Device-free positioning allows to localize and track passive targets (i.e., not carrying any electronic device) moving in an area monitored by a dense network of low-power and battery-operated wireless sensors. The technology is promising for a wide number of applications, ranging from ambient intelligence in smart spaces, intrusion detection, emergency and rescue operations in critical areas. In this paper, a new approach is proposed where both the average path-loss and the fluctuations of the received signal strength induced by the moving target are jointly modeled based on the theory of diffraction. A novel stochastic model is derived and used for the evaluation of fundamental performance limits. The model is proved to be tight enough to be adopted for real-time estimation of the target location. The proposed localization system is validated by extensive experimental studies in both indoor and outdoor environments. The model calibration is addressed in practical scenarios to compare the performance of different Bayesian online localization methods. The test-bed system supports efficient and flexible target tracking, without requiring any action from the end-users. In addition, the technology is proven to be readily applicable over the existing IEEE 802.15.4 compliant PHY layer standard, by adapting the low-level MAC firmware.