ISP CRM · Billing · Resellers · Network

Dream Radius is the multi-tenant CRM that runs your ISP end to end. Authentication, Authorization and Accounting, six-tier reseller hierarchies, wallets, billing and NAS control, in one system that reconciles itself.

Book a demo Explore the platform

Automation: Automated billing & renewals
Hierarchy depth: 6 reseller tiers, isolated books
Deployment: Your server, your data

Product tour

One workspace for every ISP workflow.

From provisioning a new PPPoE user to reconciling a month of invoices — every operation lives inside a single, keyboard-fast interface.

app.dreamradius.com

Dashboard

Live KPIs, bandwidth, revenue and router health at a glance.

Overview

also in the workspaceHRMLedgerActivity LogsNotificationsUsage SummaryBulk Operation Logs

The problem

An ISP is a hierarchy of trust. Most software flattens it.

Run a reseller network on spreadsheets and shared logins, and the same three faults surface every month-end — on schedule.

month-end close · attempt 03
status: DIVERGED · 3 faults open

subdealer collects$1,200.00

dealer reports up$1,090.00 −110

franchise reports up$940.00 −150

unaccounted, somewhere−$260.00

fault 01 · the ledger

Revenue leaks between tiers

Dealers collect cash, franchises keep books in WhatsApp, and by month-end nobody can say who owes whom. Every handoff between tiers is a place money disappears.

radacct · live● online

ahmed.k — Session-Time 4h 12m

≠

billing_v7_final.xlsx● expired

ahmed.k — lapsed 12 days ago

fault 02 · the truth

RADIUS and billing don't talk

The AAA server says a customer is online; the billing sheet says they expired last week. Two systems, two truths — and the expired one is still burning your bandwidth.

panel login · admin / dream@2019 · shared with

franchise-04dealer-19dealer-23subdealer-88ex-staff · still valid

last password change · 19 months ago

fault 03 · the keys

Growth means losing control

Every new franchise is another login you share, another price list you email, another sub-book you can't audit. Scaling the network shouldn't mean diluting authority.

Chasing receipts won't close these. They aren't discipline problems — they're architecture problems. See the architecture ↓

Authority that nests

Six tiers down, one ledger up.

Each tier creates exactly one thing: the tier below it. The Admin runs the operation; everyone above provisions, everyone below holds only their slice. Pick a rung to see its reach.

authority ↓: one create per tier, nothing more
money ↑: every payment settles into one ledger

chain-of-command6 tiers · 1 ledger

The platform

Eight modules. One radius.

RADIUS Core

FreeRADIUS AAA driven by stored functions — radcheck, radreply and radacct are first-class product tables.

Customers

Every subscriber with their credentials, MAC bind, package, wallet and session history in one record.

Resellers

Six nested tiers with pass-through permissions. Each tier sees its own book and nothing else.

Wallets & Billing

Prepaid wallets, invoices and recovery — every transaction lands in a ledger that reconciles itself.

Packages & Policies

Speed profiles, IP pools and validity in one place. Change a policy; the network follows.

NAS Devices

Your BRAS and Mikrotik fleet registered, monitored and port-bound per customer where you need it.

Staff & HRM

Staff accounts with JSONB-scoped permissions — the cashier sees payments, not the network.

Reporting

Dashboards aggregated by cron, not by waiting: revenue, expiries, online sessions, reseller performance.

AAA you can inspect

Authorization isn't a black box. Watch a packet clear every gate.

radiusd -X · one packet's life

; NAS 10.0.0.1 (bras-01) → FreeRADIUSAccess-RequestUser-Name = "demo.user1"Calling-Station-Id = "AA:BB:CC:10:20:31"NAS-Port-Id = "ether5" ; authorize { } — every gate, one passlicense .................. armedaccount .................. foundpackage .................. active · 25M-Fiberexpiry ................... 2026-08-02port binding ............. ether5 allowedmac binding .............. match ; resolve session profilepool ..................... active → active-pool ; FreeRADIUS → NASAccess-AcceptFramed-Pool = "active-pool"Mikrotik-Rate-Limit = "25M/25M"

01
The request arrives
Your NAS forwards the subscriber's PPPoE/hotspot login to FreeRADIUS with the MAC and port it came in on.
02
Every gate, one pass
License, account, package, status, expiry, port binding, MAC binding — checked in a single round trip. No middleware, no sync jobs: the CRM and RADIUS share one source of truth.
03
The reply is the profile
The reply resolves the exact IP pool and rate limit for the customer's current state. Expired customers land in the expiry pool — redirected, not disconnected.

Money that reconciles

Every payment a dealer collects lands in a ledger you can audit.

Wallets fund activations, activations debit down the chain, renewals run on cron and expiries follow your policy — the same tables FreeRADIUS authorizes against. There is no second spreadsheet to disagree with.

Renewals automated
Ledgers per ISP

Wallet ledger · today

Franchise F-204 → wallet top-up+$1,200.00
Dealer D-1187 → 46 renewals−$598.00
Subdealer S-3305 → 12 activations−$228.00
Auto-renewal cron → 214 customers−$2,782.00
Closing balance — every tier agrees$4,517.13

Also from us

NAT Syslog — PTA-compliant CGNAT logging.

The same NAS fleet that authenticates your subscribers emits the port-block logs the regulator will one day ask about. NAT Syslog keeps them for 13 months and answers IP + port + time with a username — in milliseconds.

Explore NAT Syslog

Put your whole network under one radius.

A 30-minute walkthrough with your own topology on the table — hierarchy, billing and RADIUS included.

Book a demo Start a free trial

Every subscriber, every reseller, every packet, under one radius.