<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://wiki.ampr.org/w/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Airgapped</id>
	<title>44Net Wiki - User contributions [en]</title>
	<link rel="self" type="application/atom+xml" href="https://wiki.ampr.org/w/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Airgapped"/>
	<link rel="alternate" type="text/html" href="https://wiki.ampr.org/wiki/Special:Contributions/Airgapped"/>
	<updated>2026-09-16T13:25:17Z</updated>
	<subtitle>User contributions</subtitle>
	<generator>MediaWiki 1.42.3</generator>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=MediaWiki:Common.js&amp;diff=2919</id>
		<title>MediaWiki:Common.js</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=MediaWiki:Common.js&amp;diff=2919"/>
		<updated>2026-09-09T23:52:11Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: Created page with &amp;quot; mw.hook(&amp;#039;wikipage.content&amp;#039;).add(function ($content) {       $content.find(&amp;#039;a[title^=&amp;quot;Term:&amp;quot;]&amp;#039;).removeAttr(&amp;#039;title&amp;#039;);   });&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt; mw.hook(&#039;wikipage.content&#039;).add(function ($content) {&lt;br /&gt;
      $content.find(&#039;a[title^=&amp;quot;Term:&amp;quot;]&#039;).removeAttr(&#039;title&#039;);&lt;br /&gt;
  });&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Template:Term&amp;diff=2831</id>
		<title>Template:Term</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Template:Term&amp;diff=2831"/>
		<updated>2026-08-07T20:22:15Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{#if:{{{1|}}}|{{#ifexist:Term:{{{1}}}|[[Term:{{{1}}}|{{#tag:span|{{#if:{{{2|}}}|{{{2}}}|{{{1}}}}}{{#tag:span|{{Term:{{{1}}}|mode=short}}|class=term__card mw-term__card|role=tooltip|style=display:none;}}|class=term mw-term}}]]|[[Term:{{{1}}}|{{#if:{{{2|}}}|{{{2}}}|{{{1}}}}}]]}}}}&amp;lt;noinclude&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Editor usage:&lt;br /&gt;
&amp;lt;pre&amp;gt;{{term|BGP}}&amp;lt;/pre&amp;gt;&lt;br /&gt;
Optional display text:&lt;br /&gt;
&amp;lt;pre&amp;gt;{{term|Autonomous System|AS}}&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Behavior:&lt;br /&gt;
* If &amp;lt;code&amp;gt;Term:&amp;amp;lt;name&amp;amp;gt;&amp;lt;/code&amp;gt; exists, this renders a link with a hover card using the term&#039;s short definition.&lt;br /&gt;
* If it does not exist, this renders plain text (no red link).&lt;br /&gt;
&amp;lt;/noinclude&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Term:Bare_metal&amp;diff=2830</id>
		<title>Term:Bare metal</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Term:Bare_metal&amp;diff=2830"/>
		<updated>2026-08-07T20:13:16Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{TermDefinition&lt;br /&gt;
 | short = Running an operating system directly on physical hardware, with no hypervisor or virtualization layer in between.&lt;br /&gt;
 | long  = A bare-metal installation runs the OS directly on the device (e.g. Home Assistant OS on a Raspberry Pi) rather than as a virtual machine or container on a host system.&lt;br /&gt;
 | mode  = {{{mode|view}}}&lt;br /&gt;
}}&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2829</id>
		<title>Home Assistant</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2829"/>
		<updated>2026-08-07T20:10:10Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Home Assistant is an open source home automation server. It has integrations for a wide variety of devices, and allows you to create custom dashboards for viewing sensor information and controlling your devices. If you want to access your Home Assistant instance from anywhere, but cannot port forward due to {{Term|CGNAT}}, making your instance publicly accessible via 44Net is one solution. Even if your home internet isn&#039;t behind CGNAT, it likely has a dynamic IP, which would require you to set up dynamic DNS for your instance to maintain consistent external access. A 44Net IP lets your instance be publicly accessible at a fixed IPv4 address for free. &lt;br /&gt;
&lt;br /&gt;
Prerequisites: &lt;br /&gt;
* A Home Assistant instance (set this up &#039;&#039;&#039;before&#039;&#039;&#039; exposing it to the internet so that setup cannot be hijacked)&lt;br /&gt;
* A 44Net Connect account &lt;br /&gt;
&lt;br /&gt;
== Step 1: Set up your tunnel == &lt;br /&gt;
Home Assistant OS is designed to operate less like a general purpose computing device and more like an appliance. There is no package manager with which to install higher level firewall tools, and the Home Assistant WireGuard application is unmaintained as of 2026. If you&#039;re setting up a fresh Home Assistant installation for the express purpose of exposing it to 44Net, the easiest option is running it as a docker container on a device with a [[44Net_Connect/Single Device Tunnel | single device tunnel]]. If you have a dedicated Home Assistant appliance, such as a Home Assistant Green or a Raspberry Pi running Home Assistant OS on {{Term|bare metal}}, the recommended configuration is to put it on a [[44Net_Connect/Routed Subnet | routed subnet]].  &lt;br /&gt;
&lt;br /&gt;
For fresh installations using a single device tunnel, it&#039;s recommended to configure WireGuard as a {{Term|split tunnel}} by setting &amp;lt;code&amp;gt;AllowedIPs&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;44.0.0.0/9, 44.128.0.0/10&amp;lt;/code&amp;gt;. This puts &lt;br /&gt;
&lt;br /&gt;
== Step 2: Open port == &lt;br /&gt;
Now that your Home Assistant instance and 44Net Connect tunnel are set up, it&#039;s time to open the required port in your firewall to make Home Assistant publicly accessible. The default Home Assistant port is 8123, so unless you&#039;ve changed it, you&#039;ll need to open &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt; in your firewall. If you&#039;re running a single device tunnel with a Home Assistant VM or docker container, it&#039;s as simple as opening the device&#039;s firewall on &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt;. If you have a Home Assistant appliance inside a routed subnet, you&#039;ll need to open the port in the router&#039;s firewall, and ensure the firewall&#039;s rule set allows {{Term|WAN}} devices to initiate connections on that port.&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Term:Bare_metal&amp;diff=2828</id>
		<title>Term:Bare metal</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Term:Bare_metal&amp;diff=2828"/>
		<updated>2026-08-07T20:07:43Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: Created page with &amp;quot;.&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;.&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2827</id>
		<title>Home Assistant</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2827"/>
		<updated>2026-08-07T20:06:37Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Home Assistant is an open source home automation server. It has integrations for a wide variety of devices, and allows you to create custom dashboards for viewing sensor information and controlling your devices. If you want to access your Home Assistant instance from anywhere, but cannot port forward due to {{Term|CGNAT}}, making your instance publicly accessible via 44Net is one solution. Even if your home internet isn&#039;t behind CGNAT, it likely has a dynamic IP, which would require you to set up dynamic DNS for your instance to maintain consistent external access. A 44Net IP lets your instance be publicly accessible at a fixed IPv4 address for free. &lt;br /&gt;
&lt;br /&gt;
Prerequisites: &lt;br /&gt;
* A Home Assistant instance (set this up &#039;&#039;&#039;before&#039;&#039;&#039; exposing it to the internet so that setup cannot be hijacked)&lt;br /&gt;
* A 44Net Connect account &lt;br /&gt;
&lt;br /&gt;
== Step 1: Set up your tunnel == &lt;br /&gt;
Home Assistant OS is designed to operate less like a general purpose computing device and more like an appliance. There is no package manager with which to install higher level firewall tools, and the Home Assistant WireGuard application is unmaintained as of 2026. If you&#039;re setting up a fresh Home Assistant installation for the express purpose of exposing it to 44Net, the easiest option is running it as a docker container on a device with a [[44Net_Connect/Single Device Tunnel | single device tunnel]]. If you have a dedicated Home Assistant appliance, such as a Home Assistant Green or a Raspberry Pi running Home Assistant OS on {{Term|Bare metal}}, the recommended configuration is to put it on a [[44Net_Connect/Routed Subnet | routed subnet]].  &lt;br /&gt;
&lt;br /&gt;
For fresh installations using a single device tunnel, it&#039;s recommended to configure WireGuard as a {{Term|split tunnel}} by setting &amp;lt;code&amp;gt;AllowedIPs&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;44.0.0.0/9, 44.128.0.0/10&amp;lt;/code&amp;gt;. This puts &lt;br /&gt;
&lt;br /&gt;
== Step 2: Open port == &lt;br /&gt;
Now that your Home Assistant instance and 44Net Connect tunnel are set up, it&#039;s time to open the required port in your firewall to make Home Assistant publicly accessible. The default Home Assistant port is 8123, so unless you&#039;ve changed it, you&#039;ll need to open &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt; in your firewall. If you&#039;re running a single device tunnel with a Home Assistant VM or docker container, it&#039;s as simple as opening the device&#039;s firewall on &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt;. If you have a Home Assistant appliance inside a routed subnet, you&#039;ll need to open the port in the router&#039;s firewall, and ensure the firewall&#039;s rule set allows {{Term|WAN}} devices to initiate connections on that port.&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2826</id>
		<title>Home Assistant</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2826"/>
		<updated>2026-08-07T20:05:27Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Home Assistant is an open source home automation server. It has integrations for a wide variety of devices, and allows you to create custom dashboards for viewing sensor information and controlling your devices. If you want to access your Home Assistant instance from anywhere, {{Term|Bare}} but cannot port forward due to {{Term|CGNAT}}, making your instance publicly accessible via 44Net is one solution. Even if your home internet isn&#039;t behind CGNAT, it likely has a dynamic IP, which would require you to set up dynamic DNS for your instance to maintain consistent external access. A 44Net IP lets your instance be publicly accessible at a fixed IPv4 address for free. &lt;br /&gt;
&lt;br /&gt;
Prerequisites: &lt;br /&gt;
* A Home Assistant instance (set this up &#039;&#039;&#039;before&#039;&#039;&#039; exposing it to the internet so that setup cannot be hijacked)&lt;br /&gt;
* A 44Net Connect account &lt;br /&gt;
&lt;br /&gt;
== Step 1: Set up your tunnel == &lt;br /&gt;
Home Assistant OS is designed to operate less like a general purpose computing device and more like an appliance. There is no package manager with which to install higher level firewall tools, and the Home Assistant WireGuard application is unmaintained as of 2026. If you&#039;re setting up a fresh Home Assistant installation for the express purpose of exposing it to 44Net, the easiest option is running it as a docker container on a device with a [[44Net_Connect/Single Device Tunnel | single device tunnel]]. If you have a dedicated Home Assistant appliance, such as a Home Assistant Green or a Raspberry Pi running Home Assistant OS on {{Term|Bare metal}} , the recommended configuration is to put it on a [[44Net_Connect/Routed Subnet | routed subnet]].  &lt;br /&gt;
&lt;br /&gt;
For fresh installations using a single device tunnel, it&#039;s recommended to configure WireGuard as a {{Term|split tunnel}} by setting &amp;lt;code&amp;gt;AllowedIPs&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;44.0.0.0/9, 44.128.0.0/10&amp;lt;/code&amp;gt;. This puts &lt;br /&gt;
&lt;br /&gt;
== Step 2: Open port == &lt;br /&gt;
Now that your Home Assistant instance and 44Net Connect tunnel are set up, it&#039;s time to open the required port in your firewall to make Home Assistant publicly accessible. The default Home Assistant port is 8123, so unless you&#039;ve changed it, you&#039;ll need to open &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt; in your firewall. If you&#039;re running a single device tunnel with a Home Assistant VM or docker container, it&#039;s as simple as opening the device&#039;s firewall on &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt;. If you have a Home Assistant appliance inside a routed subnet, you&#039;ll need to open the port in the router&#039;s firewall, and ensure the firewall&#039;s rule set allows {{Term|WAN}} devices to initiate connections on that port.&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2825</id>
		<title>Home Assistant</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2825"/>
		<updated>2026-08-07T20:04:50Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Home Assistant is an open source home automation server. It has integrations for a wide variety of devices, and allows you to create custom dashboards for viewing sensor information and controlling your devices. If you want to access your Home Assistant instance from anywhere, but cannot port forward due to {{Term|CGNAT}}, making your instance publicly accessible via 44Net is one solution. Even if your home internet isn&#039;t behind CGNAT, it likely has a dynamic IP, which would require you to set up dynamic DNS for your instance to maintain consistent external access. A 44Net IP lets your instance be publicly accessible at a fixed IPv4 address for free. &lt;br /&gt;
&lt;br /&gt;
Prerequisites: &lt;br /&gt;
* A Home Assistant instance (set this up &#039;&#039;&#039;before&#039;&#039;&#039; exposing it to the internet so that setup cannot be hijacked)&lt;br /&gt;
* A 44Net Connect account &lt;br /&gt;
&lt;br /&gt;
== Step 1: Set up your tunnel == &lt;br /&gt;
Home Assistant OS is designed to operate less like a general purpose computing device and more like an appliance. There is no package manager with which to install higher level firewall tools, and the Home Assistant WireGuard application is unmaintained as of 2026. If you&#039;re setting up a fresh Home Assistant installation for the express purpose of exposing it to 44Net, the easiest option is running it as a docker container on a device with a [[44Net_Connect/Single Device Tunnel | single device tunnel]]. If you have a dedicated Home Assistant appliance, such as a Home Assistant Green or a Raspberry Pi running Home Assistant OS on {{Term|Bare metal}} , the recommended configuration is to put it on a [[44Net_Connect/Routed Subnet | routed subnet]]. {{Term|bare}}&lt;br /&gt;
&lt;br /&gt;
For fresh installations using a single device tunnel, it&#039;s recommended to configure WireGuard as a {{Term|split tunnel}} by setting &amp;lt;code&amp;gt;AllowedIPs&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;44.0.0.0/9, 44.128.0.0/10&amp;lt;/code&amp;gt;. This puts &lt;br /&gt;
&lt;br /&gt;
== Step 2: Open port == &lt;br /&gt;
Now that your Home Assistant instance and 44Net Connect tunnel are set up, it&#039;s time to open the required port in your firewall to make Home Assistant publicly accessible. The default Home Assistant port is 8123, so unless you&#039;ve changed it, you&#039;ll need to open &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt; in your firewall. If you&#039;re running a single device tunnel with a Home Assistant VM or docker container, it&#039;s as simple as opening the device&#039;s firewall on &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt;. If you have a Home Assistant appliance inside a routed subnet, you&#039;ll need to open the port in the router&#039;s firewall, and ensure the firewall&#039;s rule set allows {{Term|WAN}} devices to initiate connections on that port.&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2824</id>
		<title>Home Assistant</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2824"/>
		<updated>2026-08-07T20:03:27Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Home Assistant is an open source home automation server. It has integrations for a wide variety of devices, and allows you to create custom dashboards for viewing sensor information and controlling your devices. If you want to access your Home Assistant instance from anywhere, but cannot port forward due to {{Term|CGNAT}}, making your instance publicly accessible via 44Net is one solution. Even if your home internet isn&#039;t behind CGNAT, it likely has a dynamic IP, which would require you to set up dynamic DNS for your instance to maintain consistent external access. A 44Net IP lets your instance be publicly accessible at a fixed IPv4 address for free. &lt;br /&gt;
&lt;br /&gt;
Prerequisites: &lt;br /&gt;
* A Home Assistant instance (set this up &#039;&#039;&#039;before&#039;&#039;&#039; exposing it to the internet so that setup cannot be hijacked)&lt;br /&gt;
* A 44Net Connect account &lt;br /&gt;
&lt;br /&gt;
== Step 1: Set up your tunnel == &lt;br /&gt;
Home Assistant OS is designed to operate less like a general purpose computing device and more like an appliance. There is no package manager with which to install higher level firewall tools, and the Home Assistant WireGuard application is unmaintained as of 2026. If you&#039;re setting up a fresh Home Assistant installation for the express purpose of exposing it to 44Net, the easiest option is running it as a docker container on a device with a [[44Net_Connect/Single Device Tunnel | single device tunnel]]. If you have a dedicated Home Assistant appliance, such as a Home Assistant Green or a Raspberry Pi running Home Assistant OS on {{Term|Bare metal}} , the recommended configuration is to put it on a [[44Net_Connect/Routed Subnet | routed subnet]].&lt;br /&gt;
&lt;br /&gt;
For fresh installations using a single device tunnel, it&#039;s recommended to configure WireGuard as a {{Term|split tunnel}} by setting &amp;lt;code&amp;gt;AllowedIPs&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;44.0.0.0/9, 44.128.0.0/10&amp;lt;/code&amp;gt;. This puts &lt;br /&gt;
&lt;br /&gt;
== Step 2: Open port == &lt;br /&gt;
Now that your Home Assistant instance and 44Net Connect tunnel are set up, it&#039;s time to open the required port in your firewall to make Home Assistant publicly accessible. The default Home Assistant port is 8123, so unless you&#039;ve changed it, you&#039;ll need to open &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt; in your firewall. If you&#039;re running a single device tunnel with a Home Assistant VM or docker container, it&#039;s as simple as opening the device&#039;s firewall on &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt;. If you have a Home Assistant appliance inside a routed subnet, you&#039;ll need to open the port in the router&#039;s firewall, and ensure the firewall&#039;s rule set allows {{Term|WAN}} devices to initiate connections on that port.&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2823</id>
		<title>Home Assistant</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2823"/>
		<updated>2026-08-07T19:44:06Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: Undo revision 2822 by Airgapped (talk)&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Home Assistant is an open source home automation server. It has integrations for a wide variety of devices, and allows you to create custom dashboards for viewing sensor information and controlling your devices. If you want to access your Home Assistant instance from anywhere, but cannot port forward due to {{Term|CGNAT}}, making your instance publicly accessible via 44Net is one solution. Even if your home internet isn&#039;t behind CGNAT, it likely has a dynamic IP, which would require you to set up dynamic DNS for your instance to maintain consistent external access. A 44Net IP lets your instance be publicly accessible at a fixed IPv4 address for free. &lt;br /&gt;
&lt;br /&gt;
Prerequisites: &lt;br /&gt;
* A Home Assistant instance (set this up &#039;&#039;&#039;before&#039;&#039;&#039; exposing it to the internet so that setup cannot be hijacked)&lt;br /&gt;
* A 44Net Connect account &lt;br /&gt;
&lt;br /&gt;
== Step 1: Set up your tunnel == &lt;br /&gt;
Home Assistant OS is designed to operate less like a general purpose computing device and more like an appliance. There is no package manager with which to install higher level firewall tools, and the Home Assistant WireGuard application is unmaintained as of 2026. If you&#039;re setting up a fresh Home Assistant installation for the express purpose of exposing it to 44Net, the easiest option is running it as a docker container on a device with a [[44Net_Connect/Single Device Tunnel | single device tunnel]]. If you have a dedicated Home Assistant appliance, such as a Home Assistant Green or a Raspberry Pi running Home Assistant OS on {{Term|bare metal}} , the recommended configuration is to put it on a [[44Net_Connect/Routed Subnet | routed subnet]].&lt;br /&gt;
&lt;br /&gt;
For fresh installations using a single device tunnel, it&#039;s recommended to configure WireGuard as a {{Term|split tunnel}} by setting &amp;lt;code&amp;gt;AllowedIPs&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;44.0.0.0/9, 44.128.0.0/10&amp;lt;/code&amp;gt;. This puts &lt;br /&gt;
&lt;br /&gt;
== Step 2: Open port == &lt;br /&gt;
Now that your Home Assistant instance and 44Net Connect tunnel are set up, it&#039;s time to open the required port in your firewall to make Home Assistant publicly accessible. The default Home Assistant port is 8123, so unless you&#039;ve changed it, you&#039;ll need to open &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt; in your firewall. If you&#039;re running a single device tunnel with a Home Assistant VM or docker container, it&#039;s as simple as opening the device&#039;s firewall on &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt;. If you have a Home Assistant appliance inside a routed subnet, you&#039;ll need to open the port in the router&#039;s firewall, and ensure the firewall&#039;s rule set allows {{Term|WAN}} devices to initiate connections on that port.&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2822</id>
		<title>Home Assistant</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2822"/>
		<updated>2026-08-07T19:43:53Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Home Assistant is an open source home automation server. It has integrations for a wide variety of devices, and allows you to create custom dashboards for viewing sensor information and controlling your devices. If you want to access your Home Assistant instance from anywhere, but cannot port forward due to {{Term|CGNAT}}, making your instance publicly accessible via 44Net is one solution. Even if your home internet isn&#039;t behind CGNAT, it likely has a dynamic IP, which would require you to set up dynamic DNS for your instance to maintain consistent external access. A 44Net IP lets your instance be publicly accessible at a fixed IPv4 address for free. &lt;br /&gt;
&lt;br /&gt;
Prerequisites: &lt;br /&gt;
* A Home Assistant instance (set this up &#039;&#039;&#039;before&#039;&#039;&#039; exposing it to the internet so that setup cannot be hijacked)&lt;br /&gt;
* A 44Net Connect account &lt;br /&gt;
&lt;br /&gt;
== Step 1: Set up your tunnel == &lt;br /&gt;
Home Assistant OS is designed to operate less like a general purpose computing device and more like an appliance. There is no package manager with which to install higher level firewall tools, and the Home Assistant WireGuard application is unmaintained as of 2026. If you&#039;re setting up a fresh Home Assistant installation for the express purpose of exposing it to 44Net, the easiest option is running it as a docker container on a device with a [[44Net_Connect/Single Device Tunnel | single device tunnel]]. If you have a dedicated Home Assistant appliance, such as a Home Assistant Green or a Raspberry Pi running Home Assistant OS on {{Term|Bare metal}}, the recommended configuration is to put it on a [[44Net_Connect/Routed Subnet | routed subnet]].&lt;br /&gt;
&lt;br /&gt;
For fresh installations using a single device tunnel, it&#039;s recommended to configure WireGuard as a {{Term|split tunnel}} by setting &amp;lt;code&amp;gt;AllowedIPs&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;44.0.0.0/9, 44.128.0.0/10&amp;lt;/code&amp;gt;. This puts &lt;br /&gt;
&lt;br /&gt;
== Step 2: Open port == &lt;br /&gt;
Now that your Home Assistant instance and 44Net Connect tunnel are set up, it&#039;s time to open the required port in your firewall to make Home Assistant publicly accessible. The default Home Assistant port is 8123, so unless you&#039;ve changed it, you&#039;ll need to open &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt; in your firewall. If you&#039;re running a single device tunnel with a Home Assistant VM or docker container, it&#039;s as simple as opening the device&#039;s firewall on &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt;. If you have a Home Assistant appliance inside a routed subnet, you&#039;ll need to open the port in the router&#039;s firewall, and ensure the firewall&#039;s rule set allows {{Term|WAN}} devices to initiate connections on that port.&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2821</id>
		<title>Home Assistant</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Home_Assistant&amp;diff=2821"/>
		<updated>2026-08-07T19:10:02Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Home Assistant is an open source home automation server. It has integrations for a wide variety of devices, and allows you to create custom dashboards for viewing sensor information and controlling your devices. If you want to access your Home Assistant instance from anywhere, but cannot port forward due to {{Term|CGNAT}}, making your instance publicly accessible via 44Net is one solution. Even if your home internet isn&#039;t behind CGNAT, it likely has a dynamic IP, which would require you to set up dynamic DNS for your instance to maintain consistent external access. A 44Net IP lets your instance be publicly accessible at a fixed IPv4 address for free. &lt;br /&gt;
&lt;br /&gt;
Prerequisites: &lt;br /&gt;
* A Home Assistant instance (set this up &#039;&#039;&#039;before&#039;&#039;&#039; exposing it to the internet so that setup cannot be hijacked)&lt;br /&gt;
* A 44Net Connect account &lt;br /&gt;
&lt;br /&gt;
== Step 1: Set up your tunnel == &lt;br /&gt;
Home Assistant OS is designed to operate less like a general purpose computing device and more like an appliance. There is no package manager with which to install higher level firewall tools, and the Home Assistant WireGuard application is unmaintained as of 2026. If you&#039;re setting up a fresh Home Assistant installation for the express purpose of exposing it to 44Net, the easiest option is running it as a docker container on a device with a [[44Net_Connect/Single Device Tunnel | single device tunnel]]. If you have a dedicated Home Assistant appliance, such as a Home Assistant Green or a Raspberry Pi running Home Assistant OS on {{Term|bare metal}} , the recommended configuration is to put it on a [[44Net_Connect/Routed Subnet | routed subnet]].&lt;br /&gt;
&lt;br /&gt;
For fresh installations using a single device tunnel, it&#039;s recommended to configure WireGuard as a {{Term|split tunnel}} by setting &amp;lt;code&amp;gt;AllowedIPs&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;44.0.0.0/9, 44.128.0.0/10&amp;lt;/code&amp;gt;. This puts &lt;br /&gt;
&lt;br /&gt;
== Step 2: Open port == &lt;br /&gt;
Now that your Home Assistant instance and 44Net Connect tunnel are set up, it&#039;s time to open the required port in your firewall to make Home Assistant publicly accessible. The default Home Assistant port is 8123, so unless you&#039;ve changed it, you&#039;ll need to open &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt; in your firewall. If you&#039;re running a single device tunnel with a Home Assistant VM or docker container, it&#039;s as simple as opening the device&#039;s firewall on &amp;lt;code&amp;gt;8123/tcp&amp;lt;/code&amp;gt;. If you have a Home Assistant appliance inside a routed subnet, you&#039;ll need to open the port in the router&#039;s firewall, and ensure the firewall&#039;s rule set allows {{Term|WAN}} devices to initiate connections on that port.&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Template:Term&amp;diff=2808</id>
		<title>Template:Term</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Template:Term&amp;diff=2808"/>
		<updated>2026-07-31T19:02:49Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{#if:{{{1|}}}|{{#ifexist:Term:{{{1}}}|[[Term:{{{1}}}|{{#tag:span|{{#if:{{{2|}}}|{{{2}}}|{{{1}}}}}{{#tag:span|{{Term:{{{1}}}|mode=short}}|class=term__card mw-term__card|role=tooltip|style=display:none;}}|class=term mw-term}}]]|{{#if:{{{2|}}}|{{{2}}}|{{{1}}}}}}}}}&amp;lt;noinclude&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Editor usage:&lt;br /&gt;
&amp;lt;pre&amp;gt;{{term|BGP}}&amp;lt;/pre&amp;gt;&lt;br /&gt;
Optional display text:&lt;br /&gt;
&amp;lt;pre&amp;gt;{{term|Autonomous System|AS}}&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Behavior:&lt;br /&gt;
* If &amp;lt;code&amp;gt;Term:&amp;amp;lt;name&amp;amp;gt;&amp;lt;/code&amp;gt; exists, this renders a link with a hover card using the term&#039;s short definition.&lt;br /&gt;
* If it does not exist, this renders plain text (no red link).&lt;br /&gt;
&amp;lt;/noinclude&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2807</id>
		<title>Firewalling Basics</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2807"/>
		<updated>2026-07-31T19:01:31Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: /* Configuration Recommendations */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== 44Net Connect and Security == &lt;br /&gt;
44Net Connect provides every device with a public facing IPv4 address, and does not inspect, filter, or block any traffic directed towards 44Net devices. Devices with publicly routable IP addresses face a constant barrage of traffic from various scanners and bots on the internet. Some of them are malicious, and correctly configuring your firewall is a key part of defending against them. &lt;br /&gt;
&lt;br /&gt;
== What does a firewall do? ==&lt;br /&gt;
At its most basic, a firewall inspects incoming and outgoing packets, and based on its set of rules, decides whether each packet should be allowed through, dropped, or diverted. Rules may consider a packet&#039;s source and destination IP, source and destination interface, port, protocol (TCP vs UDP), or various special flags that may be set. Basic firewall usage is primarily concerned with source/destination IP, source/destination interface, and port. There are several goals we can achieve via firewall rules: allow outside connections to public-facing services, block outside connections to private services, and in case your device is compromised, block outgoing malicious traffic originating from your device. &lt;br /&gt;
&lt;br /&gt;
Outside connections to a public-facing service are typically allowed using a firewall rule that accepts all packets on the port that service is using, regardless of the packet&#039;s source IP. Private services, such as those only intended for your LAN, are typically protected by a firewall rule that only accepts packets whose source IP is inside your LAN. Packets sent to that port that originate externally will be dropped. You may have services that are only meant to be accessed from &amp;lt;code&amp;gt;localhost&amp;lt;/code&amp;gt;, such as control interfaces accessed only by other software on the same device. &lt;br /&gt;
&lt;br /&gt;
=== Stateful Firewalls ===&lt;br /&gt;
Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if the default policy would have otherwise dropped it. It&#039;s important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls, such as those based on &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;, are stateful. If for some reason this behavior is undesirable, it can be overridden with rules that explicitly drop the unwanted external traffic. &lt;br /&gt;
&lt;br /&gt;
Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers. &lt;br /&gt;
&lt;br /&gt;
Stateless firewalls are not capable of remembering previous packets, and handle each packet as if it&#039;s completely unrelated to all other packets.&lt;br /&gt;
&lt;br /&gt;
== Configuration Recommendations ==&lt;br /&gt;
When configuring any kind of security policy, best practice is to apply the &#039;&#039;&#039;principle of least privilege.&#039;&#039;&#039; This means that a person or device is given the minimum level of access to perform their job. This minimizes attack surface (the ways in which a malicious party can attack your network) and minimizes damage if a device or user&#039;s credentials are compromised. When it comes to configuring a firewall, that means only opening the ports on which you&#039;re actually running services, and only allowing communication between network segments if it&#039;s actually necessary. &lt;br /&gt;
&lt;br /&gt;
For example, some people confine Internet of Things (IoT) devices to their own {{term|VLAN}} due to their often poor security. In such a configuration, you might allow devices from the regular LAN to initiate connections to the IoT devices, but not the other way around, to prevent a compromised IoT device from attacking the rest of your network. Some take it a step further, and block {{term|WAN}} access from the IoT VLAN to prevent devices from sending telemetry to their manufacturer.&lt;br /&gt;
&lt;br /&gt;
When restricting access between devices on your internal network, it can be helpful to use a policy that explicitly rejects disallowed packets rather than silently dropping them. This feedback can be helpful when troubleshooting, as it immediately lets you know that packets are being blocked by firewall policy rather than something like a port mismatch or a hostname/IP typo. Reject policies should only be used for relatively trusted network segments, otherwise you may spend lots of compute power sending packet rejections to automated scanners and other malicious actors on the wider internet.&lt;br /&gt;
&lt;br /&gt;
== Low Level Tools ==&lt;br /&gt;
=== iptables ===&lt;br /&gt;
&amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; is a Linux firewall rule management tool that was deprecated in favor of &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; in 2014. It allows system administrators to define &#039;&#039;tables&#039;&#039; containing &#039;&#039;chains&#039;&#039; of &#039;&#039;rules&#039;&#039; for the treatment of packets.&amp;lt;ref&amp;gt;https://en.wikipedia.org/wiki/Iptables&amp;lt;/ref&amp;gt; Both &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; use the netfilter framework to interface with the Linux kernel. &lt;br /&gt;
&lt;br /&gt;
Modern systems no longer ship with an actual copy of &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, instead using a compatibility layer that translates its rules to &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== nftables ===&lt;br /&gt;
nftables is the currently maintained Linux firewall rule management tool. It interfaces with the Linux kernel via the netfilter framework, and can be administrated with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; command line tool as well as editing &amp;lt;code&amp;gt;/etc/nftables.conf&amp;lt;/code&amp;gt;. Changes made with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; tool will not persist between reboots, and must be written into the config file to ensure persistence. It functions similarly to &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, employing tables of chains of rules, but with no predefined chains and more flexible rules.&lt;br /&gt;
&lt;br /&gt;
[[ File:Netfilter.png | 500px | A diagram illustrating the table, chain, and rule hierarchy used by iptables and nftables. A packet proceeds into the table, through the first chain, and does not match any rules. It proceeds through the second chain, matches the second rule, and makes a routing decision. ]]&lt;br /&gt;
&lt;br /&gt;
While firewall rules can be directly configured with &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt;, this is not recommended. The output of &amp;lt;code&amp;gt;sudo nft list ruleset&amp;lt;/code&amp;gt; is extremely verbose and not well formatted. &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; provides few formatting options for this output. See the next section for user-friendly tools that interface with nftables.&lt;br /&gt;
&lt;br /&gt;
== High Level Tools ==&lt;br /&gt;
=== firewalld ===&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; is an &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;-based CLI firewall management tool. It ships by default on CentOS, Fedora, OpenSUSE, RHEL, SUSE Enterprise, and EndeavourOS, and is packaged for many more distributions. It introduces the idea of a &amp;quot;zone,&amp;quot; which is a named set of policies that an interface can be assigned to. Each zone has a target, which is set to &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt;, or &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt;. These targets determine what action will be taken on packets in the zone that don&#039;t match any of the rules, services, or ports. &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; will accept ICMP and drop everything else, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; will discard packets without notifying the sender, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow the packet through, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will discard the packet and notify the sender of its rejection. Check your current zone configuration by running &amp;lt;code&amp;gt;sudo firewalld --list-all-zones&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
It&#039;s best to put public-facing interfaces into a &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; target zone. &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow unwanted or malicious traffic, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will spend lots of bandwidth replying to the barrage of traffic from bots scanning the internet.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; can be controlled using the &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; utility, or by editing the config file at &amp;lt;code&amp;gt;/etc/firewalld&amp;lt;/code&amp;gt;. Typical policy changes introduced using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; are called &amp;quot;runtime&amp;quot; changes, and will not persist after a restart of the service or a reboot. Permanent changes can be made by adding the &amp;lt;code&amp;gt;--permanent&amp;lt;/code&amp;gt; flag, or by introducing runtime changes and then invoking &amp;lt;code&amp;gt;firewall-cmd --runtime-to-permanent&amp;lt;/code&amp;gt;, which saves all current runtime changes to permanent configuration.&lt;br /&gt;
&lt;br /&gt;
Services are a &amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; abstraction containing a list of ports, protocols, destinations, and optionally a list of firewall helper modules to be loaded if the service is enabled. They make it easy to toggle these configuration groups, rather than having to toggle every rule in them individually. They can be configured using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; or by creating an XML file in &amp;lt;code&amp;gt;/etc/firewalld/services/&amp;lt;/code&amp;gt;. See &amp;lt;code&amp;gt;man firewalld.service&amp;lt;/code&amp;gt; for more information on services. As an example, the following command would enable the &amp;lt;code&amp;gt;ssh&amp;lt;/code&amp;gt; service in the &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt; zone. &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo firewall-cmd --permanent --zone public --add-service ssh&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Another advantage of using services is that the service definition can be edited, and then it will apply to all zones with that service enabled when firewalld is reloaded. firewalld can be reloaded using &amp;lt;code&amp;gt;sudo firewall-cmd --reload&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== ufw ===&lt;br /&gt;
Uncomplicated Firewall is a CLI program designed for easily managing a netfilter firewall. It also supports GUI management via the &amp;lt;code&amp;gt;gufw&amp;lt;/code&amp;gt; tool. When running, the active firewall rules can be viewed with &amp;lt;code&amp;gt;sudo ufw status&amp;lt;/code&amp;gt;. If you want to see the firewall rules while &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; is not running, use &amp;lt;code&amp;gt;sudo ufw show added&amp;lt;/code&amp;gt;. It uses a simple syntax with property names rather than flags. For the very simple operation of opening a port without utilizing any optional parameters, you need not even specify property names. One can allow TCP connections on port 22 (for example, to allow an SSH server) and start UFW as follows:&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo ufw allow 22/tcp&lt;br /&gt;
sudo ufw enable&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It also allows comments by specifying the &amp;lt;code&amp;gt;comment&amp;lt;/code&amp;gt; property and enclosing the actual comment in quotes. For example, &lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;sudo ufw allow 22/tcp comment &#039;SSH port&#039;&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
will show in the &amp;lt;code&amp;gt;ufw status&amp;lt;/code&amp;gt; output as &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;&lt;br /&gt;
To                         Action      From&lt;br /&gt;
--                         ------      ----&lt;br /&gt;
22/tcp                     ALLOW       Anywhere                 # SSH port&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
By default, Docker writes its own &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; rules and ignores &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; rules. This can cause conflicts and security issues in combination with &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt;.&amp;lt;ref&amp;gt;“Uncomplicated Firewall - ArchWiki.” 2024. Archlinux.Org. https://wiki.archlinux.org/title/Uncomplicated_Firewall.&amp;lt;/ref&amp;gt;&lt;br /&gt;
If you wish to use &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; on a system that has Docker, consider [https://docs.docker.com/engine/network/firewall-nftables#migrating-from-iptables-to-nftables migrating Docker to nftables.]&lt;br /&gt;
&lt;br /&gt;
== Verifying Configuration ==&lt;br /&gt;
After configuring your firewall, it&#039;s important to test the configuration to ensure that it&#039;s working how you think it is. This can be done with the help of a few command line tools. &lt;br /&gt;
&lt;br /&gt;
=== Verify that a port is open or closed === &lt;br /&gt;
To test whether a port is properly opened or closed, you can use set up a &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener a device behind the firewall, and use &amp;lt;code&amp;gt;curl&amp;lt;/code&amp;gt; to connect to it with a device outside the firewall. On the inside device, run &amp;lt;code&amp;gt;nc -l -p &amp;lt;port&amp;gt;&amp;lt;/code&amp;gt; (but replace &amp;lt;code&amp;gt;port&amp;lt;/code&amp;gt; with your desired port) to start the listener. If you have a service that normally runs on this port, you&#039;ll need to temporarily stop it so that &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; can bind to the port. On the outside device, run &amp;lt;code&amp;gt;curl &amp;lt;hostname&amp;gt;:&amp;lt;port&amp;gt;&amp;lt;/code&amp;gt;, and if the port is open, you&#039;ll see some text pop up on the &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener indicating that it received an HTTP GET request. &lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
=== Traffic is supposed to pass but only works intermittently ===&lt;br /&gt;
This can happen when you have duplicate or conflicting firewall rules. This can happen if you add runtime rules that are already part of persistent configuration, or add the same rules to multiple scripts or configuration files. Re-read your firewall rules and ensure there are no duplicates or conflicting rules. It may help to restore the last known working configuration, and start from there.&lt;br /&gt;
&lt;br /&gt;
=== Traffic is supposed to pass but is not going through ===&lt;br /&gt;
Common causes:&lt;br /&gt;
* The firewall was not reloaded after changing configuration files&lt;br /&gt;
* The device has its own firewall &#039;&#039;and&#039;&#039; is behind the router firewall, and one of them is missing allow rules. &lt;br /&gt;
* Traffic has not been allowed on the correct protocol (TCP instead of UDP, or vice versa) &lt;br /&gt;
&lt;br /&gt;
== References ==&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Template:Term&amp;diff=2806</id>
		<title>Template:Term</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Template:Term&amp;diff=2806"/>
		<updated>2026-07-31T19:01:05Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{#if:{{{1|}}}|{{#ifexist:Term:{{{1}}}|[[Term:{{{1}}}|{{#tag:span|{{#if:{{{2|}}}|{{{2}}}|{{{1}}}}}{{#tag:span|{{Term:{{{1}}}|mode=short}}|class=term__card mw-term__card|role=tooltip|style=display:none;}}|class=term mw-term}}]]|{{#if:{{{2|}}}|{{{2}}}|{{{1}}}}}}}}}&amp;lt;noinclude&amp;gt;&lt;br /&gt;
&amp;lt;!-- &lt;br /&gt;
OLD VERSION FOR TESTING:&lt;br /&gt;
{{#if:{{{1|}}}&lt;br /&gt;
 | {{#ifexist:Term:{{{1}}}&lt;br /&gt;
&lt;br /&gt;
    | [[Term:{{{1}}}|{{#tag:span|{{#if:{{{2|}}}|{{{2}}}|{{{1}}}}}{{#tag:span|{{Term:{{{1}}}|mode=short}}|class=term__card mw-term__card|role=tooltip|style=display:none;}}|class=term mw-term}}]]&lt;br /&gt;
    | {{#if:{{{2|}}}|{{{2}}}|{{{1}}}}}&lt;br /&gt;
   }}&lt;br /&gt;
 | &lt;br /&gt;
}}&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Editor usage:&lt;br /&gt;
&amp;lt;pre&amp;gt;{{term|BGP}}&amp;lt;/pre&amp;gt;&lt;br /&gt;
Optional display text:&lt;br /&gt;
&amp;lt;pre&amp;gt;{{term|Autonomous System|AS}}&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Behavior:&lt;br /&gt;
* If &amp;lt;code&amp;gt;Term:&amp;amp;lt;name&amp;amp;gt;&amp;lt;/code&amp;gt; exists, this renders a link with a hover card using the term&#039;s short definition.&lt;br /&gt;
* If it does not exist, this renders plain text (no red link).&lt;br /&gt;
&amp;lt;/noinclude&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2805</id>
		<title>Firewalling Basics</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2805"/>
		<updated>2026-07-31T18:52:31Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: /* Configuration Recommendations */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== 44Net Connect and Security == &lt;br /&gt;
44Net Connect provides every device with a public facing IPv4 address, and does not inspect, filter, or block any traffic directed towards 44Net devices. Devices with publicly routable IP addresses face a constant barrage of traffic from various scanners and bots on the internet. Some of them are malicious, and correctly configuring your firewall is a key part of defending against them. &lt;br /&gt;
&lt;br /&gt;
== What does a firewall do? ==&lt;br /&gt;
At its most basic, a firewall inspects incoming and outgoing packets, and based on its set of rules, decides whether each packet should be allowed through, dropped, or diverted. Rules may consider a packet&#039;s source and destination IP, source and destination interface, port, protocol (TCP vs UDP), or various special flags that may be set. Basic firewall usage is primarily concerned with source/destination IP, source/destination interface, and port. There are several goals we can achieve via firewall rules: allow outside connections to public-facing services, block outside connections to private services, and in case your device is compromised, block outgoing malicious traffic originating from your device. &lt;br /&gt;
&lt;br /&gt;
Outside connections to a public-facing service are typically allowed using a firewall rule that accepts all packets on the port that service is using, regardless of the packet&#039;s source IP. Private services, such as those only intended for your LAN, are typically protected by a firewall rule that only accepts packets whose source IP is inside your LAN. Packets sent to that port that originate externally will be dropped. You may have services that are only meant to be accessed from &amp;lt;code&amp;gt;localhost&amp;lt;/code&amp;gt;, such as control interfaces accessed only by other software on the same device. &lt;br /&gt;
&lt;br /&gt;
=== Stateful Firewalls ===&lt;br /&gt;
Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if the default policy would have otherwise dropped it. It&#039;s important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls, such as those based on &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;, are stateful. If for some reason this behavior is undesirable, it can be overridden with rules that explicitly drop the unwanted external traffic. &lt;br /&gt;
&lt;br /&gt;
Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers. &lt;br /&gt;
&lt;br /&gt;
Stateless firewalls are not capable of remembering previous packets, and handle each packet as if it&#039;s completely unrelated to all other packets.&lt;br /&gt;
&lt;br /&gt;
== Configuration Recommendations ==&lt;br /&gt;
When configuring any kind of security policy, best practice is to apply the &#039;&#039;&#039;principle of least privilege.&#039;&#039;&#039; This means that a person or device is given the minimum level of access to perform their job. This minimizes attack surface (the ways in which a malicious party can attack your network) and minimizes damage if a device or user&#039;s credentials are compromised. When it comes to configuring a firewall, that means only opening the ports on which you&#039;re actually running services, and only allowing communication between network segments if it&#039;s actually necessary. &lt;br /&gt;
&lt;br /&gt;
For example, some people confine Internet of Things (IoT) devices to their own {{term|VLAN}}due to their often poor security. In such a configuration, you might allow devices from the regular LAN to initiate connections to the IoT devices, but not the other way around, to prevent a compromised IoT device from attacking the rest of your network. Some take it a step further, and block {{term|WAN}}access from the IoT VLAN to prevent devices from sending telemetry to their manufacturer.&lt;br /&gt;
&lt;br /&gt;
When restricting access between devices on your internal network, it can be helpful to use a policy that explicitly rejects disallowed packets rather than silently dropping them. This feedback can be helpful when troubleshooting, as it immediately lets you know that packets are being blocked by firewall policy rather than something like a port mismatch or a hostname/IP typo. Reject policies should only be used for relatively trusted network segments, otherwise you may spend lots of compute power sending packet rejections to automated scanners and other malicious actors on the wider internet.&lt;br /&gt;
&lt;br /&gt;
== Low Level Tools ==&lt;br /&gt;
=== iptables ===&lt;br /&gt;
&amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; is a Linux firewall rule management tool that was deprecated in favor of &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; in 2014. It allows system administrators to define &#039;&#039;tables&#039;&#039; containing &#039;&#039;chains&#039;&#039; of &#039;&#039;rules&#039;&#039; for the treatment of packets.&amp;lt;ref&amp;gt;https://en.wikipedia.org/wiki/Iptables&amp;lt;/ref&amp;gt; Both &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; use the netfilter framework to interface with the Linux kernel. &lt;br /&gt;
&lt;br /&gt;
Modern systems no longer ship with an actual copy of &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, instead using a compatibility layer that translates its rules to &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== nftables ===&lt;br /&gt;
nftables is the currently maintained Linux firewall rule management tool. It interfaces with the Linux kernel via the netfilter framework, and can be administrated with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; command line tool as well as editing &amp;lt;code&amp;gt;/etc/nftables.conf&amp;lt;/code&amp;gt;. Changes made with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; tool will not persist between reboots, and must be written into the config file to ensure persistence. It functions similarly to &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, employing tables of chains of rules, but with no predefined chains and more flexible rules.&lt;br /&gt;
&lt;br /&gt;
[[ File:Netfilter.png | 500px | A diagram illustrating the table, chain, and rule hierarchy used by iptables and nftables. A packet proceeds into the table, through the first chain, and does not match any rules. It proceeds through the second chain, matches the second rule, and makes a routing decision. ]]&lt;br /&gt;
&lt;br /&gt;
While firewall rules can be directly configured with &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt;, this is not recommended. The output of &amp;lt;code&amp;gt;sudo nft list ruleset&amp;lt;/code&amp;gt; is extremely verbose and not well formatted. &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; provides few formatting options for this output. See the next section for user-friendly tools that interface with nftables.&lt;br /&gt;
&lt;br /&gt;
== High Level Tools ==&lt;br /&gt;
=== firewalld ===&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; is an &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;-based CLI firewall management tool. It ships by default on CentOS, Fedora, OpenSUSE, RHEL, SUSE Enterprise, and EndeavourOS, and is packaged for many more distributions. It introduces the idea of a &amp;quot;zone,&amp;quot; which is a named set of policies that an interface can be assigned to. Each zone has a target, which is set to &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt;, or &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt;. These targets determine what action will be taken on packets in the zone that don&#039;t match any of the rules, services, or ports. &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; will accept ICMP and drop everything else, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; will discard packets without notifying the sender, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow the packet through, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will discard the packet and notify the sender of its rejection. Check your current zone configuration by running &amp;lt;code&amp;gt;sudo firewalld --list-all-zones&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
It&#039;s best to put public-facing interfaces into a &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; target zone. &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow unwanted or malicious traffic, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will spend lots of bandwidth replying to the barrage of traffic from bots scanning the internet.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; can be controlled using the &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; utility, or by editing the config file at &amp;lt;code&amp;gt;/etc/firewalld&amp;lt;/code&amp;gt;. Typical policy changes introduced using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; are called &amp;quot;runtime&amp;quot; changes, and will not persist after a restart of the service or a reboot. Permanent changes can be made by adding the &amp;lt;code&amp;gt;--permanent&amp;lt;/code&amp;gt; flag, or by introducing runtime changes and then invoking &amp;lt;code&amp;gt;firewall-cmd --runtime-to-permanent&amp;lt;/code&amp;gt;, which saves all current runtime changes to permanent configuration.&lt;br /&gt;
&lt;br /&gt;
Services are a &amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; abstraction containing a list of ports, protocols, destinations, and optionally a list of firewall helper modules to be loaded if the service is enabled. They make it easy to toggle these configuration groups, rather than having to toggle every rule in them individually. They can be configured using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; or by creating an XML file in &amp;lt;code&amp;gt;/etc/firewalld/services/&amp;lt;/code&amp;gt;. See &amp;lt;code&amp;gt;man firewalld.service&amp;lt;/code&amp;gt; for more information on services. As an example, the following command would enable the &amp;lt;code&amp;gt;ssh&amp;lt;/code&amp;gt; service in the &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt; zone. &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo firewall-cmd --permanent --zone public --add-service ssh&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Another advantage of using services is that the service definition can be edited, and then it will apply to all zones with that service enabled when firewalld is reloaded. firewalld can be reloaded using &amp;lt;code&amp;gt;sudo firewall-cmd --reload&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== ufw ===&lt;br /&gt;
Uncomplicated Firewall is a CLI program designed for easily managing a netfilter firewall. It also supports GUI management via the &amp;lt;code&amp;gt;gufw&amp;lt;/code&amp;gt; tool. When running, the active firewall rules can be viewed with &amp;lt;code&amp;gt;sudo ufw status&amp;lt;/code&amp;gt;. If you want to see the firewall rules while &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; is not running, use &amp;lt;code&amp;gt;sudo ufw show added&amp;lt;/code&amp;gt;. It uses a simple syntax with property names rather than flags. For the very simple operation of opening a port without utilizing any optional parameters, you need not even specify property names. One can allow TCP connections on port 22 (for example, to allow an SSH server) and start UFW as follows:&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo ufw allow 22/tcp&lt;br /&gt;
sudo ufw enable&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It also allows comments by specifying the &amp;lt;code&amp;gt;comment&amp;lt;/code&amp;gt; property and enclosing the actual comment in quotes. For example, &lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;sudo ufw allow 22/tcp comment &#039;SSH port&#039;&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
will show in the &amp;lt;code&amp;gt;ufw status&amp;lt;/code&amp;gt; output as &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;&lt;br /&gt;
To                         Action      From&lt;br /&gt;
--                         ------      ----&lt;br /&gt;
22/tcp                     ALLOW       Anywhere                 # SSH port&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
By default, Docker writes its own &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; rules and ignores &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; rules. This can cause conflicts and security issues in combination with &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt;.&amp;lt;ref&amp;gt;“Uncomplicated Firewall - ArchWiki.” 2024. Archlinux.Org. https://wiki.archlinux.org/title/Uncomplicated_Firewall.&amp;lt;/ref&amp;gt;&lt;br /&gt;
If you wish to use &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; on a system that has Docker, consider [https://docs.docker.com/engine/network/firewall-nftables#migrating-from-iptables-to-nftables migrating Docker to nftables.]&lt;br /&gt;
&lt;br /&gt;
== Verifying Configuration ==&lt;br /&gt;
After configuring your firewall, it&#039;s important to test the configuration to ensure that it&#039;s working how you think it is. This can be done with the help of a few command line tools. &lt;br /&gt;
&lt;br /&gt;
=== Verify that a port is open or closed === &lt;br /&gt;
To test whether a port is properly opened or closed, you can use set up a &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener a device behind the firewall, and use &amp;lt;code&amp;gt;curl&amp;lt;/code&amp;gt; to connect to it with a device outside the firewall. On the inside device, run &amp;lt;code&amp;gt;nc -l -p &amp;lt;port&amp;gt;&amp;lt;/code&amp;gt; (but replace &amp;lt;code&amp;gt;port&amp;lt;/code&amp;gt; with your desired port) to start the listener. If you have a service that normally runs on this port, you&#039;ll need to temporarily stop it so that &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; can bind to the port. On the outside device, run &amp;lt;code&amp;gt;curl &amp;lt;hostname&amp;gt;:&amp;lt;port&amp;gt;&amp;lt;/code&amp;gt;, and if the port is open, you&#039;ll see some text pop up on the &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener indicating that it received an HTTP GET request. &lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
=== Traffic is supposed to pass but only works intermittently ===&lt;br /&gt;
This can happen when you have duplicate or conflicting firewall rules. This can happen if you add runtime rules that are already part of persistent configuration, or add the same rules to multiple scripts or configuration files. Re-read your firewall rules and ensure there are no duplicates or conflicting rules. It may help to restore the last known working configuration, and start from there.&lt;br /&gt;
&lt;br /&gt;
=== Traffic is supposed to pass but is not going through ===&lt;br /&gt;
Common causes:&lt;br /&gt;
* The firewall was not reloaded after changing configuration files&lt;br /&gt;
* The device has its own firewall &#039;&#039;and&#039;&#039; is behind the router firewall, and one of them is missing allow rules. &lt;br /&gt;
* Traffic has not been allowed on the correct protocol (TCP instead of UDP, or vice versa) &lt;br /&gt;
&lt;br /&gt;
== References ==&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2804</id>
		<title>Firewalling Basics</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2804"/>
		<updated>2026-07-31T18:52:16Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: /* Configuration Recommendations */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== 44Net Connect and Security == &lt;br /&gt;
44Net Connect provides every device with a public facing IPv4 address, and does not inspect, filter, or block any traffic directed towards 44Net devices. Devices with publicly routable IP addresses face a constant barrage of traffic from various scanners and bots on the internet. Some of them are malicious, and correctly configuring your firewall is a key part of defending against them. &lt;br /&gt;
&lt;br /&gt;
== What does a firewall do? ==&lt;br /&gt;
At its most basic, a firewall inspects incoming and outgoing packets, and based on its set of rules, decides whether each packet should be allowed through, dropped, or diverted. Rules may consider a packet&#039;s source and destination IP, source and destination interface, port, protocol (TCP vs UDP), or various special flags that may be set. Basic firewall usage is primarily concerned with source/destination IP, source/destination interface, and port. There are several goals we can achieve via firewall rules: allow outside connections to public-facing services, block outside connections to private services, and in case your device is compromised, block outgoing malicious traffic originating from your device. &lt;br /&gt;
&lt;br /&gt;
Outside connections to a public-facing service are typically allowed using a firewall rule that accepts all packets on the port that service is using, regardless of the packet&#039;s source IP. Private services, such as those only intended for your LAN, are typically protected by a firewall rule that only accepts packets whose source IP is inside your LAN. Packets sent to that port that originate externally will be dropped. You may have services that are only meant to be accessed from &amp;lt;code&amp;gt;localhost&amp;lt;/code&amp;gt;, such as control interfaces accessed only by other software on the same device. &lt;br /&gt;
&lt;br /&gt;
=== Stateful Firewalls ===&lt;br /&gt;
Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if the default policy would have otherwise dropped it. It&#039;s important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls, such as those based on &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;, are stateful. If for some reason this behavior is undesirable, it can be overridden with rules that explicitly drop the unwanted external traffic. &lt;br /&gt;
&lt;br /&gt;
Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers. &lt;br /&gt;
&lt;br /&gt;
Stateless firewalls are not capable of remembering previous packets, and handle each packet as if it&#039;s completely unrelated to all other packets.&lt;br /&gt;
&lt;br /&gt;
== Configuration Recommendations ==&lt;br /&gt;
When configuring any kind of security policy, best practice is to apply the &#039;&#039;&#039;principle of least privilege.&#039;&#039;&#039; This means that a person or device is given the minimum level of access to perform their job. This minimizes attack surface (the ways in which a malicious party can attack your network) and minimizes damage if a device or user&#039;s credentials are compromised. When it comes to configuring a firewall, that means only opening the ports on which you&#039;re actually running services, and only allowing communication between network segments if it&#039;s actually necessary. &lt;br /&gt;
&lt;br /&gt;
For example, some people confine Internet of Things (IoT) devices to their own {{term|VLAN}}due to their often poor security. In such a configuration, you might allow devices from the regular LAN to initiate connections to the IoT devices, but not the other way around, to prevent a compromised IoT device from attacking the rest of your network. Some take it a step further, and block {{term|WAN}} access from the IoT VLAN to prevent devices from sending telemetry to their manufacturer.&lt;br /&gt;
&lt;br /&gt;
When restricting access between devices on your internal network, it can be helpful to use a policy that explicitly rejects disallowed packets rather than silently dropping them. This feedback can be helpful when troubleshooting, as it immediately lets you know that packets are being blocked by firewall policy rather than something like a port mismatch or a hostname/IP typo. Reject policies should only be used for relatively trusted network segments, otherwise you may spend lots of compute power sending packet rejections to automated scanners and other malicious actors on the wider internet.&lt;br /&gt;
&lt;br /&gt;
== Low Level Tools ==&lt;br /&gt;
=== iptables ===&lt;br /&gt;
&amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; is a Linux firewall rule management tool that was deprecated in favor of &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; in 2014. It allows system administrators to define &#039;&#039;tables&#039;&#039; containing &#039;&#039;chains&#039;&#039; of &#039;&#039;rules&#039;&#039; for the treatment of packets.&amp;lt;ref&amp;gt;https://en.wikipedia.org/wiki/Iptables&amp;lt;/ref&amp;gt; Both &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; use the netfilter framework to interface with the Linux kernel. &lt;br /&gt;
&lt;br /&gt;
Modern systems no longer ship with an actual copy of &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, instead using a compatibility layer that translates its rules to &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== nftables ===&lt;br /&gt;
nftables is the currently maintained Linux firewall rule management tool. It interfaces with the Linux kernel via the netfilter framework, and can be administrated with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; command line tool as well as editing &amp;lt;code&amp;gt;/etc/nftables.conf&amp;lt;/code&amp;gt;. Changes made with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; tool will not persist between reboots, and must be written into the config file to ensure persistence. It functions similarly to &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, employing tables of chains of rules, but with no predefined chains and more flexible rules.&lt;br /&gt;
&lt;br /&gt;
[[ File:Netfilter.png | 500px | A diagram illustrating the table, chain, and rule hierarchy used by iptables and nftables. A packet proceeds into the table, through the first chain, and does not match any rules. It proceeds through the second chain, matches the second rule, and makes a routing decision. ]]&lt;br /&gt;
&lt;br /&gt;
While firewall rules can be directly configured with &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt;, this is not recommended. The output of &amp;lt;code&amp;gt;sudo nft list ruleset&amp;lt;/code&amp;gt; is extremely verbose and not well formatted. &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; provides few formatting options for this output. See the next section for user-friendly tools that interface with nftables.&lt;br /&gt;
&lt;br /&gt;
== High Level Tools ==&lt;br /&gt;
=== firewalld ===&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; is an &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;-based CLI firewall management tool. It ships by default on CentOS, Fedora, OpenSUSE, RHEL, SUSE Enterprise, and EndeavourOS, and is packaged for many more distributions. It introduces the idea of a &amp;quot;zone,&amp;quot; which is a named set of policies that an interface can be assigned to. Each zone has a target, which is set to &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt;, or &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt;. These targets determine what action will be taken on packets in the zone that don&#039;t match any of the rules, services, or ports. &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; will accept ICMP and drop everything else, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; will discard packets without notifying the sender, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow the packet through, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will discard the packet and notify the sender of its rejection. Check your current zone configuration by running &amp;lt;code&amp;gt;sudo firewalld --list-all-zones&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
It&#039;s best to put public-facing interfaces into a &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; target zone. &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow unwanted or malicious traffic, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will spend lots of bandwidth replying to the barrage of traffic from bots scanning the internet.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; can be controlled using the &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; utility, or by editing the config file at &amp;lt;code&amp;gt;/etc/firewalld&amp;lt;/code&amp;gt;. Typical policy changes introduced using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; are called &amp;quot;runtime&amp;quot; changes, and will not persist after a restart of the service or a reboot. Permanent changes can be made by adding the &amp;lt;code&amp;gt;--permanent&amp;lt;/code&amp;gt; flag, or by introducing runtime changes and then invoking &amp;lt;code&amp;gt;firewall-cmd --runtime-to-permanent&amp;lt;/code&amp;gt;, which saves all current runtime changes to permanent configuration.&lt;br /&gt;
&lt;br /&gt;
Services are a &amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; abstraction containing a list of ports, protocols, destinations, and optionally a list of firewall helper modules to be loaded if the service is enabled. They make it easy to toggle these configuration groups, rather than having to toggle every rule in them individually. They can be configured using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; or by creating an XML file in &amp;lt;code&amp;gt;/etc/firewalld/services/&amp;lt;/code&amp;gt;. See &amp;lt;code&amp;gt;man firewalld.service&amp;lt;/code&amp;gt; for more information on services. As an example, the following command would enable the &amp;lt;code&amp;gt;ssh&amp;lt;/code&amp;gt; service in the &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt; zone. &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo firewall-cmd --permanent --zone public --add-service ssh&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Another advantage of using services is that the service definition can be edited, and then it will apply to all zones with that service enabled when firewalld is reloaded. firewalld can be reloaded using &amp;lt;code&amp;gt;sudo firewall-cmd --reload&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== ufw ===&lt;br /&gt;
Uncomplicated Firewall is a CLI program designed for easily managing a netfilter firewall. It also supports GUI management via the &amp;lt;code&amp;gt;gufw&amp;lt;/code&amp;gt; tool. When running, the active firewall rules can be viewed with &amp;lt;code&amp;gt;sudo ufw status&amp;lt;/code&amp;gt;. If you want to see the firewall rules while &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; is not running, use &amp;lt;code&amp;gt;sudo ufw show added&amp;lt;/code&amp;gt;. It uses a simple syntax with property names rather than flags. For the very simple operation of opening a port without utilizing any optional parameters, you need not even specify property names. One can allow TCP connections on port 22 (for example, to allow an SSH server) and start UFW as follows:&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo ufw allow 22/tcp&lt;br /&gt;
sudo ufw enable&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It also allows comments by specifying the &amp;lt;code&amp;gt;comment&amp;lt;/code&amp;gt; property and enclosing the actual comment in quotes. For example, &lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;sudo ufw allow 22/tcp comment &#039;SSH port&#039;&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
will show in the &amp;lt;code&amp;gt;ufw status&amp;lt;/code&amp;gt; output as &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;&lt;br /&gt;
To                         Action      From&lt;br /&gt;
--                         ------      ----&lt;br /&gt;
22/tcp                     ALLOW       Anywhere                 # SSH port&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
By default, Docker writes its own &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; rules and ignores &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; rules. This can cause conflicts and security issues in combination with &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt;.&amp;lt;ref&amp;gt;“Uncomplicated Firewall - ArchWiki.” 2024. Archlinux.Org. https://wiki.archlinux.org/title/Uncomplicated_Firewall.&amp;lt;/ref&amp;gt;&lt;br /&gt;
If you wish to use &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; on a system that has Docker, consider [https://docs.docker.com/engine/network/firewall-nftables#migrating-from-iptables-to-nftables migrating Docker to nftables.]&lt;br /&gt;
&lt;br /&gt;
== Verifying Configuration ==&lt;br /&gt;
After configuring your firewall, it&#039;s important to test the configuration to ensure that it&#039;s working how you think it is. This can be done with the help of a few command line tools. &lt;br /&gt;
&lt;br /&gt;
=== Verify that a port is open or closed === &lt;br /&gt;
To test whether a port is properly opened or closed, you can use set up a &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener a device behind the firewall, and use &amp;lt;code&amp;gt;curl&amp;lt;/code&amp;gt; to connect to it with a device outside the firewall. On the inside device, run &amp;lt;code&amp;gt;nc -l -p &amp;lt;port&amp;gt;&amp;lt;/code&amp;gt; (but replace &amp;lt;code&amp;gt;port&amp;lt;/code&amp;gt; with your desired port) to start the listener. If you have a service that normally runs on this port, you&#039;ll need to temporarily stop it so that &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; can bind to the port. On the outside device, run &amp;lt;code&amp;gt;curl &amp;lt;hostname&amp;gt;:&amp;lt;port&amp;gt;&amp;lt;/code&amp;gt;, and if the port is open, you&#039;ll see some text pop up on the &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener indicating that it received an HTTP GET request. &lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
=== Traffic is supposed to pass but only works intermittently ===&lt;br /&gt;
This can happen when you have duplicate or conflicting firewall rules. This can happen if you add runtime rules that are already part of persistent configuration, or add the same rules to multiple scripts or configuration files. Re-read your firewall rules and ensure there are no duplicates or conflicting rules. It may help to restore the last known working configuration, and start from there.&lt;br /&gt;
&lt;br /&gt;
=== Traffic is supposed to pass but is not going through ===&lt;br /&gt;
Common causes:&lt;br /&gt;
* The firewall was not reloaded after changing configuration files&lt;br /&gt;
* The device has its own firewall &#039;&#039;and&#039;&#039; is behind the router firewall, and one of them is missing allow rules. &lt;br /&gt;
* Traffic has not been allowed on the correct protocol (TCP instead of UDP, or vice versa) &lt;br /&gt;
&lt;br /&gt;
== References ==&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2803</id>
		<title>Firewalling Basics</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2803"/>
		<updated>2026-07-31T18:52:04Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: /* Configuration Recommendations */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== 44Net Connect and Security == &lt;br /&gt;
44Net Connect provides every device with a public facing IPv4 address, and does not inspect, filter, or block any traffic directed towards 44Net devices. Devices with publicly routable IP addresses face a constant barrage of traffic from various scanners and bots on the internet. Some of them are malicious, and correctly configuring your firewall is a key part of defending against them. &lt;br /&gt;
&lt;br /&gt;
== What does a firewall do? ==&lt;br /&gt;
At its most basic, a firewall inspects incoming and outgoing packets, and based on its set of rules, decides whether each packet should be allowed through, dropped, or diverted. Rules may consider a packet&#039;s source and destination IP, source and destination interface, port, protocol (TCP vs UDP), or various special flags that may be set. Basic firewall usage is primarily concerned with source/destination IP, source/destination interface, and port. There are several goals we can achieve via firewall rules: allow outside connections to public-facing services, block outside connections to private services, and in case your device is compromised, block outgoing malicious traffic originating from your device. &lt;br /&gt;
&lt;br /&gt;
Outside connections to a public-facing service are typically allowed using a firewall rule that accepts all packets on the port that service is using, regardless of the packet&#039;s source IP. Private services, such as those only intended for your LAN, are typically protected by a firewall rule that only accepts packets whose source IP is inside your LAN. Packets sent to that port that originate externally will be dropped. You may have services that are only meant to be accessed from &amp;lt;code&amp;gt;localhost&amp;lt;/code&amp;gt;, such as control interfaces accessed only by other software on the same device. &lt;br /&gt;
&lt;br /&gt;
=== Stateful Firewalls ===&lt;br /&gt;
Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if the default policy would have otherwise dropped it. It&#039;s important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls, such as those based on &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;, are stateful. If for some reason this behavior is undesirable, it can be overridden with rules that explicitly drop the unwanted external traffic. &lt;br /&gt;
&lt;br /&gt;
Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers. &lt;br /&gt;
&lt;br /&gt;
Stateless firewalls are not capable of remembering previous packets, and handle each packet as if it&#039;s completely unrelated to all other packets.&lt;br /&gt;
&lt;br /&gt;
== Configuration Recommendations ==&lt;br /&gt;
When configuring any kind of security policy, best practice is to apply the &#039;&#039;&#039;principle of least privilege.&#039;&#039;&#039; This means that a person or device is given the minimum level of access to perform their job. This minimizes attack surface (the ways in which a malicious party can attack your network) and minimizes damage if a device or user&#039;s credentials are compromised. When it comes to configuring a firewall, that means only opening the ports on which you&#039;re actually running services, and only allowing communication between network segments if it&#039;s actually necessary. &lt;br /&gt;
&lt;br /&gt;
For example, some people confine Internet of Things (IoT) devices to their own {{term|VLAN}} &lt;br /&gt;
due to their often poor security. In such a configuration, you might allow devices from the regular LAN to initiate connections to the IoT devices, but not the other way around, to prevent a compromised IoT device from attacking the rest of your network. Some take it a step further, and block {{term|WAN}} access from the IoT VLAN to prevent devices from sending telemetry to their manufacturer.&lt;br /&gt;
&lt;br /&gt;
When restricting access between devices on your internal network, it can be helpful to use a policy that explicitly rejects disallowed packets rather than silently dropping them. This feedback can be helpful when troubleshooting, as it immediately lets you know that packets are being blocked by firewall policy rather than something like a port mismatch or a hostname/IP typo. Reject policies should only be used for relatively trusted network segments, otherwise you may spend lots of compute power sending packet rejections to automated scanners and other malicious actors on the wider internet.&lt;br /&gt;
&lt;br /&gt;
== Low Level Tools ==&lt;br /&gt;
=== iptables ===&lt;br /&gt;
&amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; is a Linux firewall rule management tool that was deprecated in favor of &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; in 2014. It allows system administrators to define &#039;&#039;tables&#039;&#039; containing &#039;&#039;chains&#039;&#039; of &#039;&#039;rules&#039;&#039; for the treatment of packets.&amp;lt;ref&amp;gt;https://en.wikipedia.org/wiki/Iptables&amp;lt;/ref&amp;gt; Both &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; use the netfilter framework to interface with the Linux kernel. &lt;br /&gt;
&lt;br /&gt;
Modern systems no longer ship with an actual copy of &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, instead using a compatibility layer that translates its rules to &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== nftables ===&lt;br /&gt;
nftables is the currently maintained Linux firewall rule management tool. It interfaces with the Linux kernel via the netfilter framework, and can be administrated with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; command line tool as well as editing &amp;lt;code&amp;gt;/etc/nftables.conf&amp;lt;/code&amp;gt;. Changes made with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; tool will not persist between reboots, and must be written into the config file to ensure persistence. It functions similarly to &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, employing tables of chains of rules, but with no predefined chains and more flexible rules.&lt;br /&gt;
&lt;br /&gt;
[[ File:Netfilter.png | 500px | A diagram illustrating the table, chain, and rule hierarchy used by iptables and nftables. A packet proceeds into the table, through the first chain, and does not match any rules. It proceeds through the second chain, matches the second rule, and makes a routing decision. ]]&lt;br /&gt;
&lt;br /&gt;
While firewall rules can be directly configured with &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt;, this is not recommended. The output of &amp;lt;code&amp;gt;sudo nft list ruleset&amp;lt;/code&amp;gt; is extremely verbose and not well formatted. &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; provides few formatting options for this output. See the next section for user-friendly tools that interface with nftables.&lt;br /&gt;
&lt;br /&gt;
== High Level Tools ==&lt;br /&gt;
=== firewalld ===&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; is an &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;-based CLI firewall management tool. It ships by default on CentOS, Fedora, OpenSUSE, RHEL, SUSE Enterprise, and EndeavourOS, and is packaged for many more distributions. It introduces the idea of a &amp;quot;zone,&amp;quot; which is a named set of policies that an interface can be assigned to. Each zone has a target, which is set to &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt;, or &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt;. These targets determine what action will be taken on packets in the zone that don&#039;t match any of the rules, services, or ports. &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; will accept ICMP and drop everything else, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; will discard packets without notifying the sender, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow the packet through, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will discard the packet and notify the sender of its rejection. Check your current zone configuration by running &amp;lt;code&amp;gt;sudo firewalld --list-all-zones&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
It&#039;s best to put public-facing interfaces into a &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; target zone. &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow unwanted or malicious traffic, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will spend lots of bandwidth replying to the barrage of traffic from bots scanning the internet.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; can be controlled using the &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; utility, or by editing the config file at &amp;lt;code&amp;gt;/etc/firewalld&amp;lt;/code&amp;gt;. Typical policy changes introduced using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; are called &amp;quot;runtime&amp;quot; changes, and will not persist after a restart of the service or a reboot. Permanent changes can be made by adding the &amp;lt;code&amp;gt;--permanent&amp;lt;/code&amp;gt; flag, or by introducing runtime changes and then invoking &amp;lt;code&amp;gt;firewall-cmd --runtime-to-permanent&amp;lt;/code&amp;gt;, which saves all current runtime changes to permanent configuration.&lt;br /&gt;
&lt;br /&gt;
Services are a &amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; abstraction containing a list of ports, protocols, destinations, and optionally a list of firewall helper modules to be loaded if the service is enabled. They make it easy to toggle these configuration groups, rather than having to toggle every rule in them individually. They can be configured using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; or by creating an XML file in &amp;lt;code&amp;gt;/etc/firewalld/services/&amp;lt;/code&amp;gt;. See &amp;lt;code&amp;gt;man firewalld.service&amp;lt;/code&amp;gt; for more information on services. As an example, the following command would enable the &amp;lt;code&amp;gt;ssh&amp;lt;/code&amp;gt; service in the &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt; zone. &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo firewall-cmd --permanent --zone public --add-service ssh&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Another advantage of using services is that the service definition can be edited, and then it will apply to all zones with that service enabled when firewalld is reloaded. firewalld can be reloaded using &amp;lt;code&amp;gt;sudo firewall-cmd --reload&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== ufw ===&lt;br /&gt;
Uncomplicated Firewall is a CLI program designed for easily managing a netfilter firewall. It also supports GUI management via the &amp;lt;code&amp;gt;gufw&amp;lt;/code&amp;gt; tool. When running, the active firewall rules can be viewed with &amp;lt;code&amp;gt;sudo ufw status&amp;lt;/code&amp;gt;. If you want to see the firewall rules while &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; is not running, use &amp;lt;code&amp;gt;sudo ufw show added&amp;lt;/code&amp;gt;. It uses a simple syntax with property names rather than flags. For the very simple operation of opening a port without utilizing any optional parameters, you need not even specify property names. One can allow TCP connections on port 22 (for example, to allow an SSH server) and start UFW as follows:&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo ufw allow 22/tcp&lt;br /&gt;
sudo ufw enable&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It also allows comments by specifying the &amp;lt;code&amp;gt;comment&amp;lt;/code&amp;gt; property and enclosing the actual comment in quotes. For example, &lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;sudo ufw allow 22/tcp comment &#039;SSH port&#039;&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
will show in the &amp;lt;code&amp;gt;ufw status&amp;lt;/code&amp;gt; output as &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;&lt;br /&gt;
To                         Action      From&lt;br /&gt;
--                         ------      ----&lt;br /&gt;
22/tcp                     ALLOW       Anywhere                 # SSH port&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
By default, Docker writes its own &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; rules and ignores &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; rules. This can cause conflicts and security issues in combination with &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt;.&amp;lt;ref&amp;gt;“Uncomplicated Firewall - ArchWiki.” 2024. Archlinux.Org. https://wiki.archlinux.org/title/Uncomplicated_Firewall.&amp;lt;/ref&amp;gt;&lt;br /&gt;
If you wish to use &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; on a system that has Docker, consider [https://docs.docker.com/engine/network/firewall-nftables#migrating-from-iptables-to-nftables migrating Docker to nftables.]&lt;br /&gt;
&lt;br /&gt;
== Verifying Configuration ==&lt;br /&gt;
After configuring your firewall, it&#039;s important to test the configuration to ensure that it&#039;s working how you think it is. This can be done with the help of a few command line tools. &lt;br /&gt;
&lt;br /&gt;
=== Verify that a port is open or closed === &lt;br /&gt;
To test whether a port is properly opened or closed, you can use set up a &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener a device behind the firewall, and use &amp;lt;code&amp;gt;curl&amp;lt;/code&amp;gt; to connect to it with a device outside the firewall. On the inside device, run &amp;lt;code&amp;gt;nc -l -p &amp;lt;port&amp;gt;&amp;lt;/code&amp;gt; (but replace &amp;lt;code&amp;gt;port&amp;lt;/code&amp;gt; with your desired port) to start the listener. If you have a service that normally runs on this port, you&#039;ll need to temporarily stop it so that &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; can bind to the port. On the outside device, run &amp;lt;code&amp;gt;curl &amp;lt;hostname&amp;gt;:&amp;lt;port&amp;gt;&amp;lt;/code&amp;gt;, and if the port is open, you&#039;ll see some text pop up on the &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener indicating that it received an HTTP GET request. &lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
=== Traffic is supposed to pass but only works intermittently ===&lt;br /&gt;
This can happen when you have duplicate or conflicting firewall rules. This can happen if you add runtime rules that are already part of persistent configuration, or add the same rules to multiple scripts or configuration files. Re-read your firewall rules and ensure there are no duplicates or conflicting rules. It may help to restore the last known working configuration, and start from there.&lt;br /&gt;
&lt;br /&gt;
=== Traffic is supposed to pass but is not going through ===&lt;br /&gt;
Common causes:&lt;br /&gt;
* The firewall was not reloaded after changing configuration files&lt;br /&gt;
* The device has its own firewall &#039;&#039;and&#039;&#039; is behind the router firewall, and one of them is missing allow rules. &lt;br /&gt;
* Traffic has not been allowed on the correct protocol (TCP instead of UDP, or vice versa) &lt;br /&gt;
&lt;br /&gt;
== References ==&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2802</id>
		<title>Firewalling Basics</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2802"/>
		<updated>2026-07-31T18:51:43Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: /* Configuration Recommendations */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== 44Net Connect and Security == &lt;br /&gt;
44Net Connect provides every device with a public facing IPv4 address, and does not inspect, filter, or block any traffic directed towards 44Net devices. Devices with publicly routable IP addresses face a constant barrage of traffic from various scanners and bots on the internet. Some of them are malicious, and correctly configuring your firewall is a key part of defending against them. &lt;br /&gt;
&lt;br /&gt;
== What does a firewall do? ==&lt;br /&gt;
At its most basic, a firewall inspects incoming and outgoing packets, and based on its set of rules, decides whether each packet should be allowed through, dropped, or diverted. Rules may consider a packet&#039;s source and destination IP, source and destination interface, port, protocol (TCP vs UDP), or various special flags that may be set. Basic firewall usage is primarily concerned with source/destination IP, source/destination interface, and port. There are several goals we can achieve via firewall rules: allow outside connections to public-facing services, block outside connections to private services, and in case your device is compromised, block outgoing malicious traffic originating from your device. &lt;br /&gt;
&lt;br /&gt;
Outside connections to a public-facing service are typically allowed using a firewall rule that accepts all packets on the port that service is using, regardless of the packet&#039;s source IP. Private services, such as those only intended for your LAN, are typically protected by a firewall rule that only accepts packets whose source IP is inside your LAN. Packets sent to that port that originate externally will be dropped. You may have services that are only meant to be accessed from &amp;lt;code&amp;gt;localhost&amp;lt;/code&amp;gt;, such as control interfaces accessed only by other software on the same device. &lt;br /&gt;
&lt;br /&gt;
=== Stateful Firewalls ===&lt;br /&gt;
Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if the default policy would have otherwise dropped it. It&#039;s important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls, such as those based on &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;, are stateful. If for some reason this behavior is undesirable, it can be overridden with rules that explicitly drop the unwanted external traffic. &lt;br /&gt;
&lt;br /&gt;
Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers. &lt;br /&gt;
&lt;br /&gt;
Stateless firewalls are not capable of remembering previous packets, and handle each packet as if it&#039;s completely unrelated to all other packets.&lt;br /&gt;
&lt;br /&gt;
== Configuration Recommendations ==&lt;br /&gt;
When configuring any kind of security policy, best practice is to apply the &#039;&#039;&#039;principle of least privilege.&#039;&#039;&#039; This means that a person or device is given the minimum level of access to perform their job. This minimizes attack surface (the ways in which a malicious party can attack your network) and minimizes damage if a device or user&#039;s credentials are compromised. When it comes to configuring a firewall, that means only opening the ports on which you&#039;re actually running services, and only allowing communication between network segments if it&#039;s actually necessary. &lt;br /&gt;
&lt;br /&gt;
For example, some people confine Internet of Things (IoT) devices to their own {{term|VLAN}} &lt;br /&gt;
due to their often poor security. In such a configuration, you might allow devices from the regular LAN to initiate connections to the IoT devices, but not the other way around, to prevent a compromised IoT device from attacking the rest of your network. Some take it a step further, and block {{term|WAN}}access from the IoT VLAN to prevent devices from sending telemetry to their manufacturer.&lt;br /&gt;
&lt;br /&gt;
When restricting access between devices on your internal network, it can be helpful to use a policy that explicitly rejects disallowed packets rather than silently dropping them. This feedback can be helpful when troubleshooting, as it immediately lets you know that packets are being blocked by firewall policy rather than something like a port mismatch or a hostname/IP typo. Reject policies should only be used for relatively trusted network segments, otherwise you may spend lots of compute power sending packet rejections to automated scanners and other malicious actors on the wider internet.&lt;br /&gt;
&lt;br /&gt;
== Low Level Tools ==&lt;br /&gt;
=== iptables ===&lt;br /&gt;
&amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; is a Linux firewall rule management tool that was deprecated in favor of &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; in 2014. It allows system administrators to define &#039;&#039;tables&#039;&#039; containing &#039;&#039;chains&#039;&#039; of &#039;&#039;rules&#039;&#039; for the treatment of packets.&amp;lt;ref&amp;gt;https://en.wikipedia.org/wiki/Iptables&amp;lt;/ref&amp;gt; Both &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; use the netfilter framework to interface with the Linux kernel. &lt;br /&gt;
&lt;br /&gt;
Modern systems no longer ship with an actual copy of &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, instead using a compatibility layer that translates its rules to &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== nftables ===&lt;br /&gt;
nftables is the currently maintained Linux firewall rule management tool. It interfaces with the Linux kernel via the netfilter framework, and can be administrated with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; command line tool as well as editing &amp;lt;code&amp;gt;/etc/nftables.conf&amp;lt;/code&amp;gt;. Changes made with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; tool will not persist between reboots, and must be written into the config file to ensure persistence. It functions similarly to &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, employing tables of chains of rules, but with no predefined chains and more flexible rules.&lt;br /&gt;
&lt;br /&gt;
[[ File:Netfilter.png | 500px | A diagram illustrating the table, chain, and rule hierarchy used by iptables and nftables. A packet proceeds into the table, through the first chain, and does not match any rules. It proceeds through the second chain, matches the second rule, and makes a routing decision. ]]&lt;br /&gt;
&lt;br /&gt;
While firewall rules can be directly configured with &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt;, this is not recommended. The output of &amp;lt;code&amp;gt;sudo nft list ruleset&amp;lt;/code&amp;gt; is extremely verbose and not well formatted. &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; provides few formatting options for this output. See the next section for user-friendly tools that interface with nftables.&lt;br /&gt;
&lt;br /&gt;
== High Level Tools ==&lt;br /&gt;
=== firewalld ===&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; is an &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;-based CLI firewall management tool. It ships by default on CentOS, Fedora, OpenSUSE, RHEL, SUSE Enterprise, and EndeavourOS, and is packaged for many more distributions. It introduces the idea of a &amp;quot;zone,&amp;quot; which is a named set of policies that an interface can be assigned to. Each zone has a target, which is set to &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt;, or &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt;. These targets determine what action will be taken on packets in the zone that don&#039;t match any of the rules, services, or ports. &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; will accept ICMP and drop everything else, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; will discard packets without notifying the sender, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow the packet through, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will discard the packet and notify the sender of its rejection. Check your current zone configuration by running &amp;lt;code&amp;gt;sudo firewalld --list-all-zones&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
It&#039;s best to put public-facing interfaces into a &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; target zone. &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow unwanted or malicious traffic, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will spend lots of bandwidth replying to the barrage of traffic from bots scanning the internet.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; can be controlled using the &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; utility, or by editing the config file at &amp;lt;code&amp;gt;/etc/firewalld&amp;lt;/code&amp;gt;. Typical policy changes introduced using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; are called &amp;quot;runtime&amp;quot; changes, and will not persist after a restart of the service or a reboot. Permanent changes can be made by adding the &amp;lt;code&amp;gt;--permanent&amp;lt;/code&amp;gt; flag, or by introducing runtime changes and then invoking &amp;lt;code&amp;gt;firewall-cmd --runtime-to-permanent&amp;lt;/code&amp;gt;, which saves all current runtime changes to permanent configuration.&lt;br /&gt;
&lt;br /&gt;
Services are a &amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; abstraction containing a list of ports, protocols, destinations, and optionally a list of firewall helper modules to be loaded if the service is enabled. They make it easy to toggle these configuration groups, rather than having to toggle every rule in them individually. They can be configured using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; or by creating an XML file in &amp;lt;code&amp;gt;/etc/firewalld/services/&amp;lt;/code&amp;gt;. See &amp;lt;code&amp;gt;man firewalld.service&amp;lt;/code&amp;gt; for more information on services. As an example, the following command would enable the &amp;lt;code&amp;gt;ssh&amp;lt;/code&amp;gt; service in the &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt; zone. &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo firewall-cmd --permanent --zone public --add-service ssh&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Another advantage of using services is that the service definition can be edited, and then it will apply to all zones with that service enabled when firewalld is reloaded. firewalld can be reloaded using &amp;lt;code&amp;gt;sudo firewall-cmd --reload&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== ufw ===&lt;br /&gt;
Uncomplicated Firewall is a CLI program designed for easily managing a netfilter firewall. It also supports GUI management via the &amp;lt;code&amp;gt;gufw&amp;lt;/code&amp;gt; tool. When running, the active firewall rules can be viewed with &amp;lt;code&amp;gt;sudo ufw status&amp;lt;/code&amp;gt;. If you want to see the firewall rules while &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; is not running, use &amp;lt;code&amp;gt;sudo ufw show added&amp;lt;/code&amp;gt;. It uses a simple syntax with property names rather than flags. For the very simple operation of opening a port without utilizing any optional parameters, you need not even specify property names. One can allow TCP connections on port 22 (for example, to allow an SSH server) and start UFW as follows:&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo ufw allow 22/tcp&lt;br /&gt;
sudo ufw enable&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It also allows comments by specifying the &amp;lt;code&amp;gt;comment&amp;lt;/code&amp;gt; property and enclosing the actual comment in quotes. For example, &lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;sudo ufw allow 22/tcp comment &#039;SSH port&#039;&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
will show in the &amp;lt;code&amp;gt;ufw status&amp;lt;/code&amp;gt; output as &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;&lt;br /&gt;
To                         Action      From&lt;br /&gt;
--                         ------      ----&lt;br /&gt;
22/tcp                     ALLOW       Anywhere                 # SSH port&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
By default, Docker writes its own &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; rules and ignores &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; rules. This can cause conflicts and security issues in combination with &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt;.&amp;lt;ref&amp;gt;“Uncomplicated Firewall - ArchWiki.” 2024. Archlinux.Org. https://wiki.archlinux.org/title/Uncomplicated_Firewall.&amp;lt;/ref&amp;gt;&lt;br /&gt;
If you wish to use &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; on a system that has Docker, consider [https://docs.docker.com/engine/network/firewall-nftables#migrating-from-iptables-to-nftables migrating Docker to nftables.]&lt;br /&gt;
&lt;br /&gt;
== Verifying Configuration ==&lt;br /&gt;
After configuring your firewall, it&#039;s important to test the configuration to ensure that it&#039;s working how you think it is. This can be done with the help of a few command line tools. &lt;br /&gt;
&lt;br /&gt;
=== Verify that a port is open or closed === &lt;br /&gt;
To test whether a port is properly opened or closed, you can use set up a &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener a device behind the firewall, and use &amp;lt;code&amp;gt;curl&amp;lt;/code&amp;gt; to connect to it with a device outside the firewall. On the inside device, run &amp;lt;code&amp;gt;nc -l -p &amp;lt;port&amp;gt;&amp;lt;/code&amp;gt; (but replace &amp;lt;code&amp;gt;port&amp;lt;/code&amp;gt; with your desired port) to start the listener. If you have a service that normally runs on this port, you&#039;ll need to temporarily stop it so that &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; can bind to the port. On the outside device, run &amp;lt;code&amp;gt;curl &amp;lt;hostname&amp;gt;:&amp;lt;port&amp;gt;&amp;lt;/code&amp;gt;, and if the port is open, you&#039;ll see some text pop up on the &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener indicating that it received an HTTP GET request. &lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
=== Traffic is supposed to pass but only works intermittently ===&lt;br /&gt;
This can happen when you have duplicate or conflicting firewall rules. This can happen if you add runtime rules that are already part of persistent configuration, or add the same rules to multiple scripts or configuration files. Re-read your firewall rules and ensure there are no duplicates or conflicting rules. It may help to restore the last known working configuration, and start from there.&lt;br /&gt;
&lt;br /&gt;
=== Traffic is supposed to pass but is not going through ===&lt;br /&gt;
Common causes:&lt;br /&gt;
* The firewall was not reloaded after changing configuration files&lt;br /&gt;
* The device has its own firewall &#039;&#039;and&#039;&#039; is behind the router firewall, and one of them is missing allow rules. &lt;br /&gt;
* Traffic has not been allowed on the correct protocol (TCP instead of UDP, or vice versa) &lt;br /&gt;
&lt;br /&gt;
== References ==&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2801</id>
		<title>Firewalling Basics</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Firewalling_Basics&amp;diff=2801"/>
		<updated>2026-07-31T18:46:10Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: /* Configuration Recommendations */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== 44Net Connect and Security == &lt;br /&gt;
44Net Connect provides every device with a public facing IPv4 address, and does not inspect, filter, or block any traffic directed towards 44Net devices. Devices with publicly routable IP addresses face a constant barrage of traffic from various scanners and bots on the internet. Some of them are malicious, and correctly configuring your firewall is a key part of defending against them. &lt;br /&gt;
&lt;br /&gt;
== What does a firewall do? ==&lt;br /&gt;
At its most basic, a firewall inspects incoming and outgoing packets, and based on its set of rules, decides whether each packet should be allowed through, dropped, or diverted. Rules may consider a packet&#039;s source and destination IP, source and destination interface, port, protocol (TCP vs UDP), or various special flags that may be set. Basic firewall usage is primarily concerned with source/destination IP, source/destination interface, and port. There are several goals we can achieve via firewall rules: allow outside connections to public-facing services, block outside connections to private services, and in case your device is compromised, block outgoing malicious traffic originating from your device. &lt;br /&gt;
&lt;br /&gt;
Outside connections to a public-facing service are typically allowed using a firewall rule that accepts all packets on the port that service is using, regardless of the packet&#039;s source IP. Private services, such as those only intended for your LAN, are typically protected by a firewall rule that only accepts packets whose source IP is inside your LAN. Packets sent to that port that originate externally will be dropped. You may have services that are only meant to be accessed from &amp;lt;code&amp;gt;localhost&amp;lt;/code&amp;gt;, such as control interfaces accessed only by other software on the same device. &lt;br /&gt;
&lt;br /&gt;
=== Stateful Firewalls ===&lt;br /&gt;
Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if the default policy would have otherwise dropped it. It&#039;s important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls, such as those based on &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;, are stateful. If for some reason this behavior is undesirable, it can be overridden with rules that explicitly drop the unwanted external traffic. &lt;br /&gt;
&lt;br /&gt;
Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers. &lt;br /&gt;
&lt;br /&gt;
Stateless firewalls are not capable of remembering previous packets, and handle each packet as if it&#039;s completely unrelated to all other packets.&lt;br /&gt;
&lt;br /&gt;
== Configuration Recommendations ==&lt;br /&gt;
When configuring any kind of security policy, best practice is to apply the &#039;&#039;&#039;principle of least privilege.&#039;&#039;&#039; This means that a person or device is given the minimum level of access to perform their job. This minimizes attack surface (the ways in which a malicious party can attack your network) and minimizes damage if a device or user&#039;s credentials are compromised. When it comes to configuring a firewall, that means only opening the ports on which you&#039;re actually running services, and only allowing communication between network segments if it&#039;s actually necessary. &lt;br /&gt;
&lt;br /&gt;
For example, some people confine Internet of Things (IoT) devices to their own {{term|VLAN}} &lt;br /&gt;
due to their often poor security. In such a configuration, you might allow devices from the regular LAN to initiate connections to the IoT devices, but not the other way around, to prevent a compromised IoT device from attacking the rest of your network. Some take it a step further, and block {{term|WAN}} access from the IoT VLAN to prevent devices from sending telemetry to their manufacturer.&lt;br /&gt;
&lt;br /&gt;
When restricting access between devices on your internal network, it can be helpful to use a policy that explicitly rejects disallowed packets rather than silently dropping them. This feedback can be helpful when troubleshooting, as it immediately lets you know that packets are being blocked by firewall policy rather than something like a port mismatch or a hostname/IP typo. Reject policies should only be used for relatively trusted network segments, otherwise you may spend lots of compute power sending packet rejections to automated scanners and other malicious actors on the wider internet.&lt;br /&gt;
&lt;br /&gt;
== Low Level Tools ==&lt;br /&gt;
=== iptables ===&lt;br /&gt;
&amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; is a Linux firewall rule management tool that was deprecated in favor of &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; in 2014. It allows system administrators to define &#039;&#039;tables&#039;&#039; containing &#039;&#039;chains&#039;&#039; of &#039;&#039;rules&#039;&#039; for the treatment of packets.&amp;lt;ref&amp;gt;https://en.wikipedia.org/wiki/Iptables&amp;lt;/ref&amp;gt; Both &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; and &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt; use the netfilter framework to interface with the Linux kernel. &lt;br /&gt;
&lt;br /&gt;
Modern systems no longer ship with an actual copy of &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, instead using a compatibility layer that translates its rules to &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== nftables ===&lt;br /&gt;
nftables is the currently maintained Linux firewall rule management tool. It interfaces with the Linux kernel via the netfilter framework, and can be administrated with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; command line tool as well as editing &amp;lt;code&amp;gt;/etc/nftables.conf&amp;lt;/code&amp;gt;. Changes made with the &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; tool will not persist between reboots, and must be written into the config file to ensure persistence. It functions similarly to &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt;, employing tables of chains of rules, but with no predefined chains and more flexible rules.&lt;br /&gt;
&lt;br /&gt;
[[ File:Netfilter.png | 500px | A diagram illustrating the table, chain, and rule hierarchy used by iptables and nftables. A packet proceeds into the table, through the first chain, and does not match any rules. It proceeds through the second chain, matches the second rule, and makes a routing decision. ]]&lt;br /&gt;
&lt;br /&gt;
While firewall rules can be directly configured with &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt;, this is not recommended. The output of &amp;lt;code&amp;gt;sudo nft list ruleset&amp;lt;/code&amp;gt; is extremely verbose and not well formatted. &amp;lt;code&amp;gt;nft&amp;lt;/code&amp;gt; provides few formatting options for this output. See the next section for user-friendly tools that interface with nftables.&lt;br /&gt;
&lt;br /&gt;
== High Level Tools ==&lt;br /&gt;
=== firewalld ===&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; is an &amp;lt;code&amp;gt;nftables&amp;lt;/code&amp;gt;-based CLI firewall management tool. It ships by default on CentOS, Fedora, OpenSUSE, RHEL, SUSE Enterprise, and EndeavourOS, and is packaged for many more distributions. It introduces the idea of a &amp;quot;zone,&amp;quot; which is a named set of policies that an interface can be assigned to. Each zone has a target, which is set to &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt;, or &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt;. These targets determine what action will be taken on packets in the zone that don&#039;t match any of the rules, services, or ports. &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; will accept ICMP and drop everything else, &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; will discard packets without notifying the sender, &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow the packet through, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will discard the packet and notify the sender of its rejection. Check your current zone configuration by running &amp;lt;code&amp;gt;sudo firewalld --list-all-zones&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
It&#039;s best to put public-facing interfaces into a &amp;lt;code&amp;gt;default&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;DROP&amp;lt;/code&amp;gt; target zone. &amp;lt;code&amp;gt;ACCEPT&amp;lt;/code&amp;gt; will allow unwanted or malicious traffic, and &amp;lt;code&amp;gt;REJECT&amp;lt;/code&amp;gt; will spend lots of bandwidth replying to the barrage of traffic from bots scanning the internet.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; can be controlled using the &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; utility, or by editing the config file at &amp;lt;code&amp;gt;/etc/firewalld&amp;lt;/code&amp;gt;. Typical policy changes introduced using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; are called &amp;quot;runtime&amp;quot; changes, and will not persist after a restart of the service or a reboot. Permanent changes can be made by adding the &amp;lt;code&amp;gt;--permanent&amp;lt;/code&amp;gt; flag, or by introducing runtime changes and then invoking &amp;lt;code&amp;gt;firewall-cmd --runtime-to-permanent&amp;lt;/code&amp;gt;, which saves all current runtime changes to permanent configuration.&lt;br /&gt;
&lt;br /&gt;
Services are a &amp;lt;code&amp;gt;firewalld&amp;lt;/code&amp;gt; abstraction containing a list of ports, protocols, destinations, and optionally a list of firewall helper modules to be loaded if the service is enabled. They make it easy to toggle these configuration groups, rather than having to toggle every rule in them individually. They can be configured using &amp;lt;code&amp;gt;firewall-cmd&amp;lt;/code&amp;gt; or by creating an XML file in &amp;lt;code&amp;gt;/etc/firewalld/services/&amp;lt;/code&amp;gt;. See &amp;lt;code&amp;gt;man firewalld.service&amp;lt;/code&amp;gt; for more information on services. As an example, the following command would enable the &amp;lt;code&amp;gt;ssh&amp;lt;/code&amp;gt; service in the &amp;lt;code&amp;gt;public&amp;lt;/code&amp;gt; zone. &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo firewall-cmd --permanent --zone public --add-service ssh&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Another advantage of using services is that the service definition can be edited, and then it will apply to all zones with that service enabled when firewalld is reloaded. firewalld can be reloaded using &amp;lt;code&amp;gt;sudo firewall-cmd --reload&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
=== ufw ===&lt;br /&gt;
Uncomplicated Firewall is a CLI program designed for easily managing a netfilter firewall. It also supports GUI management via the &amp;lt;code&amp;gt;gufw&amp;lt;/code&amp;gt; tool. When running, the active firewall rules can be viewed with &amp;lt;code&amp;gt;sudo ufw status&amp;lt;/code&amp;gt;. If you want to see the firewall rules while &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; is not running, use &amp;lt;code&amp;gt;sudo ufw show added&amp;lt;/code&amp;gt;. It uses a simple syntax with property names rather than flags. For the very simple operation of opening a port without utilizing any optional parameters, you need not even specify property names. One can allow TCP connections on port 22 (for example, to allow an SSH server) and start UFW as follows:&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;sudo ufw allow 22/tcp&lt;br /&gt;
sudo ufw enable&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It also allows comments by specifying the &amp;lt;code&amp;gt;comment&amp;lt;/code&amp;gt; property and enclosing the actual comment in quotes. For example, &lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;sudo ufw allow 22/tcp comment &#039;SSH port&#039;&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
will show in the &amp;lt;code&amp;gt;ufw status&amp;lt;/code&amp;gt; output as &lt;br /&gt;
&lt;br /&gt;
 &amp;lt;nowiki&amp;gt;&lt;br /&gt;
To                         Action      From&lt;br /&gt;
--                         ------      ----&lt;br /&gt;
22/tcp                     ALLOW       Anywhere                 # SSH port&amp;lt;/nowiki&amp;gt;&lt;br /&gt;
&lt;br /&gt;
By default, Docker writes its own &amp;lt;code&amp;gt;iptables&amp;lt;/code&amp;gt; rules and ignores &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; rules. This can cause conflicts and security issues in combination with &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt;.&amp;lt;ref&amp;gt;“Uncomplicated Firewall - ArchWiki.” 2024. Archlinux.Org. https://wiki.archlinux.org/title/Uncomplicated_Firewall.&amp;lt;/ref&amp;gt;&lt;br /&gt;
If you wish to use &amp;lt;code&amp;gt;ufw&amp;lt;/code&amp;gt; on a system that has Docker, consider [https://docs.docker.com/engine/network/firewall-nftables#migrating-from-iptables-to-nftables migrating Docker to nftables.]&lt;br /&gt;
&lt;br /&gt;
== Verifying Configuration ==&lt;br /&gt;
After configuring your firewall, it&#039;s important to test the configuration to ensure that it&#039;s working how you think it is. This can be done with the help of a few command line tools. &lt;br /&gt;
&lt;br /&gt;
=== Verify that a port is open or closed === &lt;br /&gt;
To test whether a port is properly opened or closed, you can use set up a &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener a device behind the firewall, and use &amp;lt;code&amp;gt;curl&amp;lt;/code&amp;gt; to connect to it with a device outside the firewall. On the inside device, run &amp;lt;code&amp;gt;nc -l -p &amp;lt;port&amp;gt;&amp;lt;/code&amp;gt; (but replace &amp;lt;code&amp;gt;port&amp;lt;/code&amp;gt; with your desired port) to start the listener. If you have a service that normally runs on this port, you&#039;ll need to temporarily stop it so that &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; can bind to the port. On the outside device, run &amp;lt;code&amp;gt;curl &amp;lt;hostname&amp;gt;:&amp;lt;port&amp;gt;&amp;lt;/code&amp;gt;, and if the port is open, you&#039;ll see some text pop up on the &amp;lt;code&amp;gt;netcat&amp;lt;/code&amp;gt; listener indicating that it received an HTTP GET request. &lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
=== Traffic is supposed to pass but only works intermittently ===&lt;br /&gt;
This can happen when you have duplicate or conflicting firewall rules. This can happen if you add runtime rules that are already part of persistent configuration, or add the same rules to multiple scripts or configuration files. Re-read your firewall rules and ensure there are no duplicates or conflicting rules. It may help to restore the last known working configuration, and start from there.&lt;br /&gt;
&lt;br /&gt;
=== Traffic is supposed to pass but is not going through ===&lt;br /&gt;
Common causes:&lt;br /&gt;
* The firewall was not reloaded after changing configuration files&lt;br /&gt;
* The device has its own firewall &#039;&#039;and&#039;&#039; is behind the router firewall, and one of them is missing allow rules. &lt;br /&gt;
* Traffic has not been allowed on the correct protocol (TCP instead of UDP, or vice versa) &lt;br /&gt;
&lt;br /&gt;
== References ==&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Setting_up_a_gateway_on_Ubiquiti_EdgeRouter&amp;diff=1688</id>
		<title>Setting up a gateway on Ubiquiti EdgeRouter</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Setting_up_a_gateway_on_Ubiquiti_EdgeRouter&amp;diff=1688"/>
		<updated>2025-09-11T19:58:21Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;br /&gt;
&#039;&#039;&#039;== Updated 16/05/2020 - M0MUX ==&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Setting up a gateway on Ubiquiti EdgeRouter ==&lt;br /&gt;
&lt;br /&gt;
EdgeRouter is a low cost professional grade router made by Ubiquiti.&lt;br /&gt;
All routers in the product family such as EdgeRouter X, EdgeRouter Lite and EdgeRouter PoE run the EdgeOS router operating system.&lt;br /&gt;
EdgeOS seems to be an OEM version of Vyatta (now Brocade) and Vyos (an open source version).&lt;br /&gt;
The commands are almost identical so with little adjustments this guide could serve the different variant.&lt;br /&gt;
&lt;br /&gt;
EdgeRouter is appealing to anyone interested in setting up a gateway to AMPRNet due to the built in support for the IPIP tunneling protocol.&lt;br /&gt;
This guide was created based on my experience with setting up a gateway to AMPRNet using the EdgeRouter PoE model.&lt;br /&gt;
I haven&#039;t tested it on other models, but since they all use the same OS, it should work with minimal adjustment if any.&lt;br /&gt;
&lt;br /&gt;
This guide covers only one tunnel to the master AMPRnet gateway at UCSD. This guide doesn&#039;t cover the automatic setup of tunnels to other gateways.&lt;br /&gt;
&lt;br /&gt;
== Assumptions / Prereqs ==&lt;br /&gt;
&lt;br /&gt;
•	You have already registered with AMPRNet and got your 44.0.0.0/9 or 44.128.0.0/10 allocation and it is showing in the encap.txt file&lt;br /&gt;
•	You have registered some hosts in the AMPRNet DNS like &amp;lt;your call sign&amp;gt;.ampr.org&lt;br /&gt;
•	Your EdgeRouter is upgraded to the latest EdgeOS (currently version v2.0.6)&lt;br /&gt;
•	You have a standard working NAT setup&lt;br /&gt;
        •    Interface eth0 is your connection to your ISP&lt;br /&gt;
        •    Interface eth1 is your home LAN where your computers are connected&lt;br /&gt;
&lt;br /&gt;
You have successfully setup the EdgeRouter and it is connected to the internet and providing service to your home computers&lt;br /&gt;
&lt;br /&gt;
== The plan ==&lt;br /&gt;
&lt;br /&gt;
We will use eth2 as our AMPRNet LAN where computers and other devices with assigned AMPRNet address will connect via an IPIP tunnel to the UCSD AMPRNet gateway and the internet.&lt;br /&gt;
&lt;br /&gt;
== Warning!! ==&lt;br /&gt;
&lt;br /&gt;
The author does not assume responsibility if you mess up/brick your router. Please make sure to back up your EdgeRouter configuration prior to any change.&lt;br /&gt;
Also make sure you know how to restore your configuration and you know how to restore your router to factory defaults if everything else fails.&lt;br /&gt;
&lt;br /&gt;
== Initial setup ==&lt;br /&gt;
&lt;br /&gt;
Open the CLI using the GUI button or connect using an ssh client such as PuTTY to 192.196.2.1.&lt;br /&gt;
&lt;br /&gt;
The default username/password is ubnt/ubnt unless you have already changed it.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;You need to establish a Gateway for your 44 network, that the clients will route through.&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
As I write this, my 44net allocation is 44.131.252.64/28&lt;br /&gt;
&lt;br /&gt;
My Gateway will be the next IP in the block. 44.131.252.65&lt;br /&gt;
&lt;br /&gt;
Enter configuration mode&lt;br /&gt;
        • ubnt@ubnt:~$ configure&lt;br /&gt;
Set the AMPRNet network assignment you have received to eth2 (Gateway we just decided on)&lt;br /&gt;
        • ubnt@ubnt:~#  set interfaces ethernet eth2 address 44.131.252.65/28&lt;br /&gt;
Now commit the changes&lt;br /&gt;
        • ubnt@ubnt:~#  commit&lt;br /&gt;
&lt;br /&gt;
== Setting up the tunnel ==&lt;br /&gt;
&lt;br /&gt;
In configuration mode enter the following commands&lt;br /&gt;
        • ubnt@ubnt:~#  set interfaces tunnel tun0&lt;br /&gt;
        • ubnt@ubnt:~#  set interfaces tunnel tun0 local-ip &amp;lt;put the external ip assigned to you by your ISP&amp;gt;&lt;br /&gt;
        • ubnt@ubnt:~#  set interfaces tunnel tun0 remote-ip 169.228.34.84&lt;br /&gt;
        • ubnt@ubnt:~#  set interfaces tunnel tun0 encapsulation ipip&lt;br /&gt;
        • ubnt@ubnt:~#  set interfaces tunnel tun0 description &amp;quot;Tunnel to AMPRNet gateway&amp;quot;&lt;br /&gt;
Now commit the changes&lt;br /&gt;
        • ubnt@ubnt:~#  commit ; save&lt;br /&gt;
To verify your input so far, enter the following command&lt;br /&gt;
        • ubnt@ubnt:~#  show interfaces tunnel tun0&lt;br /&gt;
The output should look like this&lt;br /&gt;
        • description &amp;quot;Tunnel to AMPRNet gateway&amp;quot;&lt;br /&gt;
        • encapsulation ipip&lt;br /&gt;
        • local-ip &amp;lt;your assigned ISP address&amp;gt;&lt;br /&gt;
        • remote-ip 169.228.34.84&lt;br /&gt;
&lt;br /&gt;
== Setting up source address routing policy ==&lt;br /&gt;
&lt;br /&gt;
Most likely your home computers LAN is setup to route to any internet destination via the interface connected to the ISP.&lt;br /&gt;
In addition, all your private ip addresses are being masqueraded before getting to the outside world.&lt;br /&gt;
Entering the following command (in operational mode) will print the routing table&lt;br /&gt;
        • ubnt@ubnt:~$  show ip route&lt;br /&gt;
&lt;br /&gt;
You should get something similar to this routing table&lt;br /&gt;
&lt;br /&gt;
       Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP&lt;br /&gt;
       O - OSPF, IA - OSPF inter area&lt;br /&gt;
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&lt;br /&gt;
       E1 - OSPF external type 1, E2 - OSPF external type 2&lt;br /&gt;
       &amp;gt; - selected route, * - FIB route, p - stale info&lt;br /&gt;
       IP Route Table for VRF &amp;quot;default&amp;quot;&lt;br /&gt;
       S    *&amp;gt; 0.0.0.0/0 [210/0] via &amp;lt;your ISP default gateway&amp;gt;, eth0&lt;br /&gt;
       C    *&amp;gt; &amp;lt;your ISP network&amp;gt; is directly connected, eth0&lt;br /&gt;
       C    *&amp;gt; 127.0.0.0/8 is directly connected, lo&lt;br /&gt;
&lt;br /&gt;
0.0.0.0/0 basically means &amp;quot;every ip address&amp;quot;&lt;br /&gt;
&lt;br /&gt;
We want to make sure the following happen:&lt;br /&gt;
&lt;br /&gt;
• Normal routing for your home computers LAN is maintained.&lt;br /&gt;
&lt;br /&gt;
• Your AMPRNet hosts are being routed to the tunnel to connect to the internet. No masquerading is needed.&lt;br /&gt;
 &lt;br /&gt;
Let&#039;s define source address routing policy that will make sure only AMPRNet hosts are routed to the tunnel&lt;br /&gt;
        • ubnt@ubnt:~# set protocols static table 1 interface-route 0.0.0.0/0 next-hop-interface tun0&lt;br /&gt;
        • ubnt@ubnt:~# set firewall modify SOURCE_ROUTE rule 10 description &#039;traffic to AMPRNet&#039;&lt;br /&gt;
        • ubnt@ubnt:~# set firewall modify SOURCE_ROUTE rule 10 source address &amp;lt;put your AMPRNet assigned network - in my case 44.252.131.64/28&amp;gt;&lt;br /&gt;
        • ubnt@ubnt:~# set firewall modify SOURCE_ROUTE rule 10 modify table 1&lt;br /&gt;
        • ubnt@ubnt:~# set interfaces ethernet eth2 firewall in modify SOURCE_ROUTE&lt;br /&gt;
&lt;br /&gt;
Now commit the changes&lt;br /&gt;
        • ubnt@ubnt:~# commit ; save ; exit&lt;br /&gt;
&lt;br /&gt;
== Smoke test ==&lt;br /&gt;
&lt;br /&gt;
To test our configuration, we first need to connect a computer to the EdgeRouter interface eth2 and manually assign an ip address from our assigned AMPRNet network range that has already been registered with the DNS.&lt;br /&gt;
&lt;br /&gt;
To test that we are accessible from the outside world, use a &amp;quot;ping service&amp;quot; such as ping.eu to ping the above mentioned host. If you see response, this basically means that the tunnel is working! (At least from the outside in)&lt;br /&gt;
&lt;br /&gt;
To see that our source routing policy works, ping an external host such as google DNS server @ 8.8.8.8. If you see a response, you at least know that your above mentioned host is reaching the internet.&lt;br /&gt;
&lt;br /&gt;
To verify that we are exiting the router via the tunnel, do a traceroute command to 8.8.8.8. If in the trace you see some ucsd.edu host, you know that you are using the tunnel.&lt;br /&gt;
&lt;br /&gt;
The last test we can do is to use a site like whatismyip.com to see the address which we are coming from. If it is the address is the above mentioned host, then we have successfully setup the AMPRNet gateway.&lt;br /&gt;
&lt;br /&gt;
== Finishing touches ==&lt;br /&gt;
&lt;br /&gt;
If you have reached so far and everything is working correctly, it is time to save our configuration.&lt;br /&gt;
In configuration mode enter the following&lt;br /&gt;
        • ubnt@ubnt:~$ save&lt;br /&gt;
&lt;br /&gt;
Since we have now an open tunnel to the world ending in our EdgeRouter, we need to extend our firewall protection to interface tun0. This can easily be done in the EdgeRouter GUI.&lt;br /&gt;
       • Select the Firewall/NAT tab&lt;br /&gt;
       • Select firewall policies tab&lt;br /&gt;
There should be two rulesets&lt;br /&gt;
       o WAN_IN&lt;br /&gt;
       o WAN_LOCAL&lt;br /&gt;
&lt;br /&gt;
For each rule, press the actions button on the right and select the interfaces option.&lt;br /&gt;
&lt;br /&gt;
       • Press the + Add Interface button.&lt;br /&gt;
       • Select tun0 as the interface and select in as the direction.&lt;br /&gt;
       • Finish by pressing the Save Ruleset button.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Example Config ==&lt;br /&gt;
&lt;br /&gt;
This is from my working ER4.&lt;br /&gt;
&lt;br /&gt;
  firewall modify SOURCE_ROUTE {&lt;br /&gt;
         rule 10 {&lt;br /&gt;
             action modify&lt;br /&gt;
             description &amp;quot;traffic to ampr&amp;quot;&lt;br /&gt;
             modify {&lt;br /&gt;
                 table 5&lt;br /&gt;
             }&lt;br /&gt;
             source {&lt;br /&gt;
                 address 44.131.252.64/28&lt;br /&gt;
             }&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
&lt;br /&gt;
  firewall name 44Net_IN {&lt;br /&gt;
         default-action drop&lt;br /&gt;
         description &amp;quot;44Net in&amp;quot;&lt;br /&gt;
         rule 10 {&lt;br /&gt;
             action accept&lt;br /&gt;
             description &amp;quot;Allow established/related&amp;quot;&lt;br /&gt;
             log disable&lt;br /&gt;
             state {&lt;br /&gt;
                 established enable&lt;br /&gt;
                 related enable&lt;br /&gt;
             }&lt;br /&gt;
         }&lt;br /&gt;
         rule 20 {&lt;br /&gt;
             action accept&lt;br /&gt;
             description ICMP&lt;br /&gt;
             log disable&lt;br /&gt;
             protocol icmp&lt;br /&gt;
         }&lt;br /&gt;
         rule 30 {&lt;br /&gt;
             action drop&lt;br /&gt;
             description &amp;quot;Drop invalid state&amp;quot;&lt;br /&gt;
             state {&lt;br /&gt;
                 invalid enable&lt;br /&gt;
             }&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
&lt;br /&gt;
   interfaces ethernet eth3 {&lt;br /&gt;
         address 44.131.252.65/28&lt;br /&gt;
         description 44.131.252.65/28&lt;br /&gt;
         duplex auto&lt;br /&gt;
         firewall {&lt;br /&gt;
             in {&lt;br /&gt;
                 modify SOURCE_ROUTE&lt;br /&gt;
             }&lt;br /&gt;
             local {&lt;br /&gt;
             }&lt;br /&gt;
             out {&lt;br /&gt;
             }&lt;br /&gt;
         }&lt;br /&gt;
         ip {&lt;br /&gt;
         }&lt;br /&gt;
         speed auto&lt;br /&gt;
     }&lt;br /&gt;
&lt;br /&gt;
   interfaces tunnel tun0 {&lt;br /&gt;
         description &amp;quot;Tunnel to AMPRNet&amp;quot;&lt;br /&gt;
         encapsulation ipip&lt;br /&gt;
         firewall {&lt;br /&gt;
             in {&lt;br /&gt;
                 name 44Net_IN&lt;br /&gt;
             }&lt;br /&gt;
         }&lt;br /&gt;
         ip {&lt;br /&gt;
         }&lt;br /&gt;
         local-ip 80.235.222.210&lt;br /&gt;
         multicast disable&lt;br /&gt;
         remote-ip 169.228.34.84&lt;br /&gt;
         ttl 255&lt;br /&gt;
     }&lt;br /&gt;
&lt;br /&gt;
   protocols static {&lt;br /&gt;
         table 5 {&lt;br /&gt;
             interface-route 0.0.0.0/0 {&lt;br /&gt;
                 next-hop-interface tun0 {&lt;br /&gt;
                 }&lt;br /&gt;
             }&lt;br /&gt;
         }&lt;br /&gt;
        }&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
[[Category:How-To Guides]]&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1616</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1616"/>
		<updated>2025-05-09T21:45:25Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
 [[File:44net_Globe.png|frameless|center|thumb|350px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
 [[File:Community-radio.png|frameless|center|thumb|550px|Jump in, nerd out. Community Radio]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1615</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1615"/>
		<updated>2025-05-09T21:39:47Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
 [[File:44net_Globe.png|frameless|center|thumb|350px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
 [[File:Community-radio.png|frameless|center|thumb|550px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=File:Community-radio.png&amp;diff=1614</id>
		<title>File:Community-radio.png</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=File:Community-radio.png&amp;diff=1614"/>
		<updated>2025-05-09T21:39:17Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=File:JUMP_IN_V1.png&amp;diff=1613</id>
		<title>File:JUMP IN V1.png</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=File:JUMP_IN_V1.png&amp;diff=1613"/>
		<updated>2025-05-09T21:31:18Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: Airgapped uploaded a new version of File:JUMP IN V1.png&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1612</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1612"/>
		<updated>2025-05-09T21:21:31Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
 [[File:44net_Globe.png|frameless|center|thumb|350px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
 [[File:JUMP_IN_V1.png|frameless|center|thumb|550px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1611</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1611"/>
		<updated>2025-05-09T21:21:18Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
 [[File:44net_Globe.png|frameless|center|thumb|350px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
 [[File:JUMP_IN_V1.png|frameless|right|thumb|450px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1610</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1610"/>
		<updated>2025-05-09T21:21:08Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
 [[File:44net_Globe.png|frameless|center|thumb|350px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
 [[File:JUMP_IN_V1.png|frameless|right|thumb|350px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1609</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1609"/>
		<updated>2025-05-09T21:20:53Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
 [[File:44net_Globe.png|frameless|center|thumb|350px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
 [[File:JUMP_IN_V1.png|frameless|center|thumb|350px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=File:JUMP_IN_V1.png&amp;diff=1608</id>
		<title>File:JUMP IN V1.png</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=File:JUMP_IN_V1.png&amp;diff=1608"/>
		<updated>2025-05-09T21:19:51Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1607</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1607"/>
		<updated>2025-05-09T20:43:33Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
 [[File:44net_Globe.png|frameless|center|thumb|350px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1606</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1606"/>
		<updated>2025-05-09T20:43:04Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
 [[File:44net_Globe.png|center|thumb|frameless|350px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1605</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1605"/>
		<updated>2025-05-09T20:41:54Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
 [[File:44net_Globe.png|center|thumb|350px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1604</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1604"/>
		<updated>2025-05-09T20:41:20Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
 [[File:44net_Globe.png|thumb| 250px|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=File:44net_Globe.png&amp;diff=1603</id>
		<title>File:44net Globe.png</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=File:44net_Globe.png&amp;diff=1603"/>
		<updated>2025-05-09T20:39:27Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: Airgapped uploaded a new version of File:44net Globe.png&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1602</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1602"/>
		<updated>2025-05-09T20:37:39Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&amp;lt;!--        Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
 [[File:44net_Globe.png|center|44net Globe]]&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=File:44net_Globe.png&amp;diff=1601</id>
		<title>File:44net Globe.png</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=File:44net_Globe.png&amp;diff=1601"/>
		<updated>2025-05-09T20:36:25Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1600</id>
		<title>User:KI5QKX/LandingPage</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=User:KI5QKX/LandingPage&amp;diff=1600"/>
		<updated>2025-05-09T20:23:36Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div class=&amp;quot;landing-page&amp;quot;&amp;gt;&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section hero-box&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Real IPv4 &amp;lt;br&amp;gt;for real hams.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;p class=&amp;quot;tagline&amp;quot;&amp;gt;Public IPv4 addresses for your projects.&amp;lt;br&amp;gt;&lt;br /&gt;
            Free to use for licensed radio amateurs.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Get Started]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section intro&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net is a global block of IP addresses reserved for licensed amateur radio operators who want to learn, experiment, and create on the real, public Internet.&amp;lt;/p&amp;gt; &lt;br /&gt;
        &amp;lt;p class=&amp;quot;label&amp;quot;&amp;gt;Get Started:&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;button-strip&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;ul&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Portal Sign-in]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|44Net Wiki]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
                &amp;lt;li&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|ARDC.net]]&amp;lt;/span&amp;gt;&amp;lt;/li&amp;gt;&lt;br /&gt;
            &amp;lt;/ul&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-1&amp;quot; style=&amp;quot;clear:both;margin:2em 0;background-color:rgba(40,60,60,0.05);padding:3em;&amp;quot;&amp;gt;&amp;lt;h1&amp;gt;No NAT. Just ’Net.&amp;lt;/h1&amp;gt;&lt;br /&gt;
        &amp;lt;p&amp;gt;44Net IP addresses are public, globally routable, and static — no NAT, no CGNAT. IP as it was meant to be.&amp;lt;/p&amp;gt;&lt;br /&gt;
        [[File:Network_map_illustration.png|center|44Net IP addresses are globally routable. Connected devices can have direct access to the public Internet.]]&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-2&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;By hams, for hams. Worldwide.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;Across the street or around the world — When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio. Got a callsign? Get started.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Sign Up]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
&amp;lt;!--        Was thinking some sort of globe illustration… adam&#039;s spinny globe would be cool if it can be embedded. or maybe a line art illustration based on it. this instance doesn&#039;t have timed media extension installed, would have to be an html video embed or maybe an animated gif. or just a static image. --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    &amp;lt;div class=&amp;quot;section alt-3&amp;quot;&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;left&amp;quot;&amp;gt;&lt;br /&gt;
        maybe a line art illustration here also, for some consistency with above. illustrating chatting? emailing? people interacting and collaborating? there&#039;s loads of cliched stock images of people working together, but they all look so fake. maybe some icons of computers and radios and people?&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
        &amp;lt;div class=&amp;quot;right&amp;quot;&amp;gt;&lt;br /&gt;
            &amp;lt;h1&amp;gt;Jump in, nerd out.&amp;lt;/h1&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;44Net is driven by the efforts of its enthusiastic, talented, and committed volunteers. Where amateur radio, networking, and the Internet meet, odds are good — you’ll find your people.&amp;lt;/p&amp;gt;&lt;br /&gt;
            &amp;lt;p&amp;gt;&amp;lt;span class=&amp;quot;button&amp;quot;&amp;gt;[[GetStarted|Join on Groups.io]]&amp;lt;/span&amp;gt;&amp;lt;/p&amp;gt;&lt;br /&gt;
        &amp;lt;/div&amp;gt;&lt;br /&gt;
    &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--&lt;br /&gt;
Connect, explore, build&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p&amp;gt;Individual IP addresses or larger subnets — request what’s right for your project.&amp;lt;/p&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Get started:&lt;br /&gt;
- Sign up with your callsign, takes minutes&lt;br /&gt;
- Get your callsign and location verified&lt;br /&gt;
- Request an IP address or subnet&lt;br /&gt;
- Connect and explore!&lt;br /&gt;
&lt;br /&gt;
How to Get Connected&lt;br /&gt;
IPIP Mesh&lt;br /&gt;
- Mesh overlay network&lt;br /&gt;
&lt;br /&gt;
BGP&lt;br /&gt;
- Announce a /24 subnet from your ISP or cloud provider&lt;br /&gt;
- Bring your own ASN&lt;br /&gt;
&lt;br /&gt;
VPN (limited beta!)&lt;br /&gt;
- Wireguard tunnel to a 44Net point of presence over almost any network&lt;br /&gt;
- No BGP or ASN needed&lt;br /&gt;
- Home, mobile, or portable stations&lt;br /&gt;
&lt;br /&gt;
Features&lt;br /&gt;
&lt;br /&gt;
No NAT, just Net&lt;br /&gt;
- 44Net IP addresses are real, globally-routable, public IPv4 addresses. No NAT, no port forwarding, no tricks. &lt;br /&gt;
&lt;br /&gt;
By hams, for hams&lt;br /&gt;
- When you access a resource on a 44Net IP, you know it&#039;s provided by a fellow ham in the spirit of amateur radio.&lt;br /&gt;
&lt;br /&gt;
BYO Access&lt;br /&gt;
- Use your own ISP, cloud provider, or home network. Build your network over copper, fiber, or RF. 44Net goes where you go.&lt;br /&gt;
&lt;br /&gt;
What is 44Net?&lt;br /&gt;
44Net is a community-driven IPv4 network for amateur radio operators. It provides a platform for hams to connect, share resources, and experiment with networking technologies. &lt;br /&gt;
&lt;br /&gt;
At the core is a block of IPv4 addresses free for licensed hams to use, available as individual IP addresses or subnets up to /24. Connect to the IPIP Mesg overlay network, or use BGP to announce your own /24 subnet from your ISP or cloud provider. Coming soon, a limited beta of a Wireguard VPN tunnel to a 44Net point of presence over almost any network, no BGP or ASN needed.&lt;br /&gt;
&lt;br /&gt;
Why use it? Who is it for?&lt;br /&gt;
&lt;br /&gt;
44Net provides a way for hams to get IPv4 address space and use it for the kinds of things hams are known for: experimentation, innovation, community, and more. Hams learn, experiment, and build on the airwaves — 44Net lets hams do the same with IP networking.&lt;br /&gt;
&lt;br /&gt;
Why 44Net?&lt;br /&gt;
&lt;br /&gt;
44Net is more than just IP addresses. It&#039;s also a community of hams who are passionate about networking and technology. By joining 44Net, you become part of a network of like-minded individuals who are eager to share knowledge, resources, and experiences.&lt;br /&gt;
&lt;br /&gt;
Get Involved!&lt;br /&gt;
- Contribute to the wiki -- document your projects, share your knowledge, help jump-start others&lt;br /&gt;
- Join the conversation on groups.io&lt;br /&gt;
- Contribute to the code&lt;br /&gt;
&lt;br /&gt;
About ARDC&lt;br /&gt;
&lt;br /&gt;
More links&lt;br /&gt;
&lt;br /&gt;
FAQ&lt;br /&gt;
&lt;br /&gt;
Contributing&lt;br /&gt;
&lt;br /&gt;
License/EULA/Privacy/contact&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=File:Approve-lot-request.png&amp;diff=1353</id>
		<title>File:Approve-lot-request.png</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=File:Approve-lot-request.png&amp;diff=1353"/>
		<updated>2024-10-16T02:15:59Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: Airgapped uploaded a new version of File:Approve-lot-request.png&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Portal_Call_Sign_Verification&amp;diff=1352</id>
		<title>Portal Call Sign Verification</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Portal_Call_Sign_Verification&amp;diff=1352"/>
		<updated>2024-10-16T02:08:01Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: /* License Verification */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= DRAFT - Currently in progress =&lt;br /&gt;
== Verification ==&lt;br /&gt;
=== How to Verify Call Signs ===&lt;br /&gt;
&lt;br /&gt;
== Claim the Ticket ==&lt;br /&gt;
* Click “&#039;&#039;&#039;Preview&#039;&#039;&#039;”&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:John-smith-verify-call-sign-line-in-table.png|750px]]&lt;br /&gt;
* Click “&#039;&#039;&#039;Take Ownership&#039;&#039;&#039;”&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:Ticket-information-7014.png|500px]]&lt;br /&gt;
&lt;br /&gt;
== Verify the Request ==&lt;br /&gt;
* Call sign verification is done by comparing either against an online Government database or from an uploaded copy of their license, to the information that they have in their profile. We are mainly checking if the account has a valid call sign associated.  To help with their next step of address verification, if information included on their license is missing from their profile, leave a friendly reminder and ask them to update their portal profile to include missing information from their license, most specifically their address.&lt;br /&gt;
* If you’re not able to verify via database - respond to the ticket and request that the user upload a copy of their license. You can use the comment: “Hello, we were unable to verify your call sign using publicly-available databases. Please upload a valid copy of your license.”&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;STEPS&#039;&#039;&#039;:&lt;br /&gt;
* Automatic Lookup. For some regions, we have a have license verification tool for call sign lookup to help with verification. &lt;br /&gt;
* Manually look up the call sign in a database and determine if it meets standards. &lt;br /&gt;
** Minimal Verification will be:&lt;br /&gt;
*** Is it a valid call sign?&lt;br /&gt;
*** Full Name - First and Last (given name)&lt;br /&gt;
* If the call sign is for an organization: &lt;br /&gt;
** Reply back to the applicant, ask if this is solely for their own use.  &lt;br /&gt;
*** If they apply that they are the only one, you can add this call sign with their individual account.  &lt;br /&gt;
*** If they say this call sign is used for multiple individuals, they should apply as an organization. Refer to [[Organizations in the Portal]] for more details.&lt;br /&gt;
&lt;br /&gt;
Note that AMPRNet (Pri) is set as the default organization for all accounts.&lt;br /&gt;
&lt;br /&gt;
* If able to verify - click approve.&lt;br /&gt;
* Add a comment along the lines of “Verified name, email and address in [X database].”&lt;br /&gt;
* Do not include any personal identifying information (PII) in this field.&lt;br /&gt;
&lt;br /&gt;
== Look Up Call Sign ==&lt;br /&gt;
The Portal has a call sign lookup for some locations. If the user hasn’t uploaded a license, we&#039;re going to check the call sign lookup first.&lt;br /&gt;
&lt;br /&gt;
Click the users call sign as shown below (beside &#039;Call sign lookup&#039;).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:Ticket-information-call-sign-lookup.png|500px]]&lt;br /&gt;
&lt;br /&gt;
* If there is information in the lookup (see below), we can use the provided information to compare to the user&#039;s Portal profile&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:Call-sign-lookup-for-verification.png|500px]]&lt;br /&gt;
&lt;br /&gt;
* Click “&#039;&#039;&#039;View&#039;&#039;&#039;” to continue. This will bring you to the call sign lookup detail described in the next section.&lt;br /&gt;
&lt;br /&gt;
== Compare Call Sign Information ==&lt;br /&gt;
&#039;&#039;&#039;&#039;&#039;Next, we’re going to compare information from the call sign lookup detail to information in the member&#039;s profile.&#039;&#039;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* Below is the call sign detail returned from the call sign lookup described in the section above.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:Detail.png|500px]]&lt;br /&gt;
&lt;br /&gt;
* On the ticket, click the name listed to the right of the &#039;&#039;&#039;&amp;quot;Member&amp;quot;&#039;&#039;&#039; field.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:Ticket-information-call-sign-lookup.png|500px]]&lt;br /&gt;
&lt;br /&gt;
* This will bring you to the member&#039;s profile details, where the name in the profile should match the name returned from the call sign lookup.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:Section-of-profile.png|500px]]&lt;br /&gt;
&lt;br /&gt;
== License Verification ==&lt;br /&gt;
&#039;&#039;&#039;&#039;&#039;Some license verification information is available here. For example, it will help you in identifying unfamiliar license call sign prefixes and other available information. If there isn&#039;t help information, you will receive a message as seen below.&#039;&#039;&#039;&#039;&#039;&lt;br /&gt;
* Click “&#039;&#039;&#039;License Verification&#039;&#039;&#039;”&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:Ticket-information-call-sign-lookup.png|500px]]&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:License-verification-not-found.png|500px]]&lt;br /&gt;
&lt;br /&gt;
== Approve, Reply, or Reject ==&lt;br /&gt;
* &#039;&#039;&#039;IF&#039;&#039;&#039; the user has uploaded a license to verify against, and all looks in order, add a welcoming reply, and click “&#039;&#039;&#039;Accept&#039;&#039;&#039;” to approve request&lt;br /&gt;
* &#039;&#039;&#039;IF&#039;&#039;&#039; any information is missing or doesn’t match, reply with a message detailing what’s missing and keep the ticket open. (Keep an eye out for future updates on ticket)&lt;br /&gt;
* &#039;&#039;&#039;IF&#039;&#039;&#039; information in Portal profile doesn’t match their call sign information from on line or uploaded license, send a reply requesting a reason for discrepancy. Ask them to correct if discrepancy was in error. &lt;br /&gt;
* &#039;&#039;&#039;IF&#039;&#039;&#039; the request is suspected to be fraudulent, provide a polite response, letting them know reason you will not approve the request, and that you will be closing the ticket. &#039;&#039;&amp;lt;u&amp;gt;(Do not close the ticket without giving them an explanation)&amp;lt;/u&amp;gt;&#039;&#039;&lt;br /&gt;
  &lt;br /&gt;
In all cases, remind users that if they believe their ticket was closed in error, they should feel free to open a new ticket.&lt;br /&gt;
&lt;br /&gt;
Aim for a user-friendly and easy process. Give users the benefit of the doubt and provide a clear path to fix errors. Focus on protecting against intentional fraud rather than conducting an overly strict review. &lt;br /&gt;
&lt;br /&gt;
(Make sure to click “&#039;&#039;&#039;Add Reply&#039;&#039;&#039;” to upload/post your message) &lt;br /&gt;
&lt;br /&gt;
=== Approve Request ===&lt;br /&gt;
* Click “&#039;&#039;&#039;Approve&#039;&#039;&#039;”&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:Ticket-information-call-sign-lookup.png|500px]]&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:Approve-lot-request.png|500px]]&lt;br /&gt;
* Add &#039;&#039;&#039;Notes&#039;&#039;&#039;: Provide brief summary of how you verified the call sign&lt;br /&gt;
* Click “&#039;&#039;&#039;Approve&#039;&#039;&#039;”&lt;br /&gt;
&#039;&#039;&#039;You&#039;re Done!! Grab the next Ticket&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
=== Reject Request ===&lt;br /&gt;
* Click “&#039;&#039;&#039;Reject&#039;&#039;&#039;&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:Ticket-information-call-sign-lookup.png|500px]]&lt;br /&gt;
&amp;lt;br&amp;gt;[[File:Reject-lot-request.png|500px]]&lt;br /&gt;
* Add &#039;&#039;&#039;Notes&#039;&#039;&#039;: Provide brief summary of why you rejected the verification&lt;br /&gt;
* Click “&#039;&#039;&#039;Confirm rejection&#039;&#039;&#039;”&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;You&#039;re Done!! Grab the next Ticket&#039;&#039;&#039;&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Archive/Main_Page&amp;diff=1301</id>
		<title>Archive/Main Page</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Archive/Main_Page&amp;diff=1301"/>
		<updated>2024-10-10T20:26:47Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Welcome to the AMPRNet Wiki.&lt;br /&gt;
&lt;br /&gt;
44Net is shorthand for Internet network 44 (44.0.0.0/9 &amp;amp; 44.128.0.0/10), also known as AMPRNet. Since its allocation to amateur radio in the mid-1980s, the network has been used by amateur radio operators to conduct scientific research and to experiment with digital communications over radio. The goals are to of advance the state of the art of Amateur Radio networking, and to educate amateur radio operators in these techniques.&lt;br /&gt;
&lt;br /&gt;
To request an assignment of IPv4 addresses see below.&lt;br /&gt;
&lt;br /&gt;
__NOTOC__&lt;br /&gt;
== Starting points ==&lt;br /&gt;
* [[Quickstart]] guide for getting onto the 44Net&lt;br /&gt;
* Basic information about 44Net and the [[ampr.org]] domain&lt;br /&gt;
* [[Services]] available on 44Net&lt;br /&gt;
* If you are looking to get an IP assignment from ARDC please read the [[Portal]] page.&lt;br /&gt;
* Frequently Asked Questions (FAQ) [[FAQ]]&lt;br /&gt;
* [[Getting started with Linux and packet radio]]&lt;br /&gt;
* [[Networks that use 44Net]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Portal How To&#039;s ==&lt;br /&gt;
* Portal Introduction [[Portal intro]]&lt;br /&gt;
* Organization Setup [[Organizations in the Portal]]&lt;br /&gt;
&lt;br /&gt;
== How to connect to the 44Net ==&lt;br /&gt;
&lt;br /&gt;
* Instructions for [[Setting up a gateway on Linux|setting up a Linux gateway]]&lt;br /&gt;
* Instructions for [[setting up a gateway on MikroTik Routers|setting up a gateway on MikroTik Routers running ROS6]].&lt;br /&gt;
* Instructions for [[Setting up a gateway in a ROS7 Mikrotik router container on arm32 arm64 and x86-64|setting up a gateway on MikroTik Routers running ROS7 using a container on arm32, arm64 and x86-64]]&lt;br /&gt;
* Instructions for [[Setting up a gateway on OpenBSD|setting up an OpenBSD gateway]]&lt;br /&gt;
* Instructions for [[setting up a gateway on Cisco Routers|setting up a  gateway on Cisco Routers]].&lt;br /&gt;
* Instructions for [[setting up a gateway on OpenWRT|setting up a gateway on OpenWRT]].&lt;br /&gt;
* Instructions for [[setting up a gateway on Ubiquiti EdgeRouter|setting up a gateway on Ubiquiti EdgeRouter]].&lt;br /&gt;
* Instructions for [[setting up a gateway on a VyOS instance|setting up a gateway on a VyOS instance]].&lt;br /&gt;
* Instructions for [[Installing ampr-ripd on a Ubiquiti EdgeRouter or EdgeRouter X|Installing ampr-ripd on a Ubiquiti EdgeRouter or EdgeRouter X]].&lt;br /&gt;
* Instructions for [[Announcing_your_allocation_directly|directly announcing your assignment via your Internet Service Provider (ISP)]].&lt;br /&gt;
* Instructions for [[OH7LZB_VPN|Accessing 44Net via VPN]] (experimental).&lt;br /&gt;
* &amp;lt;b&amp;gt;[[Why can&#039;t I just route my AMPRNet allocation directly myself ?]]&amp;lt;/b&amp;gt;&lt;br /&gt;
* If you already operate a [[gateway]] please ensure you have registered on the [[portal]] and &amp;quot;claimed&amp;quot; your [[gateway]].&lt;br /&gt;
* After your gateway is operational, consider &#039;&#039;&#039;[[Firewalls]]&#039;&#039;&#039; and other best practices&lt;br /&gt;
&lt;br /&gt;
== Groups.io ==&lt;br /&gt;
We are now on Groups.io  Please consider joining https://ardc.groups.io/g/44net&lt;br /&gt;
&lt;br /&gt;
== Mailing List ==&lt;br /&gt;
To keep up-to-date on AMPRNet information please consider joining the [[44Net mailing list]].&lt;br /&gt;
&lt;br /&gt;
== Contribute! ==&lt;br /&gt;
If you wish to contribute to the wiki, please send an email to &amp;lt;tt&amp;gt;wiki (at) ampr.org&amp;lt;/tt&amp;gt; introducing yourself. Please specify your full name and your amateur radio callsign. A login will then be created for you.&lt;br /&gt;
&lt;br /&gt;
== Terms of Service ==&lt;br /&gt;
Use of AMPRNet address space is governed by these [https://www.ampr.org/terms-of-service/ Terms of Service]&lt;br /&gt;
&lt;br /&gt;
== Other useful features ==&lt;br /&gt;
* Instruction on using the [[ampr-map]] position reporting&lt;br /&gt;
&lt;br /&gt;
== All Pages ==&lt;br /&gt;
[https://wiki.ampr.org/wiki/Special:AllPages Here&#039;s a list of all pages currently on the 44Net Wiki]&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Archive/Main_Page&amp;diff=1300</id>
		<title>Archive/Main Page</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Archive/Main_Page&amp;diff=1300"/>
		<updated>2024-10-10T20:25:34Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Welcome to the AMPRNet Wiki.&lt;br /&gt;
&lt;br /&gt;
44Net is shorthand for Internet network 44 (44.0.0.0/9 &amp;amp; 44.128.0.0/10), also known as AMPRNet. Since its allocation to amateur radio in the mid-1980s, the network has been used by amateur radio operators to conduct scientific research and to experiment with digital communications over radio. The goals are to of advance the state of the art of Amateur Radio networking, and to educate amateur radio operators in these techniques.&lt;br /&gt;
&lt;br /&gt;
To request an assignment of IPv4 addresses see below.&lt;br /&gt;
&lt;br /&gt;
__NOTOC__&lt;br /&gt;
== Starting points ==&lt;br /&gt;
* [[Quickstart]] guide for getting onto the 44Net&lt;br /&gt;
* Basic information about 44Net and the [[ampr.org]] domain&lt;br /&gt;
* [[Services]] available on 44Net&lt;br /&gt;
* If you are looking to get an IP assignment from ARDC please read the [[Portal]] page.&lt;br /&gt;
* Frequently Asked Questions (FAQ) [[FAQ]]&lt;br /&gt;
* [[Getting started with Linux and packet radio]]&lt;br /&gt;
* [[Networks that use 44Net]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Portal How To&#039;s ==&lt;br /&gt;
* Portal Introduction [[Portal intro]]&lt;br /&gt;
&lt;br /&gt;
== How to connect to the 44Net ==&lt;br /&gt;
&lt;br /&gt;
* Instructions for [[Setting up a gateway on Linux|setting up a Linux gateway]]&lt;br /&gt;
* Instructions for [[setting up a gateway on MikroTik Routers|setting up a gateway on MikroTik Routers running ROS6]].&lt;br /&gt;
* Instructions for [[Setting up a gateway in a ROS7 Mikrotik router container on arm32 arm64 and x86-64|setting up a gateway on MikroTik Routers running ROS7 using a container on arm32, arm64 and x86-64]]&lt;br /&gt;
* Instructions for [[Setting up a gateway on OpenBSD|setting up an OpenBSD gateway]]&lt;br /&gt;
* Instructions for [[setting up a gateway on Cisco Routers|setting up a  gateway on Cisco Routers]].&lt;br /&gt;
* Instructions for [[setting up a gateway on OpenWRT|setting up a gateway on OpenWRT]].&lt;br /&gt;
* Instructions for [[setting up a gateway on Ubiquiti EdgeRouter|setting up a gateway on Ubiquiti EdgeRouter]].&lt;br /&gt;
* Instructions for [[setting up a gateway on a VyOS instance|setting up a gateway on a VyOS instance]].&lt;br /&gt;
* Instructions for [[Installing ampr-ripd on a Ubiquiti EdgeRouter or EdgeRouter X|Installing ampr-ripd on a Ubiquiti EdgeRouter or EdgeRouter X]].&lt;br /&gt;
* Instructions for [[Announcing_your_allocation_directly|directly announcing your assignment via your Internet Service Provider (ISP)]].&lt;br /&gt;
* Instructions for [[OH7LZB_VPN|Accessing 44Net via VPN]] (experimental).&lt;br /&gt;
* &amp;lt;b&amp;gt;[[Why can&#039;t I just route my AMPRNet allocation directly myself ?]]&amp;lt;/b&amp;gt;&lt;br /&gt;
* If you already operate a [[gateway]] please ensure you have registered on the [[portal]] and &amp;quot;claimed&amp;quot; your [[gateway]].&lt;br /&gt;
* After your gateway is operational, consider &#039;&#039;&#039;[[Firewalls]]&#039;&#039;&#039; and other best practices&lt;br /&gt;
&lt;br /&gt;
== Groups.io ==&lt;br /&gt;
We are now on Groups.io  Please consider joining https://ardc.groups.io/g/44net&lt;br /&gt;
&lt;br /&gt;
== Mailing List ==&lt;br /&gt;
To keep up-to-date on AMPRNet information please consider joining the [[44Net mailing list]].&lt;br /&gt;
&lt;br /&gt;
== Contribute! ==&lt;br /&gt;
If you wish to contribute to the wiki, please send an email to &amp;lt;tt&amp;gt;wiki (at) ampr.org&amp;lt;/tt&amp;gt; introducing yourself. Please specify your full name and your amateur radio callsign. A login will then be created for you.&lt;br /&gt;
&lt;br /&gt;
== Terms of Service ==&lt;br /&gt;
Use of AMPRNet address space is governed by these [https://www.ampr.org/terms-of-service/ Terms of Service]&lt;br /&gt;
&lt;br /&gt;
== Other useful features ==&lt;br /&gt;
* Instruction on using the [[ampr-map]] position reporting&lt;br /&gt;
&lt;br /&gt;
== All Pages ==&lt;br /&gt;
[https://wiki.ampr.org/wiki/Special:AllPages Here&#039;s a list of all pages currently on the 44Net Wiki]&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Archive/Main_Page&amp;diff=1299</id>
		<title>Archive/Main Page</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Archive/Main_Page&amp;diff=1299"/>
		<updated>2024-10-10T20:24:22Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Welcome to the AMPRNet Wiki.&lt;br /&gt;
&lt;br /&gt;
44Net is shorthand for Internet network 44 (44.0.0.0/9 &amp;amp; 44.128.0.0/10), also known as AMPRNet. Since its allocation to amateur radio in the mid-1980s, the network has been used by amateur radio operators to conduct scientific research and to experiment with digital communications over radio. The goals are to of advance the state of the art of Amateur Radio networking, and to educate amateur radio operators in these techniques.&lt;br /&gt;
&lt;br /&gt;
To request an assignment of IPv4 addresses see below.&lt;br /&gt;
&lt;br /&gt;
__NOTOC__&lt;br /&gt;
== Starting points ==&lt;br /&gt;
* [[Quickstart]] guide for getting onto the 44Net&lt;br /&gt;
* Basic information about 44Net and the [[ampr.org]] domain&lt;br /&gt;
* [[Services]] available on 44Net&lt;br /&gt;
* If you are looking to get an IP assignment from ARDC please read the [[Portal]] page.&lt;br /&gt;
* Frequently Asked Questions (FAQ) [[FAQ]]&lt;br /&gt;
* [[Getting started with Linux and packet radio]]&lt;br /&gt;
* [[Networks that use 44Net]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Portal How To&#039;s ==&lt;br /&gt;
&lt;br /&gt;
== How to connect to the 44Net ==&lt;br /&gt;
&lt;br /&gt;
* Instructions for [[Setting up a gateway on Linux|setting up a Linux gateway]]&lt;br /&gt;
* Instructions for [[setting up a gateway on MikroTik Routers|setting up a gateway on MikroTik Routers running ROS6]].&lt;br /&gt;
* Instructions for [[Setting up a gateway in a ROS7 Mikrotik router container on arm32 arm64 and x86-64|setting up a gateway on MikroTik Routers running ROS7 using a container on arm32, arm64 and x86-64]]&lt;br /&gt;
* Instructions for [[Setting up a gateway on OpenBSD|setting up an OpenBSD gateway]]&lt;br /&gt;
* Instructions for [[setting up a gateway on Cisco Routers|setting up a  gateway on Cisco Routers]].&lt;br /&gt;
* Instructions for [[setting up a gateway on OpenWRT|setting up a gateway on OpenWRT]].&lt;br /&gt;
* Instructions for [[setting up a gateway on Ubiquiti EdgeRouter|setting up a gateway on Ubiquiti EdgeRouter]].&lt;br /&gt;
* Instructions for [[setting up a gateway on a VyOS instance|setting up a gateway on a VyOS instance]].&lt;br /&gt;
* Instructions for [[Installing ampr-ripd on a Ubiquiti EdgeRouter or EdgeRouter X|Installing ampr-ripd on a Ubiquiti EdgeRouter or EdgeRouter X]].&lt;br /&gt;
* Instructions for [[Announcing_your_allocation_directly|directly announcing your assignment via your Internet Service Provider (ISP)]].&lt;br /&gt;
* Instructions for [[OH7LZB_VPN|Accessing 44Net via VPN]] (experimental).&lt;br /&gt;
* &amp;lt;b&amp;gt;[[Why can&#039;t I just route my AMPRNet allocation directly myself ?]]&amp;lt;/b&amp;gt;&lt;br /&gt;
* If you already operate a [[gateway]] please ensure you have registered on the [[portal]] and &amp;quot;claimed&amp;quot; your [[gateway]].&lt;br /&gt;
* After your gateway is operational, consider &#039;&#039;&#039;[[Firewalls]]&#039;&#039;&#039; and other best practices&lt;br /&gt;
&lt;br /&gt;
== Groups.io ==&lt;br /&gt;
We are now on Groups.io  Please consider joining https://ardc.groups.io/g/44net&lt;br /&gt;
&lt;br /&gt;
== Mailing List ==&lt;br /&gt;
To keep up-to-date on AMPRNet information please consider joining the [[44Net mailing list]].&lt;br /&gt;
&lt;br /&gt;
== Contribute! ==&lt;br /&gt;
If you wish to contribute to the wiki, please send an email to &amp;lt;tt&amp;gt;wiki (at) ampr.org&amp;lt;/tt&amp;gt; introducing yourself. Please specify your full name and your amateur radio callsign. A login will then be created for you.&lt;br /&gt;
&lt;br /&gt;
== Terms of Service ==&lt;br /&gt;
Use of AMPRNet address space is governed by these [https://www.ampr.org/terms-of-service/ Terms of Service]&lt;br /&gt;
&lt;br /&gt;
== Other useful features ==&lt;br /&gt;
* Instruction on using the [[ampr-map]] position reporting&lt;br /&gt;
&lt;br /&gt;
== All Pages ==&lt;br /&gt;
[https://wiki.ampr.org/wiki/Special:AllPages Here&#039;s a list of all pages currently on the 44Net Wiki]&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Archive/Main_Page&amp;diff=1298</id>
		<title>Archive/Main Page</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Archive/Main_Page&amp;diff=1298"/>
		<updated>2024-10-10T20:03:23Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Welcome to the AMPRNet Wiki.&lt;br /&gt;
&lt;br /&gt;
44Net is shorthand for Internet network 44 (44.0.0.0/9 &amp;amp; 44.128.0.0/10), also known as AMPRNet. Since its allocation to amateur radio in the mid-1980s, the network has been used by amateur radio operators to conduct scientific research and to experiment with digital communications over radio. The goals are to of advance the state of the art of Amateur Radio networking, and to educate amateur radio operators in these techniques.&lt;br /&gt;
&lt;br /&gt;
To request an assignment of IPv4 addresses see below.&lt;br /&gt;
&lt;br /&gt;
__NOTOC__&lt;br /&gt;
== Starting points ==&lt;br /&gt;
* [[Quickstart]] guide for getting onto the 44Net&lt;br /&gt;
* Basic information about 44Net and the [[ampr.org]] domain&lt;br /&gt;
* [[Services]] available on 44Net&lt;br /&gt;
* If you are looking to get an IP assignment from ARDC please read the [[Portal]] page.&lt;br /&gt;
* Frequently Asked Questions (FAQ) [[FAQ]]&lt;br /&gt;
* [[Getting started with Linux and packet radio]]&lt;br /&gt;
* [[Networks that use 44Net]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Portal How To ==&lt;br /&gt;
&lt;br /&gt;
== How to connect to the 44Net ==&lt;br /&gt;
&lt;br /&gt;
* Instructions for [[Setting up a gateway on Linux|setting up a Linux gateway]]&lt;br /&gt;
* Instructions for [[setting up a gateway on MikroTik Routers|setting up a gateway on MikroTik Routers running ROS6]].&lt;br /&gt;
* Instructions for [[Setting up a gateway in a ROS7 Mikrotik router container on arm32 arm64 and x86-64|setting up a gateway on MikroTik Routers running ROS7 using a container on arm32, arm64 and x86-64]]&lt;br /&gt;
* Instructions for [[Setting up a gateway on OpenBSD|setting up an OpenBSD gateway]]&lt;br /&gt;
* Instructions for [[setting up a gateway on Cisco Routers|setting up a  gateway on Cisco Routers]].&lt;br /&gt;
* Instructions for [[setting up a gateway on OpenWRT|setting up a gateway on OpenWRT]].&lt;br /&gt;
* Instructions for [[setting up a gateway on Ubiquiti EdgeRouter|setting up a gateway on Ubiquiti EdgeRouter]].&lt;br /&gt;
* Instructions for [[setting up a gateway on a VyOS instance|setting up a gateway on a VyOS instance]].&lt;br /&gt;
* Instructions for [[Installing ampr-ripd on a Ubiquiti EdgeRouter or EdgeRouter X|Installing ampr-ripd on a Ubiquiti EdgeRouter or EdgeRouter X]].&lt;br /&gt;
* Instructions for [[Announcing_your_allocation_directly|directly announcing your assignment via your Internet Service Provider (ISP)]].&lt;br /&gt;
* Instructions for [[OH7LZB_VPN|Accessing 44Net via VPN]] (experimental).&lt;br /&gt;
* &amp;lt;b&amp;gt;[[Why can&#039;t I just route my AMPRNet allocation directly myself ?]]&amp;lt;/b&amp;gt;&lt;br /&gt;
* If you already operate a [[gateway]] please ensure you have registered on the [[portal]] and &amp;quot;claimed&amp;quot; your [[gateway]].&lt;br /&gt;
* After your gateway is operational, consider &#039;&#039;&#039;[[Firewalls]]&#039;&#039;&#039; and other best practices&lt;br /&gt;
&lt;br /&gt;
== Groups.io ==&lt;br /&gt;
We are now on Groups.io  Please consider joining https://ardc.groups.io/g/44net&lt;br /&gt;
&lt;br /&gt;
== Mailing List ==&lt;br /&gt;
To keep up-to-date on AMPRNet information please consider joining the [[44Net mailing list]].&lt;br /&gt;
&lt;br /&gt;
== Contribute! ==&lt;br /&gt;
If you wish to contribute to the wiki, please send an email to &amp;lt;tt&amp;gt;wiki (at) ampr.org&amp;lt;/tt&amp;gt; introducing yourself. Please specify your full name and your amateur radio callsign. A login will then be created for you.&lt;br /&gt;
&lt;br /&gt;
== Terms of Service ==&lt;br /&gt;
Use of AMPRNet address space is governed by these [https://www.ampr.org/terms-of-service/ Terms of Service]&lt;br /&gt;
&lt;br /&gt;
== Other useful features ==&lt;br /&gt;
* Instruction on using the [[ampr-map]] position reporting&lt;br /&gt;
&lt;br /&gt;
== All Pages ==&lt;br /&gt;
[https://wiki.ampr.org/wiki/Special:AllPages Here&#039;s a list of all pages currently on the 44Net Wiki]&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
	<entry>
		<id>https://wiki.ampr.org/w/index.php?title=Setting_up_a_gateway_on_Linux&amp;diff=994</id>
		<title>Setting up a gateway on Linux</title>
		<link rel="alternate" type="text/html" href="https://wiki.ampr.org/w/index.php?title=Setting_up_a_gateway_on_Linux&amp;diff=994"/>
		<updated>2023-03-08T23:41:04Z</updated>

		<summary type="html">&lt;p&gt;Airgapped: Link no longer Active, find new link or create.&amp;gt;&amp;gt;  &amp;quot;John Martin KF8KK has written a [http://kf8kk.com/packet/jnos-linux/linux-jnos-setup-1.htm Linux - Jnos Setup and Configuration HOW-TO]. &amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;There are a few different ways to run an AMPRnet gateway on a Linux system. Each has some benefits, so you&#039;ll need to pick your favourite.&lt;br /&gt;
&lt;br /&gt;
Before configuring the Linux gateway you&#039;ll need to:&lt;br /&gt;
# Using the [[Portal]], obtain your AMPRnet IP addresses from a regional coordinator.&lt;br /&gt;
# Obtain a public static IP address for your gateway. &lt;br /&gt;
# Using the [[Portal]], create an entry for your gateway.&lt;br /&gt;
# Get some of your AMPRNet IP addresses registered in the [[ampr.org]] DNS.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= Flavours of Linux gateways =&lt;br /&gt;
&lt;br /&gt;
== Native Linux kernel AX.25 and IPIP tunneling ==&lt;br /&gt;
&lt;br /&gt;
Linux contains the necessary building blocks for a gateway without much added software. Radio interfaces are configured much like any other network interfaces such as Ethernet, they&#039;re just given amateur radio callsigns in addition to an IP address (callsign will act the role of the Ethernet MAC address). If you&#039;re familiar with Linux configuration but have not heard of NOS, or if you wish to go with minimal amount of moving parts, this would probably be your choice.&lt;br /&gt;
&lt;br /&gt;
Setting up a native Linux gateway consists of two main steps:&lt;br /&gt;
&lt;br /&gt;
=== Step 1: Setting up tunnel routing to the rest of the AMPRnet===&lt;br /&gt;
Configuring your Linux system to learn about other AMPRNet [[gateway| gateways]] can be done two ways:&lt;br /&gt;
&lt;br /&gt;
# Automatically learn about other gateways via modified RIPv2 advertisements. Two popular programs to do this are:&lt;br /&gt;
## Using [[ampr-ripd]], a C based routing daemon&lt;br /&gt;
## Using [[rip44d]], a PERL based routing daemon&lt;br /&gt;
# Manually Downloading the [[encap.txt]] file using FTP and setting up routes using a [[munge script]] is the traditional method&lt;br /&gt;
&lt;br /&gt;
====Example Gateway Configuration Instructions====&lt;br /&gt;
* [[Ubuntu Linux Gateway Example]]&lt;br /&gt;
* [http://www.qsl.net/k/kb9mwr//wapr/tcpip/ampr-ripd.html Two Interface Debian Linux Amprnet Gateway Example]&lt;br /&gt;
* [https://k7ilo.blogspot.com/p/server-setup.html K7ILO&#039;S Two Interface Debian 11 AmprNet Gateway Build in layman&#039;s terms]&lt;br /&gt;
&lt;br /&gt;
=== Step 2: Setting up radio interfaces in Linux===&lt;br /&gt;
&lt;br /&gt;
* [http://www.tldp.org/HOWTO/AX25-HOWTO/ Linux AX.25 set-up]&lt;br /&gt;
* 802.11 WiFi on amateur frequencies (2.4 or 5 GHz) is a new popular way to set up fast links.&lt;br /&gt;
&lt;br /&gt;
== Running JNOS (or other NOS) on top of Linux ==&lt;br /&gt;
&lt;br /&gt;
If you&#039;re already familiar with running NOS on top of DOS or Linux, or wish to keep the AMPRnet IP packet routing away from the host Linux system, it might make sense to run JNOS as an application on top of Linux.&lt;br /&gt;
&lt;br /&gt;
The downside is that it&#039;ll have a slightly higher overhead (consumed memory and CPU), and you&#039;ll have two IP routers running on top of each other instead of just one, which is seen as slightly complicated by some.&lt;br /&gt;
&lt;br /&gt;
The upside is that you&#039;ll also get the JNOS BBS-type features, and some other traditional services without installing additional software on top.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=See also=&lt;br /&gt;
&lt;br /&gt;
* [[Ubuntu Linux Gateway Example]]&lt;br /&gt;
* [[startampr]]&lt;/div&gt;</summary>
		<author><name>Airgapped</name></author>
	</entry>
</feed>