 3-retry with exponential backoff and per-NAS port override.
FUP throttle via CoA
When a customer crosses their threshold, a live rate-limit packet replaces their profile mid-session. No kick, no re-auth, no router reload.
Per-session accounting
Acct-Start / Interim-Update / Acct-Stop captured per RFC 2866, attributed back to the subscription and invoice that paid for it.
Walled garden
Suspended customers land on a parking pool with a captive portal that lets them top-up, then auto-reactivates the session the instant payment clears.
Concurrent session limits
Per-username max-simultaneous-use enforcement at the session-service layer — stops password sharing without manual policy plumbing.
Payment lapses. Session ends. No human in the loop.
The same workspace that takes the payment knows when it didn't arrive. A Disconnect-Request goes out, the NAS drops the session, the customer lands in the walled garden — typically in under a second.
Subscription state changes
Invoice lapses, admin suspends, or an FUP threshold trips. The billing layer publishes the change.
CoA packet → NAS
ISPStack sends a Disconnect-Request (or rate-limit CoA) to the customer's NAS on port 3799 — 1700 on MikroTik.
Session ends · garden opens
NAS drops the session, the framed-route flips to the parking pool, captive portal offers a top-up. Auto-reactivates on payment.
Telemetry your NOC will actually use.
Auth events, accounting tear-downs, CoA dispatches, IP-pool utilisation — surfaced in the same console, with the packet-level detail your network team expects.
| time | event | user | NAS | detail |
|---|---|---|---|---|
| 00:42:14 | Auth-ACK | mwangi.n | NAS-NRB-03 | PPPoE · Framed-IP allocated |
| 00:42:11 | CoA-ACK | aisha.o | NAS-NRB-01 | rate-limit 2M/2M (FUP) |
| 00:41:58 | Auth-REJ | unknown | NAS-MOM-01 | User-Password mismatch |
| 00:41:42 | Acct-Stop | wanjiku.k | NAS-KSM-02 | Lost-Carrier · 11h 08m |
| 00:41:31 | Auth-ACK | otieno.s | NAS-NRB-02 | Static-IP · 100M profile |
Standards-compliant. No surprises.
Every wire-level packet, every default port — what we actually support, written out so your network team can validate before you ever sign up.
- PAP
- CHAP
- MS-CHAPv2
- Cleartext-Password (encrypted at rest)
- Acct-Start
- Acct-Interim-Update
- Acct-Stop
- RFC 2866 compliant
- Disconnect-Request
- CoA-Request
- RFC 5176 / 3576
- 3-retry · 200ms backoff
- 1812 · auth
- 1813 · accounting
- 3799 · CoA (default)
- 1700 · CoA (MikroTik override)
Wire it up to a NAS this afternoon.
PPPoE, hotspot, static-IP profiles, FUP rules, walled-garden DNS — all live within an afternoon of pointing your NAS at us.