RADIUS service address filtering

For extra security, you can limit access to RADIUS services by entering an IP address for a specific network adapter or by adding a list of IP addresses (such as for VPN servers). This ensures that unauthorized hosts can't access RADIUS services.

Important: For Okta RADIUS server agent version 2.28.0 and later, the agent enforces a deny-by-default policy for client connections. For a new installation, the agent doesn't listen on any port until you configure a client IP allowlist to specify the clients that are allowed to connect. If you're upgrading from a version earlier than 2.28.0, your existing configuration is preserved.

To configure address filtering:

Go to the config.properties file in the installation folder of the RADIUS app. If the app is installed with the default settings, the file path is the following:
```
C:\Program Files (x86)\Okta\Okta RADIUS Agent\current\user\config\radius\
```
Back up the configuration file to ensure that you can recover from editing mistakes.
Open the config.properties file with any text editor.
Optional. To limit access to a network adapter, add the following entry to the file. Replace <IP address> with the IP address that you want to use:
```
ragent.network.bind = <IP address>
```
For example, to accept a connection where 10.10.10.110 is the adapter IP address, enter the following:
```
ragent.network.bind = 10.10.10.110 
```
If your RADIUS agent version is 2.28.0 or later: To limit client access for all RADIUS apps configured on this agent, add the following entry to the file. Replace each <IP address> with the IP address that you want to allow:
```
ragent.client_ip_allow_list = <IP address>, <IP address>, <IP address>
```
The following values are allowed:
- The * symbol (allow any client).
- A comma-separated list of IP addresses.
- A value of none, deny, or no value assigned (the agent won't listen on that port).
If your RADIUS agent version is 2.14.0 to 2.28.0, it's recommended to upgrade. To do so, add the following entry to the file to limit client access. Replace each <IP address> with the IP address that you want to use:
```
ragent.network.accept.allow_list = <IP address>, <IP address>, <IP address>
```
For example, to accept packets from a client using 10.10.10.15, 10.10.10.16, or 10.10.10.17:
```
ragent.network.accept.allow_list = 10.10.10.15, 10.10.10.16, 10.10.10.17
```
Remember: ragent.network.accept.white_list was deprecated in RADIUS agent version 2.14.0 and is replaced by ragent.network.accept.allow_list for version 2.14.0 to 2.28.0.
Recommended. For orgs with multiple RADIUS apps on this agent, to allow different clients per app, add the following entry to the file. Replace each <IP address> with the IP address that you want to allow:
```
ragent.client_ip_allow_list.<port> = <IP address>, <IP address>
```
For example, to allow different clients on two apps, enter the following:
```
ragent.client_ip_allow_list.1812 = 10.0.0.5,10.0.0.6
ragent.client_ip_allow_list.1645 = 10.0.1.10
```
Save the file and restart the okta-radius service for your changes to take effect.
To confirm which ports the agent is listening on, check the agent log file:
- An INFO entry indicates that a port is restricted to specific IP addresses.
- A WARN entry indicates that a port allows any client (*).
- A message saying Not listening on port(s)... indicates a port with no valid allowlist.
Not recommended. If you want to preserve the behavior of your RADIUS agent from versions earlier than 2.28.0, add the following entry to the file:
```
fileragent.client_ip_allow_list = *
```