Run your ISP on one box.
Billing, bandwidth policy - and find the people sharing their connection.
RadControl v4 is the rebuilt radcontrol: a complete subscriber-management platform for WISPs and ISPs — prepaid billing and dealer resale, per-plan speed policy enforced in RADIUS and mid-session over CoA, live operations dashboards, and an ML-powered account-sharing analyzer. Self-hosted, offline-capable, installed with one command.
The root dashboard: host health, live RADIUS req/accept/reject meters, backup freshness, per-dealer rollups.
One product, the whole operation.
Subscribers & prepaid billing
Create, renew, top-up. Per-user MAC lock, static IPs, scheduled plan changes, bulk import, and a full per-user ledger. Subscribers get their own self-service portal.
Dealer hierarchy
Resell through a tree of dealers and sub-dealers with credit ledgers, parent-to-child transfers, per-dealer offer catalogues and commission that resolves down each level.
Scratch-card batches
Generate thousands of prepaid cards per batch, hand them to dealers, and track activation rates. First login activates the card — no operator involved.
Multi-tier speed policy
Baseline speed, usage tiers, burst, night booster windows, free-quota time spans, penalty speeds, daily and monthly caps — compiled into Mikrotik-Rate-Limit automatically.
Live operations
Online users, per-NAS status with RADIUS and NetFlow badges, host health, live request rates, billing, volume and top-user reports, and a full audit log.
Sharing Analyzer
NetFlow-driven, ML-scored account-sharing detection: 0–100% doubt scores with plain-language evidence, never verdicts. See how it works ↓
Zero-restart NAS onboarding
Add a MikroTik in the UI and it's served on its first packet — new routers are recognized automatically. No config reload, no service restart.
Continuous backup & DR
Client-side-encrypted snapshots every 15 minutes to your SFTP or S3 storage. A dead server is a 30-minute restore, driven by an in-product wizard.
Offline licensing
Cryptographically signed licenses verified locally — no phone-home, ever. Over the limit? New activations pause; your existing subscribers keep working.
Find the accounts feeding a whole building — with evidence, not hunches.
Password sharing quietly eats WISP revenue. RadControl watches sampled NetFlow from your routers and scores every account against its own plan population — continuously, on your own hardware.
Signals, not volume
Heavy users aren't sharers. The analyzer reads the shape of an account's traffic — roughly how many devices, at what hours, doing what — dozens of behavioral signals that a big download alone can't trigger.
Scored against peers
A machine-learning ensemble, retrained continuously, ranks each account against the others on the same plan. New installs run a careful baseline period before scores go live — no snap judgements on day one.
Doubt, not verdicts
Scores are doubt percentages, and every score comes with the plain-language observations behind it. Large families exist; you review the evidence before you act.
The ranked report: doubt scores, trends, and the top signals behind each — filterable, exportable, dealer-scoped.
Drill into any account: score history, weekly activity heatmap, device-count signals over time, sampling-corrected traffic mix.
Privacy-conscious by design: flows are sampled, raw data is kept only briefly, and long-term storage is aggregate only. Ready-made MikroTik export recipes are built into the NAS pages — enabling it is a two-minute job per router.
A high-performance RADIUS engine that answers instantly — and never guesses.
Every login is answered by RadControl's purpose-built RADIUS engine. It checks the subscriber, the plan, the balance and the usage in one stroke, and replies in a blink — even at peak hour, on modest hardware. Policy is computed fresh on every request, so what the router applies is always the current truth.
- Speeds, quotas, bursts and time windows are evaluated live on each request — there is no cached policy to go stale and no sync job to wait for.
- Login and mid-session always agree: the speed a router gets over CoA is exactly what a fresh login would get at that moment.
- When a night window opens or a cap is crossed, the router is updated immediately — subscribers never keep yesterday's speed by accident.
- Fail-closed by design: if the platform can't verify an account, it doesn't let it online — an outage never becomes free internet.
# 02:14 — login request from router 10.10.0.1 auth: ahmed.kareem → plan 'Home 25M' · usage 111G / 400G · ok auth: night booster active (01:00–07:00) → speed 10M/50M auth: Access-Accept — rate limit + pool + session window applied # 05:02 — usage tier crossed while still online coa: ahmed.kareem → new rate 2M/6M pushed to 10.10.0.1 coa: acknowledged — applied without disconnecting the session
Your dealer network, priced down the tree.
Dealers buy credit, resell your plans with their own markup, and open branches of their own. Every level sees only its subtree; prices resolve base → +commission per resale level, and every credit movement is one row in an immutable ledger.
- Deposits, withdrawals and parent→child transfers with running balances.
- Scratch-card batches priced per dealer, activation tracked per card.
- Per-dealer feature flags: sub-dealer creation, plan changes, credit floors.
- Aggregate dashboards — user counts and volume per dealer, never raw sessions.
Every subscriber, one page. Live status, cap meters and expiry in a stats strip; profile, billing ledger and network activity in tabs. The usage chart splits validated download/upload by day, and the session table shows the accounting history exactly as the routers reported it.
- Renew, top-up, override bandwidth, or schedule a plan change in two clicks.
- Global search from the header: name, username, email, or dealer.
- Subscribers check their own balance and usage in the UserCP portal.
The server can die. The business doesn't.
Every 15 minutes RadControl snapshots your business data — subscribers, balances, ledgers, settings — encrypts it on your box, and ships it to storage you control (SFTP or any S3-compatible bucket). The vendor never sees plaintext; the passphrase is shown to you once, and it is the key to everything.
- Hardware dies → fresh box + install command + restore wizard ≈ 30 minutes.
- Backup freshness sits on the dashboard: protected, or it isn't.
- Licenses verify offline with signed blobs — air-gapped networks welcome.
- Auto-tuned at install: the platform sizes itself to the hardware you give it.
Your routers talk to one node. That's the whole diagram.
Every NAS speaks standard RADIUS and NetFlow to a single self-hosted RadControl node; the node pushes mid-session changes back over CoA. Operators, dealers and subscribers use the web console — and encrypted snapshots leave for storage you control.
Up and running before the coffee cools.
One command on a fresh Linux box installs everything — Docker, database, RADIUS, analytics — and prints your login.
$ curl -fsSL https://radcontrol.org/install.sh | sudo bash