Hi Alan, I have the following debug logs. Scenario 1 - Initial setup - radsecproxy server IP is in clients table It loads clients.conf which is empty. It starts generating sql clients. I can see radsecproxy server IP address 10.0.8.130 was added by rlm_sql. rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database '*' on Localhost via UNIX socket, server version *, protocol version * rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, ipaddress, shortname, type, secret, server FROM clienttable rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id, ipaddress, shortname, type, secret, server FROM clienttable rlm_sql (sql): Adding client 10.0.8.130 (ce9) to mysite clients list rlm_sql (10.0.8.130): Client "ce9" (sql) added rlm_sql (sql): Released connection (0) Finally ends with below messages and starts listening. Listening on auth proto tcp address * port 2083 (TLS) Listening on auth address * port 1812 bound to server mysite Listening on acct address * port 1813 bound to server mysite Ready to process requests When I ran command radsecproxy -f -d 1 from radsecproxy server, it shows below error. ... new connection request on TCP socket Receive - Error receiving packet: Transport endpoint is not connected Ignoring request to auth proto tcp address * port 2083 (TLS) from unknown client 10.0.8.130 port 42299 proto tcp Ready to process requests ==================================================================================== Scenario 2 - radsecproxy server IP is in clients.conf (The one in the clients table is removed) including configuration file /etc/raddb/clients.conf client radsecproxy { ipaddr = 10.0.0.130 secret = <<< secret >>> proto = "tcp" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } It finally shows the ports listening message and ready. Listening on auth proto tcp address * port 2083 (TLS) bound to server mysite Listening on auth address * port 1812 bound to server mysite Listening on acct address * port 1813 bound to server mysite Ready to process requests When I ran command radsecproxy -f -d 1 from radsecproxy server, it shows below message and so on and successfully accepted. ... new connection request on TCP socket Listening on auth from client (10.0.0.130, 36223) -> (*, 2083, virtual-server=mysite) Waking up in 0.6 seconds. (0) Initiating new TLS session (0) Setting verify mode to require certificate from client (0) (other): before SSL initialization (0) TLS_accept: before SSL initialization (0) TLS_accept: before SSL initialization (0) <<< recv TLS 1.3 [length 0128] (0) TLS_accept: SSLv3/TLS read client hello (0) >>> send TLS 1.2 [length 003d] (0) TLS_accept: SSLv3/TLS write server hello (0) >>> send TLS 1.2 [length 0993] (0) TLS_accept: SSLv3/TLS write certificate (0) >>> send TLS 1.2 [length 014d] (0) TLS_accept: SSLv3/TLS write key exchange (0) >>> send TLS 1.2 [length 00e3] (0) TLS_accept: SSLv3/TLS write certificate request (0) >>> send TLS 1.2 [length 0004] (0) TLS_accept: SSLv3/TLS write server done (0) TLS_accept: Need to read more data: SSLv3/TLS write server done (0) TLS - In Handshake Phase (0) TLS - got 3101 bytes of data ==================================================================================== I vaguely have the idea like it is somehow treating all sql client table as UDP connection. Until I add the client in clients.conf with proto = tcp identifier, TCP incoming may not have a client record for radsecproxy server. On Wednesday, 8 July 2026 at 09:57:01 pm SGT, Alan DeKok <alan.dekok@inkbridge.io> wrote: On Jul 8, 2026, at 7:52 AM, Alan Smith via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Thanks for the advice Alan. I tried configuring radsecproxy in another server (radsec_server) which radsecproxy config pointing to my radius server who is listening at both udp 1812 and tcp 2083.After configuring radsecproxy successfully, this new server listens at udp 1812. I ran radtest in this server to localhost 1812 and it will go to radius server at 2083.Let me confirm this is the correct setup?
Yes.
The authentication needs the radsec_server IP address to be present in clients.conf. Although it is already present in SQL radius client table, it cannot be recognized.I think authentication request that reaches tcp 2083 are not associated with SQL client table. Did I miss to update something?
The server has debug output. Read it. Alan DeKok.