44Net Wiki - User contributions [en]

Provisioning Methods

2026-10-19T15:29:45Z

KI5QKX: mw push

{{DISPLAYTITLE:Provisioning Methods}}

44Net provides address resources and ways to connect amateur radio projects. You can use a service that supplies connectivity, participate in a community network, or request address space for a network whose connectivity you arrange.

This page helps you choose what your project needs and where to start. New here? See [[GetStarted|Getting started]] for account setup.

== IP networks and connectivity ==

=== 44Net Connect ===

[[44Net Connect]] gives your device or network public IP addresses through a WireGuard tunnel over your existing Internet connection. ARDC operates the Connect endpoints; you maintain your device or gateway, its routing, and its firewall.

'''Includes:''' Addresses and a WireGuard tunnel, with routed subnets available through the Connect dashboard. You do not need to request address space separately in the Portal before creating a tunnel.

'''Requirements:''' Internet access and a device or router that supports WireGuard. Connect works behind NAT and CGNAT, provided your connection allows WireGuard traffic to reach the endpoint.

'''Start here:''' [[44Net Connect|Choose a single-device or routed-subnet setup]], then sign in to the [https://connect.44net.cloud/ Connect dashboard] with your Portal account.

=== IPIP Mesh ===

The [[IPIP Mesh]] connects participating amateur radio networks through IP-in-IP tunnels. You can operate your own gateway or ask an existing participating network about connecting through its infrastructure. ARDC supports the Mesh and operates a shared Internet gateway; participants operate their own gateways and networks.

'''Includes:''' An address assignment for Mesh use. For your own gateway, you register its endpoint and subnet in the Portal and configure tunnels and routes to other Mesh networks.

'''Requirements:''' An IPIP-capable gateway, a reachable public IPv4 endpoint, and an Internet connection that permits IPIP (IP protocol 4). NAT and CGNAT are not supported. The Mesh does not provide general-purpose Internet access; see its overview for the limits of the shared Internet gateway.

'''Start here:''' [[IPIP Mesh|Check the requirements and choose how to participate]]. For your own gateway, [[Portal/Request Address Space|request a Mesh address assignment]] in the Portal.

== Address space and registration ==

=== Connectivity you arrange ===

If you are building a network with your own connectivity, you can request 44Net address space for it. ARDC maintains the assignment and provides routing authorization where applicable. You and your network or upstream provider arrange how traffic reaches the addresses.

'''Includes:''' An IP address assignment, a Letter of Authorization (LOA) for BGP announcements where applicable, and optional reverse DNS delegation.

'''Requirements:''' A network plan and your own connectivity. For a BGP-announced subnet, you need an upstream or routing arrangement that can announce it. Your provider may announce on your behalf, or you may operate BGP yourself, depending on that arrangement.

'''Start here:''' [[Portal/Request Address Space|Request address space in the Portal]]. For Internet routing through a provider, read the [[BGP|BGP overview]] and [[BGP/Quick Start|BGP Quick Start]] before requesting service from an upstream. You may also want to review the [[Guide for ISPs|Guide for ISPs]].

For these independently connected assignments, ARDC provides address resources and authorization. You and your provider are responsible for connectivity, routing, and transit.

If you are joining an existing network, ask its operators how addresses and routing are arranged before requesting a separate assignment.

== Supporting services ==

=== DNS ===

[[DNS]] gives names to your devices and services. You can request an ampr.org subdomain for your callsign, or a club or organization subdomain subject to review, and manage records beneath it.

DNS can support projects using Connect, the Mesh, or independently arranged connectivity. A and AAAA records can point to addresses outside 44Net as well as to 44Net addresses.

Reverse DNS for an address assignment is a separate facility from a callsign subdomain. Reverse DNS for 44Net Connect is not currently available.

Reverse DNS delegation for eligible BGP subnets is available by request; [[DNS/Portal/Delegations#Reverse DNS (rDNS)|check the delegation requirements]] and open a support ticket in the Portal.

'''Start here:''' [[DNS/Portal/Subdomains|Request and manage a subdomain in the Portal]].

== Joining an existing project ==

You may be able to participate through an independently operated network or project. Its operators determine how you join, what connectivity they provide, and what equipment or resources you need. Ask them whether you should request your own address assignment before applying for one.

Independently operated networks such as HAMNET and HAMGATE use 44Net resources. Networks built with AREDN can also use 44Net addresses; ask the local operators what their network supports.

== Choosing for your project ==

=== If you want… ===

'''A public address for a device or small network over an existing Internet connection:'''

Start with [[44Net Connect]]. It can work behind NAT and CGNAT.

'''Communication with networks on the IPIP Mesh:'''

Check the [[IPIP Mesh|Mesh requirements]], or ask a participating network about joining through it.

'''Addresses for a network whose connectivity you arrange:'''

[[Portal/Request Address Space|Request address space]]. If an upstream will announce it to the Internet, follow the [[BGP/Quick Start|BGP guide]].

'''Names for your devices or services:'''

Use [[DNS]] alongside the connection you choose.

These choices describe what your project needs, not a sequence of upgrades. A project may use more than one. Using 44Net addresses does not automatically make systems reachable from every other 44Net network; reachability depends on routing, service arrangements, and firewall rules.

== Learn more ==

* [[Portal/Introduction|Managing resources in the Portal]]
* [[Routing|Routing and connectivity]]
* [[Internet Requirements|Internet connection requirements]]
* [[Get Help|Getting help]]

[[Category:Explanation]]
[[Category:Participation Methods]]

MediaWiki:Common.css

2026-10-06T03:12:03Z

KI5QKX: Allow Vector header to fit mobile screen widths

/* CSS placed here will be applied to all skins */

/* Let the Vector header fit mobile screens below its 500px minimum. */
@media screen and (max-width: 999px) {
.skin-vector-2022.skin--responsive .vector-header-container .mw-header {
min-width: 0;
}
}

/* Keep images from escaping their enclosures */
img {
max-width: 100%;
height: auto;
}

/* Main page overrides */
body.page-Main_Page main header.mw-body-header,
body.page-Main_Page div.vector-page-toolbar {
display: none;
}

/* --- Legacy landing page styles (keep as-is until you retire it) --- */

.landing-page .section span.button a {
display: inline-block;
padding: 0.5em 1.5em;
background-color: rgb(177, 224, 223);
color: black;
text-decoration: none;
border-radius: 5px;
font-size: 1rem;
font-weight: bold;
}

.landing-page .section h1,
.landing-page .section h2 {
font-family: Arial, Helvetica, sans-serif !important;
font-weight: bold;
border: 0;
padding: 0;
display: block;
}
.landing-page .section h1 { margin: 0; }
.landing-page .section h2 { margin: 0 0 0.55em 0; }

/* Section box base */
.landing-page .section {
display: flex;
flex-wrap: wrap;
align-items: center;
margin: 8em 0;
padding-right: 3em;
}
.landing-page .section > div { padding: 2em 0; }
.landing-page .section .left { flex: 3; min-width: 350px; }
.landing-page .section .right { flex: 2; min-width: 350px; }
.landing-page .section p { font-size: 1.2rem; }

/* Hero box overrides */
.landing-page .hero-box { padding-right: 0; }
.landing-page .hero-box h1 {
font-size: 4rem;
line-height: 1.0;
margin: 0;
}
.landing-page .hero-box .tagline {
font-size: 1.2rem;
line-height: 1.8;
margin-top: 0;
color: rgba(50, 60, 60, 0.8);
}

/* Landing page intro box */
.landing-page .intro {
padding: 2em;
border: 2px solid rgb(177, 224, 223);
}
.landing-page .intro .label {
font-family: Arial, Helvetica, sans-serif !important;
font-weight: bold;
font-size: 1.2rem;
margin: 0;
padding: 0;
}
.landing-page .intro p { font-size: 1.6rem; }

/* Button strip */
.landing-page .button-strip {
padding: 0 !important;
margin: 1em 0;
}
.landing-page .button-strip ul {
list-style: none;
padding: 0;
margin: 0;
display: flex;
justify-content: center;
gap: 1em;
clear: both;
flex-wrap: wrap;
}
.landing-page .button-strip li {
display: inline-block;
padding: 0 1em;
margin: 0.5em 0;
}
.landing-page .button-strip li .mw-parser-output a.external {
background-image: none !important;
}

/* Section alts */
.landing-page .alt-1 {
clear: both;
margin: 2em 0;
background-color: rgba(40, 60, 60, 0.05);
padding: 3em;
}
.landing-page .alt-1 p {
border-bottom: 2px solid rgb(230, 230, 230);
padding-bottom: 1em;
margin-bottom: 2em;
}
.landing-page .alt-2 { padding: 3em; }
.landing-page .section .alt-3 .left { flex: 2; min-width: 350px; }
.landing-page .section .alt-3 .right { flex: 3; min-width: 350px; }

/* --- 2026+ shared components --- */

.mw-page-lead {
font-size: 3em;
font-weight: 100;
line-height: 1.55;
color: #444;
margin: 0 0 0.8em 0;
}

.mw-page-deck {
font-size: 1.8em;
font-weight: 100;
line-height: 1.55;
color: #444;
margin: 0 0 0.8em 0;
}

/* Section wrapper */
.mw-section {
margin: 1.25rem 0;
clear: both;
display: flow-root;
}
.mw-section::after {
content: "";
display: block;
clear: both;
}
.mw-parser-output .mw-section + hr {
clear: both;
}
.mw-section--primary {
background: none;
}
.mw-section--secondary {
background: rgba(0, 0, 0, 0.06);
padding: 1rem;
border-radius: 10px;
}
.mw-section--brief {
margin-bottom: 0.85rem;
}
.mw-section--quickpaths-strip {
margin: 0.35rem 0 0.85rem 0;
font-size: 0.96em;
line-height: 1.35;
color: rgba(0, 0, 0, 0.75);
}
.mw-section--quickpaths-strip p {
margin: 0;
}
.mw-section--quickpaths-strip a {
white-space: nowrap;
}
@media (max-width: 900px) {
.mw-section--quickpaths-strip a,
.mw-section--quickpaths-strip .mw-parser-output a {
white-space: normal;
}
}
.mw-section--secondary > :is(h1, h2, h3, h4, h5, h6):first-child {
font-size: 1.3em;
font-weight: 700;
margin: 0 0 0.75rem 0;
padding-bottom: 0;
border-bottom: 0;
}
.mw-parser-output .mw-section--secondary :is(h1, h2, h3, h4, h5, h6) {
border-bottom: 0;
padding-bottom: 0;
}
.mw-parser-output .mw-section :is(h1, h2, h3, h4, h5, h6),
.mw-parser-output .mw-section__card :is(h1, h2, h3, h4, h5, h6) {
margin-top: 0;
padding-top: 0;
}
.mw-parser-output .mw-section h2,
.mw-parser-output .mw-section__card h2 {
padding-bottom: 0;
}
.mw-section__layout {
display: grid;
grid-template-columns: repeat(auto-fit, minmax(var(--mw-card-min, 18rem), 1fr));
gap: var(--mw-card-gap, 0.9rem);
}
.mw-section__card {
background: rgba(255, 255, 255, 0.7);
padding: 0.95rem 1rem;
border-radius: 10px;
border: 1px solid rgba(0, 0, 0, 0.06);
line-height: 1.5;
}
.mw-section--primary .mw-section__card {
margin-left: 0;
margin-right: 0;
}
.mw-section--secondary .mw-section__card {
background: rgba(255,255,255, 0.6);
}
.mw-section__card + .mw-section__card { margin-top: 0.9rem; }
.mw-section__layout .mw-section__card + .mw-section__card { margin-top: 0; }
.mw-section__card > :is(h1, h2, h3, h4, h5, h6):first-child {
font-weight: 700;
margin: 0 0 0.5rem 0;
font-size: 1.2em;
}
.mw-section__card h4 {
margin: 0.8rem 0 0.35rem 0;
padding-top: 0;
border-top: 0;
font-size: 0.95em;
font-weight: 700;
}
.mw-section__chips {
display: flex;
flex-wrap: wrap;
gap: 0.4rem 0.45rem;
margin-top: 0.25rem;
}

/* --- Inline term system --- */

.mw-parser-output .term,
.mw-parser-output .mw-term {
position: relative;
display: inline-block;
text-decoration: underline dotted;
text-underline-offset: 0.14em;
cursor: help;
}

.mw-parser-output .term__card,
.mw-parser-output .mw-term__card {
display: none;
position: absolute;
left: 0;
top: calc(100% + 0.4rem);
width: 20rem;
max-width: 70vw;
z-index: 100;
padding: 0.55rem 0.65rem;
border: 1px solid rgba(0, 0, 0, 0.16);
border-radius: 8px;
background: #fff;
color: #2f3338;
box-shadow: 0 10px 24px rgba(0, 0, 0, 0.18);
font-size: 0.9em;
line-height: 1.35;
font-weight: 500;
text-decoration: none;
pointer-events: none;
}

.mw-parser-output a:hover .term__card,
.mw-parser-output a:hover .mw-term__card,
.mw-parser-output a:focus .term__card,
.mw-parser-output a:focus .mw-term__card,
.mw-parser-output a:focus-visible .term__card,
.mw-parser-output a:focus-visible .mw-term__card,
.mw-parser-output .term:hover .term__card,
.mw-parser-output .mw-term:hover .mw-term__card {
display: block !important;
}

.term-definition {
margin: 0.35rem 0 0.75rem;
padding: 0.75rem 0.9rem;
background: rgba(0, 0, 0, 0.04);
border: 1px solid rgba(0, 0, 0, 0.08);
border-radius: 8px;
}

.term-definition__row + .term-definition__row {
margin-top: 0.45rem;
}
.mw-section__chips a {
display: inline-block;
padding: 0.18rem 0.55rem;
border-radius: 999px;
border: 1px solid rgba(0, 0, 0, 0.14);
background: rgba(255, 255, 255, 0.78);
text-decoration: none;
line-height: 1.25;
}
.mw-section__chips a:hover,
.mw-section__chips a:focus {
background: rgba(255, 255, 255, 0.96);
}
.mw-section__more {
margin-top: 0.45rem;
margin-bottom: 0;
font-size: 0.92em;
line-height: 1.25;
}
.mw-section__layout--build {
grid-template-columns: 1fr;
margin: 0.85rem 0;
}
.mw-section__layout--build .mw-section__card {
height: auto;
}
.mw-section__layout--build .mw-section__card > ul:first-of-type {
margin-top: 0.35rem;
margin-bottom: 0;
padding-left: 1.15rem;
}
.mw-section__layout--build .mw-section__card > ul:first-of-type li {
margin: 0.2rem 0;
}
.mw-section__layout--build .mw-section__card h4 {
margin-top: 0.5rem;
margin-bottom: 0.35rem;
padding-top: 0.5rem;
border-top: 0;
font-size: 0.88em;
font-weight: 500;
color: rgba(0, 0, 0, 0.58);
}
.mw-section__layout--build .mw-section__more {
margin-top: 0.55rem;
}
@media (min-width: 860px) {
.mw-section__layout--build {
grid-template-columns: repeat(3, minmax(0, 1fr));
}
}

/* Brief section: right-side card + media container */
.mw-section__brief-aside {
float: right;
width: min(100%, 26rem);
margin: 0 0 1rem 1rem;
display: grid;
gap: 0.9rem;
}
.mw-section__media {
background: rgba(255, 255, 255, 0.7);
padding: 0.95rem 1rem;
border-radius: 10px;
border: 0;
}
.mw-section__media figure[typeof~="mw:File/Thumb"],
.mw-section__media figure[typeof~="mw:File/Frame"] {
float: none !important;
margin: 0 !important;
width: 100% !important;
max-width: 100% !important;
display: flex !important;
flex-direction: column;
border: 0 !important;
background: transparent !important;
padding: 0 !important;
box-shadow: none !important;
line-height: normal !important;
min-width: 0;
}
.mw-section__media figure > a.mw-file-description {
display: block;
width: 100%;
}
.mw-section__media img.mw-file-element {
width: 100% !important;
height: auto;
display: block;
border: 0 !important;
background: transparent !important;
box-shadow: none !important;
}
.mw-section__media figure > figcaption {
display: block !important;
margin-top: 0.6rem;
width: auto !important;
max-width: none !important;
inline-size: 100% !important;
min-width: 0;
padding: 0 !important;
border: 0 !important;
background: transparent !important;
white-space: normal;
overflow-wrap: break-word;
word-break: normal !important;
hyphens: none !important;
float: none !important;
clear: both !important;
}
.mw-section__media .thumbinner,
.mw-section__media .thumbcaption {
width: 100% !important;
max-width: 100% !important;
inline-size: 100% !important;
box-sizing: border-box;
border: 0 !important;
background: transparent !important;
padding: 0 !important;
float: none !important;
}
.mw-section__media figure > figcaption::before,
.mw-section__media figure > figcaption::after {
content: none !important;
}
@media (max-width: 900px) {
.mw-section__brief-aside {
float: none;
width: 100%;
margin: 0 0 1rem 0;
}
}

.mw-section-wrapper-secondary {
background: rgba(0, 0, 0, 0.04);
padding: 1rem;
border-radius: 10px;
margin: 1.25rem 0;
clear: both;
}
.mw-section-wrapper-secondary__title {
font-size: 1.3em;
font-weight: 700;
margin: 0 0 0.75rem 0;
padding-bottom: 0.4rem;
border-bottom: 1px solid rgba(0, 0, 0, 0.15);
}
.mw-section-wrapper-secondary .mw-card {
background: rgba(255, 255, 255, 0.7);
padding: 0.95rem 1rem;
border-radius: 10px;
border: 1px solid rgba(0, 0, 0, 0.06);
}
.mw-section-wrapper-secondary .mw-card__title { font-weight: 700; margin: 0 0 0.5rem 0; font-size: 1.2em; }
.mw-section-wrapper-secondary .mw-card__body { line-height: 1.5; }

/* Card row wrapper */
.mw-cardrow {
padding: 1rem;
border-radius: 10px;
margin: 1.25rem 0;
clear: both;
}

/* Responsive grid */
.mw-cardgrid {
display: grid;
grid-template-columns: 1fr;
gap: 0.9rem;
}
@media (min-width: 900px) {
.mw-cardgrid { grid-template-columns: repeat(3, 1fr); }
}

/* Cards */
.mw-card {
background: rgba(255, 255, 255, 0.7);
padding: 0.95rem 1rem;
border-radius: 10px;
border: 1px solid rgba(0, 0, 0, 0.06);
}
.mw-card__title { font-weight: 700; margin: 0 0 0.5rem 0; font-size: 1.2em; }
.mw-card__body { line-height: 1.5; }

/* Card row title */
.mw-cardrow__title {
font-size: 1.3em;
font-weight: 700;
margin: 0 0 0.75rem 0;
padding-bottom: 0.4rem;
border-bottom: 1px solid rgba(0, 0, 0, 0.15);
}

/* --- Opt-in thumbnail card: class=mw-thumb-card (locked 50%) --- */

/* Frame + layout */
figure.mw-thumb-card[typeof~="mw:File/Thumb"],
figure.mw-thumb-card[typeof~="mw:File/Frame"] {
float: right;
clear: right;

/* Override Vector thumb table model */
display: block !important;
line-height: normal !important;
border-collapse: separate !important;

/* Lock width (responsive) */
width: 50%;
max-width: 100%;

/* Frame */
border: 0px solid rgba(0, 0, 0, 0.15) !important;
border-radius: 10px;
background: none !important;

padding: 1rem;
margin: 0.5em 0 1.3em 1.4em;
box-sizing: border-box;

text-align: center;
}

/* Undo Vector’s thumb background/border rules that leak through media queries */
@media screen {
figure.mw-thumb-card[typeof~="mw:File/Thumb"],
figure.mw-thumb-card[typeof~="mw:File/Frame"] {
background-color: transparent !important;
border-bottom: 0px solid rgba(0, 0, 0, 0.15) !important;
}
}

/* Image wrapper */
figure.mw-thumb-card > a.mw-file-description {
display: block;
padding: 2px;
border-radius: 9px;
}

/* Image fills the 400px frame */
figure.mw-thumb-card img.mw-file-element {
display: block;
width: 100% !important;
height: auto;

background: transparent !important; /* defeat Vector’s thumb image fill */
border: 0 !important;
outline: 0 !important;
box-shadow: none !important;

border-radius: 6px;
margin: 0 auto;
}

/* Caption inside the frame */
figure.mw-thumb-card > figcaption {
display: block !important;
margin: 1rem 0 0 0;
padding: 0;

background: none !important;
border: 0 !important;

color: rgba(0, 0, 0, 0.75);
font-size: 0.95em;
line-height: 1.35;
text-align: left;

/* wrap without “skinny column” behavior */
overflow-wrap: break-word;
word-break: normal !important;
hyphens: none !important;
white-space: normal;
}

figure.mw-thumb-card > figcaption::before,
figure.mw-thumb-card > figcaption::after {
content: none !important;
}

/* What People Build: light card grid */

.mw-build-grid {
display: grid;
grid-template-columns: repeat(auto-fit, minmax(320px, 1fr));
gap: 1.5rem;
margin: 2rem 0;
}

.mw-build-card {
padding: 1.25rem 1.4rem;

border: 1px solid rgba(0,0,0,0.08);
border-radius: 10px;

background: white;

box-sizing: border-box;
}

.mw-build-card h3 {
margin: 0 0 0.4rem 0;

font-size: 1.05rem;
font-weight: 700;
}

.mw-build-card p {
margin: 0;

font-size: 0.95rem;
line-height: 1.45;
color: rgba(0,0,0,0.75);
}

/* Procedure step layout */
.mw-step {
margin: 2rem 0 4rem 0;
display: grid;
grid-template-columns: minmax(220px, 340px) minmax(0, 1fr);
gap: 0.9rem 3rem;
align-items: start;
}
.mw-step--plain {
padding: 0;
border: 0;
border-radius: 0;
background: transparent;
}
.mw-step--card {
padding: 0.95rem 1rem;
border-radius: 10px;
border: 1px solid rgba(0, 0, 0, 0.06);
background: rgba(255, 255, 255, 0.7);
}
.mw-step--shaded {
padding: 1rem;
border: 0;
border-radius: 10px;
background: rgba(0, 0, 0, 0.04);
}
.mw-step :is(h1, h2, h3, h4, h5, h6) {
margin-top: 0;
padding-top: 0;
}
.mw-step__image {
grid-column: 1;
min-width: 0;
}
.mw-step__text {
grid-column: 2;
min-width: 0;
}
.mw-step__text :is(h1, h2, h3, h4, h5, h6) {
margin-top: 1rem;
}
.mw-parser-output .mw-step__text :is(ul, ol),
.mw-content-ltr .mw-parser-output .mw-step__text :is(ul, ol) {
margin-left: 1.5rem;
padding-left: 0;
}
.mw-parser-output .mw-step__text :is(ul, ol) > li,
.mw-content-ltr .mw-parser-output .mw-step__text :is(ul, ol) > li {
margin-left: 0;
}
.mw-step__image figure[typeof~="mw:File/Thumb"],
.mw-step__image figure[typeof~="mw:File/Frame"] {
float: none !important;
margin: 0 !important;
width: 100% !important;
max-width: 100% !important;
display: flex !important;
flex-direction: column;
border: 0 !important;
background: transparent !important;
padding: 0 !important;
box-shadow: none !important;
line-height: normal !important;
min-width: 0;
}
.mw-step__image figure > a.mw-file-description {
display: block;
width: 100%;
}
.mw-step__image figure > figcaption {
display: block !important;
margin-top: 0.6rem;
width: auto !important;
max-width: none !important;
inline-size: 100% !important;
min-width: 0;
padding: 0 !important;
border: 0 !important;
background: transparent !important;
white-space: normal;
overflow-wrap: break-word;
word-break: normal !important;
hyphens: none !important;
float: none !important;
clear: both !important;
}
.mw-step__image .thumbinner,
.mw-step__image .thumbcaption {
width: 100% !important;
max-width: 100% !important;
inline-size: 100% !important;
box-sizing: border-box;
border: 0 !important;
background: transparent !important;
padding: 0 !important;
float: none !important;
}
.mw-step__image img.mw-file-element {
width: 100% !important;
height: auto;
display: block;
border: 0 !important;
background: transparent !important;
box-shadow: none !important;
}
.mw-step__image figure > figcaption::before,
.mw-step__image figure > figcaption::after {
content: none !important;
}
@media screen {
.mw-step__image figure[typeof~="mw:File/Thumb"],
.mw-step__image figure[typeof~="mw:File/Frame"] {
background-color: transparent !important;
border-bottom: 0 !important;
}
}
@media (max-width: 900px) {
.mw-step {
grid-template-columns: 1fr;
}
.mw-step__image,
.mw-step__text {
grid-column: 1;
}
}

/* Info box template */
.mw-info {
margin: 0.9rem 0;
padding: 0.7rem 0.95rem;
border-radius: 8px;
border: 1px solid rgba(0, 0, 0, 0.12);
border-left-width: 4px;
background: rgba(80, 110, 140, 0.08);
border-left-color: rgba(60, 95, 130, 0.55);
display: flow-root;
}
.mw-info__title {
margin: 0 0 0.25rem 0;
font-weight: 700;
font-size: 0.95em;
letter-spacing: 0.01em;
}
.mw-info__body > :first-child {
margin-top: 0;
}
.mw-info__body > :last-child {
margin-bottom: 0;
}
.mw-info--info {
background: rgba(80, 110, 140, 0.08);
border-left-color: rgba(60, 95, 130, 0.55);
}
.mw-info--note {
background: rgba(84, 110, 160, 0.08);
border-left-color: rgba(74, 96, 143, 0.6);
}
.mw-info--tip {
background: rgba(72, 130, 72, 0.09);
border-left-color: rgba(57, 112, 57, 0.6);
}
.mw-info--warning {
background: rgba(185, 122, 44, 0.12);
border-left-color: rgba(161, 94, 25, 0.68);
}

/* Inline placeholder token */
.mw-placeholder {
display: inline;
font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
font-size: 0.95em;
font-weight: 600;
line-height: 1.3;
color: #222;
background: rgba(0, 0, 0, 0.06);
border: 1px solid rgba(0, 0, 0, 0.2);
border-radius: 4px;
padding: 0.04em 0.34em;
white-space: nowrap;
}

/* TOC limits */
.toclimit-2 .toclevel-2,
.toclimit-2 .toclevel-3,
.toclimit-2 .toclevel-4 { display:none; }

.toclimit-3 .toclevel-3,
.toclimit-3 .toclevel-4 { display:none; }

.toclimit-4 .toclevel-4 { display:none; }

/* Vector 2022 sidebar TOC support */
body:has(.toclimit-2) .vector-toc .vector-toc-level-2,
body:has(.toclimit-2) .vector-toc .vector-toc-level-3,
body:has(.toclimit-2) .vector-toc .vector-toc-level-4,
body:has(.toclimit-2) .vector-toc .vector-toc-level-5,
body:has(.toclimit-2) .vector-toc .vector-toc-level-6,
body:has(.toclimit-2) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-2,
body:has(.toclimit-2) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-3,
body:has(.toclimit-2) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-4,
body:has(.toclimit-2) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-5,
body:has(.toclimit-2) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-6 { display: none !important; }

body:has(.toclimit-3) .vector-toc .vector-toc-level-3,
body:has(.toclimit-3) .vector-toc .vector-toc-level-4,
body:has(.toclimit-3) .vector-toc .vector-toc-level-5,
body:has(.toclimit-3) .vector-toc .vector-toc-level-6,
body:has(.toclimit-3) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-3,
body:has(.toclimit-3) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-4,
body:has(.toclimit-3) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-5,
body:has(.toclimit-3) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-6 { display: none !important; }

body:has(.toclimit-4) .vector-toc .vector-toc-level-4,
body:has(.toclimit-4) .vector-toc .vector-toc-level-5,
body:has(.toclimit-4) .vector-toc .vector-toc-level-6,
body:has(.toclimit-4) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-4,
body:has(.toclimit-4) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-5,
body:has(.toclimit-4) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-6 { display: none !important; }

/* Doc lifecycle / context banner */
.doccontext {
border: 1px solid rgba(0,0,0,0.18);
border-radius: 10px;
padding: 0.85em 1em;
margin: 1em 0;
background: rgba(0,0,0,0.03);
}

.doccontext__row {
display: flex;
flex-wrap: wrap;
gap: 0.5em 0.6em;
align-items: baseline;
}

.doccontext__label {
font-weight: 600;
}

.doccontext__meta {
margin-top: 0.6em;
font-size: 0.95em;
}

.doccontext__meta dl {
margin: 0;
}

.doccontext__meta dt {
float: left;
clear: left;
width: 9.5em;
font-weight: 600;
}

.doccontext__meta dd {
margin: 0 0 0.25em 10em;
}

.doccontext__badge {
display: inline-block;
padding: 0.12em 0.55em;
border-radius: 999px;
font-size: 0.92em;
line-height: 1.6;
border: 1px solid rgba(0,0,0,0.18);
background: rgba(255,255,255,0.75);
white-space: nowrap;
}

.doccontext__badge--status { font-weight: 700; }

.doccontext__badge--current { background: rgba(30, 136, 229, 0.10); }
.doccontext__badge--stable { background: rgba(67, 160, 71, 0.10); }
.doccontext__badge--superseded { background: rgba(255, 179, 0, 0.12); }
.doccontext__badge--historical { background: rgba(120, 144, 156, 0.12); }
.doccontext__badge--archived { background: rgba(55, 71, 79, 0.10); }

.doccontext__note {
margin-top: 0.6em;
}

.doccontext__note p {
margin: 0.25em 0 0 0;
}

@media (max-width: 720px) {
.doccontext__meta dt { float: none; width: auto; }
.doccontext__meta dd { margin-left: 0; }
}

MediaWiki:Common.css

2026-09-30T22:43:27Z

KI5QKX: mw push

/* CSS placed here will be applied to all skins */

/* Keep images from escaping their enclosures */
img {
max-width: 100%;
height: auto;
}

/* Main page overrides */
body.page-Main_Page main header.mw-body-header,
body.page-Main_Page div.vector-page-toolbar {
display: none;
}

/* --- Legacy landing page styles (keep as-is until you retire it) --- */

.landing-page .section span.button a {
display: inline-block;
padding: 0.5em 1.5em;
background-color: rgb(177, 224, 223);
color: black;
text-decoration: none;
border-radius: 5px;
font-size: 1rem;
font-weight: bold;
}

.landing-page .section h1,
.landing-page .section h2 {
font-family: Arial, Helvetica, sans-serif !important;
font-weight: bold;
border: 0;
padding: 0;
display: block;
}
.landing-page .section h1 { margin: 0; }
.landing-page .section h2 { margin: 0 0 0.55em 0; }

/* Section box base */
.landing-page .section {
display: flex;
flex-wrap: wrap;
align-items: center;
margin: 8em 0;
padding-right: 3em;
}
.landing-page .section > div { padding: 2em 0; }
.landing-page .section .left { flex: 3; min-width: 350px; }
.landing-page .section .right { flex: 2; min-width: 350px; }
.landing-page .section p { font-size: 1.2rem; }

/* Hero box overrides */
.landing-page .hero-box { padding-right: 0; }
.landing-page .hero-box h1 {
font-size: 4rem;
line-height: 1.0;
margin: 0;
}
.landing-page .hero-box .tagline {
font-size: 1.2rem;
line-height: 1.8;
margin-top: 0;
color: rgba(50, 60, 60, 0.8);
}

/* Landing page intro box */
.landing-page .intro {
padding: 2em;
border: 2px solid rgb(177, 224, 223);
}
.landing-page .intro .label {
font-family: Arial, Helvetica, sans-serif !important;
font-weight: bold;
font-size: 1.2rem;
margin: 0;
padding: 0;
}
.landing-page .intro p { font-size: 1.6rem; }

/* Button strip */
.landing-page .button-strip {
padding: 0 !important;
margin: 1em 0;
}
.landing-page .button-strip ul {
list-style: none;
padding: 0;
margin: 0;
display: flex;
justify-content: center;
gap: 1em;
clear: both;
flex-wrap: wrap;
}
.landing-page .button-strip li {
display: inline-block;
padding: 0 1em;
margin: 0.5em 0;
}
.landing-page .button-strip li .mw-parser-output a.external {
background-image: none !important;
}

/* Section alts */
.landing-page .alt-1 {
clear: both;
margin: 2em 0;
background-color: rgba(40, 60, 60, 0.05);
padding: 3em;
}
.landing-page .alt-1 p {
border-bottom: 2px solid rgb(230, 230, 230);
padding-bottom: 1em;
margin-bottom: 2em;
}
.landing-page .alt-2 { padding: 3em; }
.landing-page .section .alt-3 .left { flex: 2; min-width: 350px; }
.landing-page .section .alt-3 .right { flex: 3; min-width: 350px; }

/* --- 2026+ shared components --- */

.mw-page-lead {
font-size: 3em;
font-weight: 100;
line-height: 1.55;
color: #444;
margin: 0 0 0.8em 0;
}

.mw-page-deck {
font-size: 1.8em;
font-weight: 100;
line-height: 1.55;
color: #444;
margin: 0 0 0.8em 0;
}

/* Section wrapper */
.mw-section {
margin: 1.25rem 0;
clear: both;
display: flow-root;
}
.mw-section::after {
content: "";
display: block;
clear: both;
}
.mw-parser-output .mw-section + hr {
clear: both;
}
.mw-section--primary {
background: none;
}
.mw-section--secondary {
background: rgba(0, 0, 0, 0.06);
padding: 1rem;
border-radius: 10px;
}
.mw-section--brief {
margin-bottom: 0.85rem;
}
.mw-section--quickpaths-strip {
margin: 0.35rem 0 0.85rem 0;
font-size: 0.96em;
line-height: 1.35;
color: rgba(0, 0, 0, 0.75);
}
.mw-section--quickpaths-strip p {
margin: 0;
}
.mw-section--quickpaths-strip a {
white-space: nowrap;
}
@media (max-width: 900px) {
.mw-section--quickpaths-strip a,
.mw-section--quickpaths-strip .mw-parser-output a {
white-space: normal;
}
}
.mw-section--secondary > :is(h1, h2, h3, h4, h5, h6):first-child {
font-size: 1.3em;
font-weight: 700;
margin: 0 0 0.75rem 0;
padding-bottom: 0;
border-bottom: 0;
}
.mw-parser-output .mw-section--secondary :is(h1, h2, h3, h4, h5, h6) {
border-bottom: 0;
padding-bottom: 0;
}
.mw-parser-output .mw-section :is(h1, h2, h3, h4, h5, h6),
.mw-parser-output .mw-section__card :is(h1, h2, h3, h4, h5, h6) {
margin-top: 0;
padding-top: 0;
}
.mw-parser-output .mw-section h2,
.mw-parser-output .mw-section__card h2 {
padding-bottom: 0;
}
.mw-section__layout {
display: grid;
grid-template-columns: repeat(auto-fit, minmax(var(--mw-card-min, 18rem), 1fr));
gap: var(--mw-card-gap, 0.9rem);
}
.mw-section__card {
background: rgba(255, 255, 255, 0.7);
padding: 0.95rem 1rem;
border-radius: 10px;
border: 1px solid rgba(0, 0, 0, 0.06);
line-height: 1.5;
}
.mw-section--primary .mw-section__card {
margin-left: 0;
margin-right: 0;
}
.mw-section--secondary .mw-section__card {
background: rgba(255,255,255, 0.6);
}
.mw-section__card + .mw-section__card { margin-top: 0.9rem; }
.mw-section__layout .mw-section__card + .mw-section__card { margin-top: 0; }
.mw-section__card > :is(h1, h2, h3, h4, h5, h6):first-child {
font-weight: 700;
margin: 0 0 0.5rem 0;
font-size: 1.2em;
}
.mw-section__card h4 {
margin: 0.8rem 0 0.35rem 0;
padding-top: 0;
border-top: 0;
font-size: 0.95em;
font-weight: 700;
}
.mw-section__chips {
display: flex;
flex-wrap: wrap;
gap: 0.4rem 0.45rem;
margin-top: 0.25rem;
}

/* --- Inline term system --- */

.mw-parser-output .term,
.mw-parser-output .mw-term {
position: relative;
display: inline-block;
text-decoration: underline dotted;
text-underline-offset: 0.14em;
cursor: help;
}

.mw-parser-output .term__card,
.mw-parser-output .mw-term__card {
display: none;
position: absolute;
left: 0;
top: calc(100% + 0.4rem);
width: 20rem;
max-width: 70vw;
z-index: 100;
padding: 0.55rem 0.65rem;
border: 1px solid rgba(0, 0, 0, 0.16);
border-radius: 8px;
background: #fff;
color: #2f3338;
box-shadow: 0 10px 24px rgba(0, 0, 0, 0.18);
font-size: 0.9em;
line-height: 1.35;
font-weight: 500;
text-decoration: none;
pointer-events: none;
}

.mw-parser-output a:hover .term__card,
.mw-parser-output a:hover .mw-term__card,
.mw-parser-output a:focus .term__card,
.mw-parser-output a:focus .mw-term__card,
.mw-parser-output a:focus-visible .term__card,
.mw-parser-output a:focus-visible .mw-term__card,
.mw-parser-output .term:hover .term__card,
.mw-parser-output .mw-term:hover .mw-term__card {
display: block !important;
}

.term-definition {
margin: 0.35rem 0 0.75rem;
padding: 0.75rem 0.9rem;
background: rgba(0, 0, 0, 0.04);
border: 1px solid rgba(0, 0, 0, 0.08);
border-radius: 8px;
}

.term-definition__row + .term-definition__row {
margin-top: 0.45rem;
}
.mw-section__chips a {
display: inline-block;
padding: 0.18rem 0.55rem;
border-radius: 999px;
border: 1px solid rgba(0, 0, 0, 0.14);
background: rgba(255, 255, 255, 0.78);
text-decoration: none;
line-height: 1.25;
}
.mw-section__chips a:hover,
.mw-section__chips a:focus {
background: rgba(255, 255, 255, 0.96);
}
.mw-section__more {
margin-top: 0.45rem;
margin-bottom: 0;
font-size: 0.92em;
line-height: 1.25;
}
.mw-section__layout--build {
grid-template-columns: 1fr;
margin: 0.85rem 0;
}
.mw-section__layout--build .mw-section__card {
height: auto;
}
.mw-section__layout--build .mw-section__card > ul:first-of-type {
margin-top: 0.35rem;
margin-bottom: 0;
padding-left: 1.15rem;
}
.mw-section__layout--build .mw-section__card > ul:first-of-type li {
margin: 0.2rem 0;
}
.mw-section__layout--build .mw-section__card h4 {
margin-top: 0.5rem;
margin-bottom: 0.35rem;
padding-top: 0.5rem;
border-top: 0;
font-size: 0.88em;
font-weight: 500;
color: rgba(0, 0, 0, 0.58);
}
.mw-section__layout--build .mw-section__more {
margin-top: 0.55rem;
}
@media (min-width: 860px) {
.mw-section__layout--build {
grid-template-columns: repeat(3, minmax(0, 1fr));
}
}

/* Brief section: right-side card + media container */
.mw-section__brief-aside {
float: right;
width: min(100%, 26rem);
margin: 0 0 1rem 1rem;
display: grid;
gap: 0.9rem;
}
.mw-section__media {
background: rgba(255, 255, 255, 0.7);
padding: 0.95rem 1rem;
border-radius: 10px;
border: 0;
}
.mw-section__media figure[typeof~="mw:File/Thumb"],
.mw-section__media figure[typeof~="mw:File/Frame"] {
float: none !important;
margin: 0 !important;
width: 100% !important;
max-width: 100% !important;
display: flex !important;
flex-direction: column;
border: 0 !important;
background: transparent !important;
padding: 0 !important;
box-shadow: none !important;
line-height: normal !important;
min-width: 0;
}
.mw-section__media figure > a.mw-file-description {
display: block;
width: 100%;
}
.mw-section__media img.mw-file-element {
width: 100% !important;
height: auto;
display: block;
border: 0 !important;
background: transparent !important;
box-shadow: none !important;
}
.mw-section__media figure > figcaption {
display: block !important;
margin-top: 0.6rem;
width: auto !important;
max-width: none !important;
inline-size: 100% !important;
min-width: 0;
padding: 0 !important;
border: 0 !important;
background: transparent !important;
white-space: normal;
overflow-wrap: break-word;
word-break: normal !important;
hyphens: none !important;
float: none !important;
clear: both !important;
}
.mw-section__media .thumbinner,
.mw-section__media .thumbcaption {
width: 100% !important;
max-width: 100% !important;
inline-size: 100% !important;
box-sizing: border-box;
border: 0 !important;
background: transparent !important;
padding: 0 !important;
float: none !important;
}
.mw-section__media figure > figcaption::before,
.mw-section__media figure > figcaption::after {
content: none !important;
}
@media (max-width: 900px) {
.mw-section__brief-aside {
float: none;
width: 100%;
margin: 0 0 1rem 0;
}
}

.mw-section-wrapper-secondary {
background: rgba(0, 0, 0, 0.04);
padding: 1rem;
border-radius: 10px;
margin: 1.25rem 0;
clear: both;
}
.mw-section-wrapper-secondary__title {
font-size: 1.3em;
font-weight: 700;
margin: 0 0 0.75rem 0;
padding-bottom: 0.4rem;
border-bottom: 1px solid rgba(0, 0, 0, 0.15);
}
.mw-section-wrapper-secondary .mw-card {
background: rgba(255, 255, 255, 0.7);
padding: 0.95rem 1rem;
border-radius: 10px;
border: 1px solid rgba(0, 0, 0, 0.06);
}
.mw-section-wrapper-secondary .mw-card__title { font-weight: 700; margin: 0 0 0.5rem 0; font-size: 1.2em; }
.mw-section-wrapper-secondary .mw-card__body { line-height: 1.5; }

/* Card row wrapper */
.mw-cardrow {
padding: 1rem;
border-radius: 10px;
margin: 1.25rem 0;
clear: both;
}

/* Responsive grid */
.mw-cardgrid {
display: grid;
grid-template-columns: 1fr;
gap: 0.9rem;
}
@media (min-width: 900px) {
.mw-cardgrid { grid-template-columns: repeat(3, 1fr); }
}

/* Cards */
.mw-card {
background: rgba(255, 255, 255, 0.7);
padding: 0.95rem 1rem;
border-radius: 10px;
border: 1px solid rgba(0, 0, 0, 0.06);
}
.mw-card__title { font-weight: 700; margin: 0 0 0.5rem 0; font-size: 1.2em; }
.mw-card__body { line-height: 1.5; }

/* Card row title */
.mw-cardrow__title {
font-size: 1.3em;
font-weight: 700;
margin: 0 0 0.75rem 0;
padding-bottom: 0.4rem;
border-bottom: 1px solid rgba(0, 0, 0, 0.15);
}

/* --- Opt-in thumbnail card: class=mw-thumb-card (locked 50%) --- */

/* Frame + layout */
figure.mw-thumb-card[typeof~="mw:File/Thumb"],
figure.mw-thumb-card[typeof~="mw:File/Frame"] {
float: right;
clear: right;

/* Override Vector thumb table model */
display: block !important;
line-height: normal !important;
border-collapse: separate !important;

/* Lock width (responsive) */
width: 50%;
max-width: 100%;

/* Frame */
border: 0px solid rgba(0, 0, 0, 0.15) !important;
border-radius: 10px;
background: none !important;

padding: 1rem;
margin: 0.5em 0 1.3em 1.4em;
box-sizing: border-box;

text-align: center;
}

/* Undo Vector’s thumb background/border rules that leak through media queries */
@media screen {
figure.mw-thumb-card[typeof~="mw:File/Thumb"],
figure.mw-thumb-card[typeof~="mw:File/Frame"] {
background-color: transparent !important;
border-bottom: 0px solid rgba(0, 0, 0, 0.15) !important;
}
}

/* Image wrapper */
figure.mw-thumb-card > a.mw-file-description {
display: block;
padding: 2px;
border-radius: 9px;
}

/* Image fills the 400px frame */
figure.mw-thumb-card img.mw-file-element {
display: block;
width: 100% !important;
height: auto;

background: transparent !important; /* defeat Vector’s thumb image fill */
border: 0 !important;
outline: 0 !important;
box-shadow: none !important;

border-radius: 6px;
margin: 0 auto;
}

/* Caption inside the frame */
figure.mw-thumb-card > figcaption {
display: block !important;
margin: 1rem 0 0 0;
padding: 0;

background: none !important;
border: 0 !important;

color: rgba(0, 0, 0, 0.75);
font-size: 0.95em;
line-height: 1.35;
text-align: left;

/* wrap without “skinny column” behavior */
overflow-wrap: break-word;
word-break: normal !important;
hyphens: none !important;
white-space: normal;
}

figure.mw-thumb-card > figcaption::before,
figure.mw-thumb-card > figcaption::after {
content: none !important;
}

/* What People Build: light card grid */

.mw-build-grid {
display: grid;
grid-template-columns: repeat(auto-fit, minmax(320px, 1fr));
gap: 1.5rem;
margin: 2rem 0;
}

.mw-build-card {
padding: 1.25rem 1.4rem;

border: 1px solid rgba(0,0,0,0.08);
border-radius: 10px;

background: white;

box-sizing: border-box;
}

.mw-build-card h3 {
margin: 0 0 0.4rem 0;

font-size: 1.05rem;
font-weight: 700;
}

.mw-build-card p {
margin: 0;

font-size: 0.95rem;
line-height: 1.45;
color: rgba(0,0,0,0.75);
}

/* Procedure step layout */
.mw-step {
margin: 2rem 0 4rem 0;
display: grid;
grid-template-columns: minmax(220px, 340px) minmax(0, 1fr);
gap: 0.9rem 3rem;
align-items: start;
}
.mw-step--plain {
padding: 0;
border: 0;
border-radius: 0;
background: transparent;
}
.mw-step--card {
padding: 0.95rem 1rem;
border-radius: 10px;
border: 1px solid rgba(0, 0, 0, 0.06);
background: rgba(255, 255, 255, 0.7);
}
.mw-step--shaded {
padding: 1rem;
border: 0;
border-radius: 10px;
background: rgba(0, 0, 0, 0.04);
}
.mw-step :is(h1, h2, h3, h4, h5, h6) {
margin-top: 0;
padding-top: 0;
}
.mw-step__image {
grid-column: 1;
min-width: 0;
}
.mw-step__text {
grid-column: 2;
min-width: 0;
}
.mw-step__text :is(h1, h2, h3, h4, h5, h6) {
margin-top: 1rem;
}
.mw-parser-output .mw-step__text :is(ul, ol),
.mw-content-ltr .mw-parser-output .mw-step__text :is(ul, ol) {
margin-left: 1.5rem;
padding-left: 0;
}
.mw-parser-output .mw-step__text :is(ul, ol) > li,
.mw-content-ltr .mw-parser-output .mw-step__text :is(ul, ol) > li {
margin-left: 0;
}
.mw-step__image figure[typeof~="mw:File/Thumb"],
.mw-step__image figure[typeof~="mw:File/Frame"] {
float: none !important;
margin: 0 !important;
width: 100% !important;
max-width: 100% !important;
display: flex !important;
flex-direction: column;
border: 0 !important;
background: transparent !important;
padding: 0 !important;
box-shadow: none !important;
line-height: normal !important;
min-width: 0;
}
.mw-step__image figure > a.mw-file-description {
display: block;
width: 100%;
}
.mw-step__image figure > figcaption {
display: block !important;
margin-top: 0.6rem;
width: auto !important;
max-width: none !important;
inline-size: 100% !important;
min-width: 0;
padding: 0 !important;
border: 0 !important;
background: transparent !important;
white-space: normal;
overflow-wrap: break-word;
word-break: normal !important;
hyphens: none !important;
float: none !important;
clear: both !important;
}
.mw-step__image .thumbinner,
.mw-step__image .thumbcaption {
width: 100% !important;
max-width: 100% !important;
inline-size: 100% !important;
box-sizing: border-box;
border: 0 !important;
background: transparent !important;
padding: 0 !important;
float: none !important;
}
.mw-step__image img.mw-file-element {
width: 100% !important;
height: auto;
display: block;
border: 0 !important;
background: transparent !important;
box-shadow: none !important;
}
.mw-step__image figure > figcaption::before,
.mw-step__image figure > figcaption::after {
content: none !important;
}
@media screen {
.mw-step__image figure[typeof~="mw:File/Thumb"],
.mw-step__image figure[typeof~="mw:File/Frame"] {
background-color: transparent !important;
border-bottom: 0 !important;
}
}
@media (max-width: 900px) {
.mw-step {
grid-template-columns: 1fr;
}
.mw-step__image,
.mw-step__text {
grid-column: 1;
}
}

/* Info box template */
.mw-info {
margin: 0.9rem 0;
padding: 0.7rem 0.95rem;
border-radius: 8px;
border: 1px solid rgba(0, 0, 0, 0.12);
border-left-width: 4px;
background: rgba(80, 110, 140, 0.08);
border-left-color: rgba(60, 95, 130, 0.55);
display: flow-root;
}
.mw-info__title {
margin: 0 0 0.25rem 0;
font-weight: 700;
font-size: 0.95em;
letter-spacing: 0.01em;
}
.mw-info__body > :first-child {
margin-top: 0;
}
.mw-info__body > :last-child {
margin-bottom: 0;
}
.mw-info--info {
background: rgba(80, 110, 140, 0.08);
border-left-color: rgba(60, 95, 130, 0.55);
}
.mw-info--note {
background: rgba(84, 110, 160, 0.08);
border-left-color: rgba(74, 96, 143, 0.6);
}
.mw-info--tip {
background: rgba(72, 130, 72, 0.09);
border-left-color: rgba(57, 112, 57, 0.6);
}
.mw-info--warning {
background: rgba(185, 122, 44, 0.12);
border-left-color: rgba(161, 94, 25, 0.68);
}

/* Inline placeholder token */
.mw-placeholder {
display: inline;
font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
font-size: 0.95em;
font-weight: 600;
line-height: 1.3;
color: #222;
background: rgba(0, 0, 0, 0.06);
border: 1px solid rgba(0, 0, 0, 0.2);
border-radius: 4px;
padding: 0.04em 0.34em;
white-space: nowrap;
}

/* TOC limits */
.toclimit-2 .toclevel-2,
.toclimit-2 .toclevel-3,
.toclimit-2 .toclevel-4 { display:none; }

.toclimit-3 .toclevel-3,
.toclimit-3 .toclevel-4 { display:none; }

.toclimit-4 .toclevel-4 { display:none; }

/* Vector 2022 sidebar TOC support */
body:has(.toclimit-2) .vector-toc .vector-toc-level-2,
body:has(.toclimit-2) .vector-toc .vector-toc-level-3,
body:has(.toclimit-2) .vector-toc .vector-toc-level-4,
body:has(.toclimit-2) .vector-toc .vector-toc-level-5,
body:has(.toclimit-2) .vector-toc .vector-toc-level-6,
body:has(.toclimit-2) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-2,
body:has(.toclimit-2) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-3,
body:has(.toclimit-2) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-4,
body:has(.toclimit-2) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-5,
body:has(.toclimit-2) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-6 { display: none !important; }

body:has(.toclimit-3) .vector-toc .vector-toc-level-3,
body:has(.toclimit-3) .vector-toc .vector-toc-level-4,
body:has(.toclimit-3) .vector-toc .vector-toc-level-5,
body:has(.toclimit-3) .vector-toc .vector-toc-level-6,
body:has(.toclimit-3) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-3,
body:has(.toclimit-3) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-4,
body:has(.toclimit-3) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-5,
body:has(.toclimit-3) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-6 { display: none !important; }

body:has(.toclimit-4) .vector-toc .vector-toc-level-4,
body:has(.toclimit-4) .vector-toc .vector-toc-level-5,
body:has(.toclimit-4) .vector-toc .vector-toc-level-6,
body:has(.toclimit-4) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-4,
body:has(.toclimit-4) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-5,
body:has(.toclimit-4) .vector-toc .vector-toc-level-1.vector-toc-list-item-expanded .vector-toc-list-item.vector-toc-level-6 { display: none !important; }

/* Doc lifecycle / context banner */
.doccontext {
border: 1px solid rgba(0,0,0,0.18);
border-radius: 10px;
padding: 0.85em 1em;
margin: 1em 0;
background: rgba(0,0,0,0.03);
}

.doccontext__row {
display: flex;
flex-wrap: wrap;
gap: 0.5em 0.6em;
align-items: baseline;
}

.doccontext__label {
font-weight: 600;
}

.doccontext__meta {
margin-top: 0.6em;
font-size: 0.95em;
}

.doccontext__meta dl {
margin: 0;
}

.doccontext__meta dt {
float: left;
clear: left;
width: 9.5em;
font-weight: 600;
}

.doccontext__meta dd {
margin: 0 0 0.25em 10em;
}

.doccontext__badge {
display: inline-block;
padding: 0.12em 0.55em;
border-radius: 999px;
font-size: 0.92em;
line-height: 1.6;
border: 1px solid rgba(0,0,0,0.18);
background: rgba(255,255,255,0.75);
white-space: nowrap;
}

.doccontext__badge--status { font-weight: 700; }

.doccontext__badge--current { background: rgba(30, 136, 229, 0.10); }
.doccontext__badge--stable { background: rgba(67, 160, 71, 0.10); }
.doccontext__badge--superseded { background: rgba(255, 179, 0, 0.12); }
.doccontext__badge--historical { background: rgba(120, 144, 156, 0.12); }
.doccontext__badge--archived { background: rgba(55, 71, 79, 0.10); }

.doccontext__note {
margin-top: 0.6em;
}

.doccontext__note p {
margin: 0.25em 0 0 0;
}

@media (max-width: 720px) {
.doccontext__meta dt { float: none; width: auto; }
.doccontext__meta dd { margin-left: 0; }
}

2026-09-29T19:28:00Z

KI5QKX: Organize remaining IPIP Mesh articles and navigation

{{Section nav|hub=IPIP Mesh|title=IPIP Mesh|category=IPIP Mesh}}

Initial Server/Gateway Machine Setup

The computer I had laying around to build my basic server/gateway was an old Dell OptiPlex GX280 (Intel 3.2Ghz CPU) with 3GB’s of RAM, 160GB HD (Yeah, I know overkill but that's the HD that was in the machine) and two 1Gb Ethernet adapters, 1 built-in and 1 Intel PCI Ethernet adapter I installed, where..
1. the built-in Ethernet adapter is to my router for my Internet connection.
2. the PCI Ethernet adapter serves my AmprNet Network.

Because of the architecture of the computer, I had to use the 32bit version of Debian 11.5.0 netinstall image for this setup. I like Debian mainly because, well because I like it, LOL. BTW, it is not in the scope of these instructions to show you how to install Debian 11 so please search Google for information on the topic if needed. Keep in mind though the SSH server and the standard system utilities were the only software options I selected for my bare Debian 11 installation.

After the installation is completed, log in as root and make sure Debian has the latest fixes and patches by typing:
apt update && apt full-upgrade -y

During these procedures I used root directly since to me, it was quicker to setup the server/gateway. But if you want to use sudo, it is not installed by default on Debian 11 so again search Google on how to install it. There are a lot of resources on the subject. I installed sudo after getting the server/gateway up and running for future administration and security. If the server/gateway does any updates from the command's above, reboot to make sure updates take affect (old Windows habit). Type:
reboot

Install other software for this setup.

Descriptions..
1. screen (optional): This software allows you to connect back to a particular session if you are remote and loose connection to your server/gateway.
2. compile tools: Needed to compile software.
3. iptables-persistent: This installs the most used Linux firewall iptables and it's tools, well to my knowledge. When asked, it's not necessary to save the current v.4 and v.6 iptables rules.
4. psmisc: Installed for the killall command. Used for the update-server script found in the Optional Software and Task's section.
5. curl (optional): Used to install optional software found in the Optional Software and Task's section.
6. cron: Used to schedule task. This is more than likely already installed.
7. tcpdump: Useful networking tool.
8. traceroute: Useful networking tool. This is more than likely already installed.

To install these, Type:
apt install -y screen build-essential iptables-persistent psmisc curl tcpdump

Reboot. (Again, old Windows habit) Type:
reboot

Now let's turn this server machine into an AmprNet Gateway (Updates Coming so please check back soon)

[[Category:How-To]]
[[Category:How-To Guides]]
[[Category:Infrastructure]]
[[Category:Gateways]]
[[Category:Device and platform guides]]

K7ILO'S Two Interface Debian 11 AmprNet Gateway Build in layman's terms

2026-09-29T19:28:00Z

KI5QKX: KI5QKX moved page K7ILO'S Two Interface Debian 11 AmprNet Gateway Build in layman's terms to IPIP Mesh/K7ILO'S Two Interface Debian 11 AmprNet Gateway Build in layman's terms: Group remaining mesh documentation under IPIP Mesh

#REDIRECT [[IPIP Mesh/K7ILO'S Two Interface Debian 11 AmprNet Gateway Build in layman's terms]]

IPIP Mesh/K7ILO'S Two Interface Debian 11 AmprNet Gateway Build in layman's terms

2026-09-29T19:28:00Z

Initial Server/Gateway Machine Setup

The computer I had laying around to build my basic server/gateway was an old Dell OptiPlex GX280 (Intel 3.2Ghz CPU) with 3GB’s of RAM, 160GB HD (Yeah, I know overkill but that's the HD that was in the machine) and two 1Gb Ethernet adapters, 1 built-in and 1 Intel PCI Ethernet adapter I installed, where..
1. the built-in Ethernet adapter is to my router for my Internet connection.
2. the PCI Ethernet adapter serves my AmprNet Network.

Because of the architecture of the computer, I had to use the 32bit version of Debian 11.5.0 netinstall image for this setup. I like Debian mainly because, well because I like it, LOL. BTW, it is not in the scope of these instructions to show you how to install Debian 11 so please search Google for information on the topic if needed. Keep in mind though the SSH server and the standard system utilities were the only software options I selected for my bare Debian 11 installation.

After the installation is completed, log in as root and make sure Debian has the latest fixes and patches by typing:
apt update && apt full-upgrade -y

During these procedures I used root directly since to me, it was quicker to setup the server/gateway. But if you want to use sudo, it is not installed by default on Debian 11 so again search Google on how to install it. There are a lot of resources on the subject. I installed sudo after getting the server/gateway up and running for future administration and security. If the server/gateway does any updates from the command's above, reboot to make sure updates take affect (old Windows habit). Type:
reboot

Install other software for this setup.

Descriptions..
1. screen (optional): This software allows you to connect back to a particular session if you are remote and loose connection to your server/gateway.
2. compile tools: Needed to compile software.
3. iptables-persistent: This installs the most used Linux firewall iptables and it's tools, well to my knowledge. When asked, it's not necessary to save the current v.4 and v.6 iptables rules.
4. psmisc: Installed for the killall command. Used for the update-server script found in the Optional Software and Task's section.
5. curl (optional): Used to install optional software found in the Optional Software and Task's section.
6. cron: Used to schedule task. This is more than likely already installed.
7. tcpdump: Useful networking tool.
8. traceroute: Useful networking tool. This is more than likely already installed.

To install these, Type:
apt install -y screen build-essential iptables-persistent psmisc curl tcpdump

Reboot. (Again, old Windows habit) Type:
reboot

Now let's turn this server machine into an AmprNet Gateway (Updates Coming so please check back soon)

[[Category:How-To]]
[[Category:How-To Guides]]
[[Category:Infrastructure]]
[[Category:Gateways]]
[[Category:Device and platform guides]]

IPIP Mesh/Filtering RFC1918 Addresses

2026-09-29T19:27:57Z

KI5QKX: Organize remaining IPIP Mesh articles and navigation

{{Section nav|hub=IPIP Mesh|title=IPIP Mesh|category=IPIP Mesh}}

== Mikrotik RouterOS ==

<ol>
<li>Define an RFC1918 address list
<pre>/ip firewall address-list
add address=10.0.0.0/8 list=RFC1918
add address=172.16.0.0/12 list=RFC1918
add address=192.168.0.0/16 list=RFC1918</pre>
</li>
<li>Perform NAT on traffic coming into AMPR from RFC1918 space
<pre>/ip firewall nat
add action=masquerade chain=srcnat src-address-list=RFC1918</pre>
</li>
</ol>

[[Category:How-To]]
[[Category:How-To Guides]]
[[Category:Infrastructure]]

Filtering RFC1918 Addresses

2026-09-29T19:27:56Z

KI5QKX: KI5QKX moved page Filtering RFC1918 Addresses to IPIP Mesh/Filtering RFC1918 Addresses: Group remaining mesh documentation under IPIP Mesh

#REDIRECT [[IPIP Mesh/Filtering RFC1918 Addresses]]

IPIP Mesh/Filtering RFC1918 Addresses

2026-09-29T19:27:56Z

KI5QKX: KI5QKX moved page Filtering RFC1918 Addresses to IPIP Mesh/Filtering RFC1918 Addresses: Group remaining mesh documentation under IPIP Mesh

== Mikrotik RouterOS ==

<ol>
<li>Define an RFC1918 address list
<pre>/ip firewall address-list
add address=10.0.0.0/8 list=RFC1918
add address=172.16.0.0/12 list=RFC1918
add address=192.168.0.0/16 list=RFC1918</pre>
</li>
<li>Perform NAT on traffic coming into AMPR from RFC1918 space
<pre>/ip firewall nat
add action=masquerade chain=srcnat src-address-list=RFC1918</pre>
</li>
</ol>

[[Category:How-To]]
[[Category:How-To Guides]]
[[Category:Infrastructure]]

IPIP Mesh/OH7LZB VPN

2026-09-29T19:27:54Z

KI5QKX: Organize remaining IPIP Mesh articles and navigation

{{Section nav|hub=IPIP Mesh|title=IPIP Mesh|category=IPIP Mesh}}

The OH7LZB VPN was an experimental method to access the IPIP Mesh using a VPN from anywhere on the Internet. The VPN was openly available to any amateur radio operators who had successfully applied for an X.509 certificate from one of the following Certificate Authorities:

* [http://www.arrl.org/logbook-of-the-world ARRL Logbook of the World (LoTW)]

As of May, 2024, the OH7LZB VPN appears to no longer be operational.

The Certificate Authority (CA) validates using a relatively strong method that the operator is actually licensed, and gives the operator a cryptographic certificate to prove that. Other services, such as this VPN can then check that the operator possesses a valid amateur radio operator certificate (and the accompanying private key), without any manual work being performed by the operators of those services. The operator can use his private key to sign LoTW log files, or any other information he wishes to communicate, and other parties trusting the CA can use the certificate to check that they have been transmitted by someone who has a private key and a certificate for a callsign from the CA.

If and when other organisations start to give out X.509 certificates, after sufficient amateur radio license validation, the VPN will be configured to accept those in addition to the LoTW. If you're not willing to obtain a LoTW certificate, please set up a CA for your local club or association, document the method of license validation you're using, and I'll be happy to trust your certificates.

The VPN operator (Hessu, OH7LZB) does not have time to run a CA and validate licenses manually, so please don't ask for a certificate from anywhere else than the CAs listed above. Thanks!

The VPN is only used to access the IPIP Mesh. While you're connected to the VPN, the VPN client will only transmit packets from you to the IPIP Mesh via the VPN. Packets from you to the rest of the Internet will not go via the VPN - they'll flow out from your local network connection as before. This is called a [http://en.wikipedia.org/wiki/Split_tunneling split tunnel VPN configuration].

The setup is still a bit complicated - it can be made easier and more automatic with a little additional software in a later phase.

The VPN is an experimental service. It might be shut down for technical or political reasons - we'll see if it's a feasible idea or not.

= Getting a certificate from LoTW =

Go through [https://lotw.arrl.org/lotw-help/getting-started/ these simple steps]. After step 4 you're ready to continue with the VPN.

It's going to take some time to validate, and you'll have to do some manual work (especially if you're outside the USA), but that is intentional. It significantly reduces abuse of the system, and increases its security.

= Extracting the certificate from LoTW =

LoTW uses a custom file format (.TQ*) to exchange certificates, but after the LoTW certificate process is done and the TrustedQSL software has your certificates, they can be easily copied from TrustedQSL's directories. You'll need three files: your '''user certificate''', an '''intermediate certificate''' that was used to sign it, and your '''private key'''. The only secret piece of information is the private key - you should not reveal it to anyone at any point, as they could then use services on your behalf, using your callsign.

== Windows ==

* C:\Documents and Settings\your-username\Application Data\TrustedQSL contains two directories, '''certs''' and '''keys'''.
* certs\user contains the '''user certificate'''
* certs\authorities contains an '''intermediate certificate'''
* keys\YOURCALL contains, within some XML, your '''private key'''

Make copies of those files in another directory, and work on those copies in order to avoid breaking the originals.

The user and intermediate certificates need to be concatenated to a single file named '''client.crt'''. The user certificate must be first, followed by the intermediate certificate. That can be done by an ascii editor such as Notepad (Wordpad or Word is likely to mess it up in a big way).

The private key needs to be extracted from the YOURCALL file. The file is a regular ASCII text file, and contains a block which looks something like this (just longer):

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,0C7B5495F6A91F31

0xmWfliK/v9U88MFyYtUbteRoAkfVMK6BllcdID3pZzmdykHaPLZUjXOCUh3vFUX
1bjnYwXpLX/CxgZ6NIxQIk7jMjL3iaP5SkWzCswqi9mCO+zHxuS6PWq7YwbWNFgo
7smNcko1yTp7f/VbS4CZ5kgIF9kCgNaiqdxq+v0IcphQHRR4xjfLpBQ4ckYOi4nC
jqFR1BitwBL4K2JeE9PGUkkUBwvU4oOi9PGChuoxMXs8PwKi/dZTmSWM7kOfMiBw
-----END RSA PRIVATE KEY-----

Copy-paste that block to a separate file named '''client.key'''.

== Linux and Mac ==

* ~/.tqsl/certs/user contains the '''user certificate'''
* ~/.tqsl/certs/authorities contains an '''intermediate certificate'''
* ~/.tqsl/keys/YOURCALL contains, within some XML, your '''private key'''

The user and intermediate certificates need to be concatenated to a single file named '''client.crt'''. The user certificate must be first, followed by the intermediate certificate. That can be done by a single command:

cat ~/.tqsl/certs/user ~/.tqsl/certs/authorities > client.crt

The private key needs to be extracted from the YOURCALL file. The file is a regular ASCII text file, and contains a block which looks something like this (just longer):

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,0C7B5495F6A91F31

0xmWfliK/v9U88MFyYtUbteRoAkfVMK6BllcdID3pZzmdykHaPLZUjXOCUh3vFUX
1bjnYwXpLX/CxgZ6NIxQIk7jMjL3iaP5SkWzCswqi9mCO+zHxuS6PWq7YwbWNFgo
7smNcko1yTp7f/VbS4CZ5kgIF9kCgNaiqdxq+v0IcphQHRR4xjfLpBQ4ckYOi4nC
jqFR1BitwBL4K2JeE9PGUkkUBwvU4oOi9PGChuoxMXs8PwKi/dZTmSWM7kOfMiBw
-----END RSA PRIVATE KEY-----

Copy-paste that block to a separate file named '''client.key'''. If you're going to open up the original private key file in a text editor, it's a good idea to make a backup copy of that file first in case of an accidental corruption of its contents.

= Configuring the VPN =

== Windows: OpenVPN ==

# [http://openvpn.net/index.php/download/community-downloads.html Download the Windows Installer], it's free and open source.
# Run the installer to install it.
# [http://he.fi/amprnet-vpn/amprnet-vpn-win.zip Download the AMPRNet VPN configuration files for Windows]
# Open up the zip file, it contains two files: amprnet-vpn.ovpn and amprnet-vpn-ca.crt.
# In Start menu, under OpenVPN => Shortcuts you'll find an entry named '''OpenVPN configuration file directory'''. Open it, and move the two files from the zip to the configuration file directory.
# Place client.crt and client.key, which were created previously, in the configuration file directory.
# Run the '''OpenVPN GUI''' from the desktop icon or start menu. A new icon will appear in the lower right corner (two computers with red screens + a globe on the side).
# Right-click the OpenVPN toolbar icon and select '''Connect'''.

If you chose to encrypt your private key with a password (or passphrase) when initially applying for a LoTW certificate and generating the Certificate Request, OpenVPN will ask you for that password when connecting.

To rephrase: When OpenVPN says "Enter Password", the password being asked is the one you picked when you first applied for a LoTW certificate. It's not something the VPN operator knows (or should know). It's not the one you got on a postcard. Only you have ever been aware of that password (hopefully).

== Linux: OpenVPN ==

=== Ubuntu 15.10 ===

Here is steps to install the VPN to Ubuntu 15.10 destop. Install OpenVPN plugin to network manager.
Open terminal and type

sudo apt-get install network-manager-open vpn-gnome

Then add VPN-connection information to NetworkManager

# Click network manager icon on taskbar
# Edit connections
# Add
# OpenVPN
# Create
#* Connection name: AMPRNet
#* Gateway: amprnet-vpn1.aprs.fi
#* Select proper files to User Certificate, CA certificate and Private key
#* Optionally enter private key password if you are set one
# Click Advanced
#* [x] Use custom gateway port: 1773
#* [x] Use LZO data compression
# Click OK
# Click Save
# Click Close

Now you can connect to VPN

# Click network manager icon on taskbar
# VPN connections -> AMPRNet
# Connection should be established

== Linux (Raspberry Pi): OpenVPN ==

Log in to Raspberry Pi console. Install openvpn software.

sudo apt-get install openvpn

Create openvpn client configuration file with your favourite editor to /etc/openvpn/client.conf

<pre>
client
dev tun
proto udp
remote amprnet-vpn1.aprs.fi 1773
resolv-retry infinite
persist-key
persist-tun
ca amprnet-vpn-ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
</pre>

Extract your client certificate and key as explained above section Extracting the certificate from LoTW. Copy your certificate files client.crt and client.key to /etc/openvpn/ . You also need amprnet-vpn-ca.crt which can be found inside this archive
http://he.fi/amprnet-vpn/amprnet-vpn-win.zip . Extract it and copy to /etc/openvpn/

Restart openvpn

service openvpn restart

All done.

== Mac OS X: Tunnelblick ==

# [https://tunnelblick.net/ Download Tunnelblick], it's free and open source, and works like a charm. It's based on OpenVPN.
# [http://he.fi/amprnet-vpn/amprnet-vpn-tblk.zip Download the VPN configuration for Tunnelblick], it's a zip file containing a directory with a couple files
# Double-click the downloaded zip file to extract it, you'll get a directory named '''amprnet-vpn.tblk'''
# Move the '''private key''' (in a file which was named '''client.key''' in the previous step) to that directory
# Move the certificates (in a file which was named '''client.crt''' in the previous step) to that directory
# Double-click the '''amprnet-vpn.tblk''' directory - this will launch Tunnelblick and install the VPN configuration

You should now see a "tunnel" icon in the top right corner of the screen. Click it to see a few menu items allowing you to connect and disconnect the VPN.

If you chose to encrypt your private key with a password (or passphrase) when initially applying for a LoTW certificate and generating the Certificate Request, Tunnelblick will ask you for that passphrase when connecting.

To rephrase: When Tunnelblick says "A passphrase is required to connect to amprnet-vpn", the passphrase being asked is the one you picked when you first applied for a LoTW certificate. It's not something the VPN operator knows (or should know). Only you have ever been aware of that passphrase (hopefully).

[[Category:How-To]]
[[Category:Reference]][[Category:How-To Guides]]
[[Category:Participation Methods]]
[[Category:VPN]]

Talk:OH7LZB VPN

2026-09-29T19:27:53Z

KI5QKX: KI5QKX moved page Talk:OH7LZB VPN to Talk:IPIP Mesh/OH7LZB VPN: Group remaining mesh documentation under IPIP Mesh

#REDIRECT [[Talk:IPIP Mesh/OH7LZB VPN]]

Talk:IPIP Mesh/OH7LZB VPN

2026-09-29T19:27:53Z

KI5QKX: KI5QKX moved page Talk:OH7LZB VPN to Talk:IPIP Mesh/OH7LZB VPN: Group remaining mesh documentation under IPIP Mesh

Hi,
LOTW private key certificate is a PKCS12 format (p12 file)
To use it with AMPR VPN, you need to first convert it using openssl.

Example:
openssl pkcs12 -in <callsign>.p12 -out <callsign>.cer

from this text file, copy the private key section

OH7LZB VPN

2026-09-29T19:27:52Z

KI5QKX: KI5QKX moved page OH7LZB VPN to IPIP Mesh/OH7LZB VPN: Group remaining mesh documentation under IPIP Mesh

#REDIRECT [[IPIP Mesh/OH7LZB VPN]]

IPIP Mesh/OH7LZB VPN

2026-09-29T19:27:52Z

KI5QKX: KI5QKX moved page OH7LZB VPN to IPIP Mesh/OH7LZB VPN: Group remaining mesh documentation under IPIP Mesh

The OH7LZB VPN was an experimental method to access the IPIP Mesh using a VPN from anywhere on the Internet. The VPN was openly available to any amateur radio operators who had successfully applied for an X.509 certificate from one of the following Certificate Authorities:

* [http://www.arrl.org/logbook-of-the-world ARRL Logbook of the World (LoTW)]

As of May, 2024, the OH7LZB VPN appears to no longer be operational.

The Certificate Authority (CA) validates using a relatively strong method that the operator is actually licensed, and gives the operator a cryptographic certificate to prove that. Other services, such as this VPN can then check that the operator possesses a valid amateur radio operator certificate (and the accompanying private key), without any manual work being performed by the operators of those services. The operator can use his private key to sign LoTW log files, or any other information he wishes to communicate, and other parties trusting the CA can use the certificate to check that they have been transmitted by someone who has a private key and a certificate for a callsign from the CA.

If and when other organisations start to give out X.509 certificates, after sufficient amateur radio license validation, the VPN will be configured to accept those in addition to the LoTW. If you're not willing to obtain a LoTW certificate, please set up a CA for your local club or association, document the method of license validation you're using, and I'll be happy to trust your certificates.

The VPN operator (Hessu, OH7LZB) does not have time to run a CA and validate licenses manually, so please don't ask for a certificate from anywhere else than the CAs listed above. Thanks!

The VPN is only used to access the IPIP Mesh. While you're connected to the VPN, the VPN client will only transmit packets from you to the IPIP Mesh via the VPN. Packets from you to the rest of the Internet will not go via the VPN - they'll flow out from your local network connection as before. This is called a [http://en.wikipedia.org/wiki/Split_tunneling split tunnel VPN configuration].

The setup is still a bit complicated - it can be made easier and more automatic with a little additional software in a later phase.

The VPN is an experimental service. It might be shut down for technical or political reasons - we'll see if it's a feasible idea or not.

= Getting a certificate from LoTW =

Go through [https://lotw.arrl.org/lotw-help/getting-started/ these simple steps]. After step 4 you're ready to continue with the VPN.

It's going to take some time to validate, and you'll have to do some manual work (especially if you're outside the USA), but that is intentional. It significantly reduces abuse of the system, and increases its security.

= Extracting the certificate from LoTW =

LoTW uses a custom file format (.TQ*) to exchange certificates, but after the LoTW certificate process is done and the TrustedQSL software has your certificates, they can be easily copied from TrustedQSL's directories. You'll need three files: your '''user certificate''', an '''intermediate certificate''' that was used to sign it, and your '''private key'''. The only secret piece of information is the private key - you should not reveal it to anyone at any point, as they could then use services on your behalf, using your callsign.

== Windows ==

* C:\Documents and Settings\your-username\Application Data\TrustedQSL contains two directories, '''certs''' and '''keys'''.
* certs\user contains the '''user certificate'''
* certs\authorities contains an '''intermediate certificate'''
* keys\YOURCALL contains, within some XML, your '''private key'''

Make copies of those files in another directory, and work on those copies in order to avoid breaking the originals.

The user and intermediate certificates need to be concatenated to a single file named '''client.crt'''. The user certificate must be first, followed by the intermediate certificate. That can be done by an ascii editor such as Notepad (Wordpad or Word is likely to mess it up in a big way).

The private key needs to be extracted from the YOURCALL file. The file is a regular ASCII text file, and contains a block which looks something like this (just longer):

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,0C7B5495F6A91F31

0xmWfliK/v9U88MFyYtUbteRoAkfVMK6BllcdID3pZzmdykHaPLZUjXOCUh3vFUX
1bjnYwXpLX/CxgZ6NIxQIk7jMjL3iaP5SkWzCswqi9mCO+zHxuS6PWq7YwbWNFgo
7smNcko1yTp7f/VbS4CZ5kgIF9kCgNaiqdxq+v0IcphQHRR4xjfLpBQ4ckYOi4nC
jqFR1BitwBL4K2JeE9PGUkkUBwvU4oOi9PGChuoxMXs8PwKi/dZTmSWM7kOfMiBw
-----END RSA PRIVATE KEY-----

Copy-paste that block to a separate file named '''client.key'''.

== Linux and Mac ==

* ~/.tqsl/certs/user contains the '''user certificate'''
* ~/.tqsl/certs/authorities contains an '''intermediate certificate'''
* ~/.tqsl/keys/YOURCALL contains, within some XML, your '''private key'''

The user and intermediate certificates need to be concatenated to a single file named '''client.crt'''. The user certificate must be first, followed by the intermediate certificate. That can be done by a single command:

cat ~/.tqsl/certs/user ~/.tqsl/certs/authorities > client.crt

The private key needs to be extracted from the YOURCALL file. The file is a regular ASCII text file, and contains a block which looks something like this (just longer):

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,0C7B5495F6A91F31

0xmWfliK/v9U88MFyYtUbteRoAkfVMK6BllcdID3pZzmdykHaPLZUjXOCUh3vFUX
1bjnYwXpLX/CxgZ6NIxQIk7jMjL3iaP5SkWzCswqi9mCO+zHxuS6PWq7YwbWNFgo
7smNcko1yTp7f/VbS4CZ5kgIF9kCgNaiqdxq+v0IcphQHRR4xjfLpBQ4ckYOi4nC
jqFR1BitwBL4K2JeE9PGUkkUBwvU4oOi9PGChuoxMXs8PwKi/dZTmSWM7kOfMiBw
-----END RSA PRIVATE KEY-----

Copy-paste that block to a separate file named '''client.key'''. If you're going to open up the original private key file in a text editor, it's a good idea to make a backup copy of that file first in case of an accidental corruption of its contents.

= Configuring the VPN =

== Windows: OpenVPN ==

# [http://openvpn.net/index.php/download/community-downloads.html Download the Windows Installer], it's free and open source.
# Run the installer to install it.
# [http://he.fi/amprnet-vpn/amprnet-vpn-win.zip Download the AMPRNet VPN configuration files for Windows]
# Open up the zip file, it contains two files: amprnet-vpn.ovpn and amprnet-vpn-ca.crt.
# In Start menu, under OpenVPN => Shortcuts you'll find an entry named '''OpenVPN configuration file directory'''. Open it, and move the two files from the zip to the configuration file directory.
# Place client.crt and client.key, which were created previously, in the configuration file directory.
# Run the '''OpenVPN GUI''' from the desktop icon or start menu. A new icon will appear in the lower right corner (two computers with red screens + a globe on the side).
# Right-click the OpenVPN toolbar icon and select '''Connect'''.

If you chose to encrypt your private key with a password (or passphrase) when initially applying for a LoTW certificate and generating the Certificate Request, OpenVPN will ask you for that password when connecting.

To rephrase: When OpenVPN says "Enter Password", the password being asked is the one you picked when you first applied for a LoTW certificate. It's not something the VPN operator knows (or should know). It's not the one you got on a postcard. Only you have ever been aware of that password (hopefully).

== Linux: OpenVPN ==

=== Ubuntu 15.10 ===

Here is steps to install the VPN to Ubuntu 15.10 destop. Install OpenVPN plugin to network manager.
Open terminal and type

sudo apt-get install network-manager-open vpn-gnome

Then add VPN-connection information to NetworkManager

# Click network manager icon on taskbar
# Edit connections
# Add
# OpenVPN
# Create
#* Connection name: AMPRNet
#* Gateway: amprnet-vpn1.aprs.fi
#* Select proper files to User Certificate, CA certificate and Private key
#* Optionally enter private key password if you are set one
# Click Advanced
#* [x] Use custom gateway port: 1773
#* [x] Use LZO data compression
# Click OK
# Click Save
# Click Close

Now you can connect to VPN

# Click network manager icon on taskbar
# VPN connections -> AMPRNet
# Connection should be established

== Linux (Raspberry Pi): OpenVPN ==

Log in to Raspberry Pi console. Install openvpn software.

sudo apt-get install openvpn

Create openvpn client configuration file with your favourite editor to /etc/openvpn/client.conf

<pre>
client
dev tun
proto udp
remote amprnet-vpn1.aprs.fi 1773
resolv-retry infinite
persist-key
persist-tun
ca amprnet-vpn-ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
</pre>

Extract your client certificate and key as explained above section Extracting the certificate from LoTW. Copy your certificate files client.crt and client.key to /etc/openvpn/ . You also need amprnet-vpn-ca.crt which can be found inside this archive
http://he.fi/amprnet-vpn/amprnet-vpn-win.zip . Extract it and copy to /etc/openvpn/

Restart openvpn

service openvpn restart

All done.

== Mac OS X: Tunnelblick ==

# [https://tunnelblick.net/ Download Tunnelblick], it's free and open source, and works like a charm. It's based on OpenVPN.
# [http://he.fi/amprnet-vpn/amprnet-vpn-tblk.zip Download the VPN configuration for Tunnelblick], it's a zip file containing a directory with a couple files
# Double-click the downloaded zip file to extract it, you'll get a directory named '''amprnet-vpn.tblk'''
# Move the '''private key''' (in a file which was named '''client.key''' in the previous step) to that directory
# Move the certificates (in a file which was named '''client.crt''' in the previous step) to that directory
# Double-click the '''amprnet-vpn.tblk''' directory - this will launch Tunnelblick and install the VPN configuration

You should now see a "tunnel" icon in the top right corner of the screen. Click it to see a few menu items allowing you to connect and disconnect the VPN.

If you chose to encrypt your private key with a password (or passphrase) when initially applying for a LoTW certificate and generating the Certificate Request, Tunnelblick will ask you for that passphrase when connecting.

To rephrase: When Tunnelblick says "A passphrase is required to connect to amprnet-vpn", the passphrase being asked is the one you picked when you first applied for a LoTW certificate. It's not something the VPN operator knows (or should know). Only you have ever been aware of that passphrase (hopefully).

[[Category:How-To]]
[[Category:Reference]][[Category:How-To Guides]]
[[Category:Participation Methods]]
[[Category:VPN]]

Setting up a gateway in a ROS7 Mikrotik router container on arm32, arm64 and x86-64

2026-09-29T19:09:31Z

KI5QKX: Organize IPIP Mesh documentation and navigation

#REDIRECT [[IPIP Mesh/MikroTik RouterOS 7 Container]]
[[Category:How-To]]
[[Category:Infrastructure]]
[[Category:Gateways]]

MediaWiki:Sidebar

2026-09-29T19:09:31Z

KI5QKX: Organize IPIP Mesh documentation and navigation

Setting up a complete gateway on Ubiquiti EdgeRouter

2026-09-29T19:09:31Z

KI5QKX: Organize IPIP Mesh documentation and navigation

#REDIRECT [[IPIP Mesh/Ubiquiti EdgeRouter with ampr-ripd]]
[[Category:How-To]]
[[Category:Infrastructure]]
[[Category:Gateways]]

Internet Requirements

2026-09-29T19:09:30Z

KI5QKX: Organize IPIP Mesh documentation and navigation

{{DISPLAYTITLE:Internet Requirements}}

44Net does not provide Internet service, so you will need your own Internet connection. This page describes the requirements for your Internet connection to support 44Net services.

== 44Net Connect ==

44Net Connect is the most flexible way to get 44Net onto your device. It works over pretty much any Internet connection that allows outbound UDP traffic, and it can handle changes in your IP address or network seamlessly, which is helpful for devices that roam or change networks.

It can work over home broadband, cellular, satellite, and public Wi-Fi. It can also work behind NAT and CGNAT, and even on some connections that block VPN traffic.

See [[44Net Connect/Quick Start|Connect Quick Start]].

== IPIP Mesh ==

The IPIP Mesh is a long-running project to interconnect 44Net subnets over the Internet using a mesh of IP-in-IP tunnels. Its design assumes an Internet that is largely open and unrestricted, which is less the case today than it was when the project started. It is still possible to participate in the IPIP Mesh, but you may run into obstacles with some ISPs.

=== Requirements ===

==== Inbound access ====

For IPIP Mesh to work, your Internet connection and all intermediate devices, including ISP-provided equipment, must allow:
* IP-in-IP traffic (ipencap protocol 4)
* RIPv2 packets arriving on UDP port 520

==== Public IP address ====

Your public IP address does not need to be static, but it must be reachable from the Internet. If your ISP uses CGNAT, you almost certainly cannot participate in the IPIP Mesh.

==== DNS A record ====

You must configure a DNS hostname that resolves to your public IP address. This hostname is periodically resolved by the Portal to update the IPIP tunnel endpoints broadcast from the gateway via RIP. You can use your own domain name, a free dynamic DNS service, or a free <callsign>.ampr.org record you set up in the Portal.

If your public IP address is not static, you will need a dynamic DNS service to keep your hostname updated. The Portal does not currently provide this.

See [[DNS|DNS setup]] and [[IPIP Mesh/Gateways|gateway setup guides]].

== BGP-announced subnets ==

Announcing via BGP is the most advanced way to get 44Net onto your network.

For running a router on your premises, you will need a connection to a provider willing to handle your subnet.

To announce your subnet from a cloud provider, you will need a provider that supports BYOIP (Bring Your Own IP) and accepts 44Net subnets. In particular, the provider must allow you to announce your subnet [[RPKI and ROAs on 44Net|without RPKI ROAs.]]

See [[BGP/Quick Start|BGP Quick Start]] and [[Guide for ISPs]].

== Speed and quality ==

The speed and quality of service required depends on the intended use of your connection. The WireGuard protocol used by 44Net Connect is designed to be efficient and resilient, and the link itself usually tolerates variable connection quality. The application running over the link may be more more sensitive, however, including things like streaming, voice, remote desktop, or video.

For example, a typical VOIP call generally needs only about 64kbps of bandwidth, so high speeds are not usually necessary for voice applications like IRLP, Allstar, or DMR. LTE or Starlink standby mode may be more than sufficient. Voice applications are sometimes sensitive to packet loss, jitter, and latency, however, so an unstable or marginal connection may work fine or it might not.

Remote operation via remote desktop or a lightweight web UI might only sip bandwidth as well, even streaming audio. Voice QSOs could be fine as far as bandwidth and latency are concerned, but time-sensitive applications like FT8 might not be viable.

== Things to check before you start ==

=== Speed, latency, jitter, and packet loss ===
Testing these may uncover problems that affect your application. You can check these using a speed test like [https://testmy.net/ TestMy] or [https://www.speedtest.net/ Speedtest]. Check both download and upload speeds.

=== Connection stability ===
Less of an issue on typical Internet connections, but a remote site might be on a less stable connection. Many routers record connection quality, which can be useful for estimating link stability. UniFi, for example, has a chart showing packet loss and latency over time.

=== Am I on CGNAT? ===
You can check whether you might be behind CGNAT using an online tool like [https://portwarp.com/tools/cgnat-detector PortWarp CGNAT Detector]. If you are behind CGNAT, you will not be able to participate in the IPIP Mesh or announce your own subnet via BGP, so it'll be 44Net Connect or nothing for you.

[[Category:Reference]]
[[Category:Getting Started]]

FAQ

2026-09-29T19:09:30Z

KI5QKX: Organize IPIP Mesh documentation and navigation

= Frequently Asked Questions =

This page answers common questions about 44Net (AMPRNet), how it works, and how to participate. For detailed setup instructions and technical deep dives, follow the links within each section.

== General ==
=== What is AMPRNet? ===

AMPRNet stands for AMateur Packet Radio NETwork. It is a collection of amateur radio-oriented computers, connected together via a variety of technologies, including radio, Internet, and ethernet. However, all of these computers have an IP address that begins with 44 (that is, IP addresses of the form 44.0.0.0/9 or 44.128.0.0/10). For this reason, AMPRnet can also be referred to as 44Net.

Some further details can be found at [https://en.wikipedia.org/wiki/AMPRNet AMPRNet on Wikipedia] and [https://wiki.ampr.org/wiki/Main_Page AMPRNet Wiki].

=== What is AMPRNet for? ===

The purpose of AMPRNet is to permit experimentation by amateurs in digital networking and to provide computer services to other amateurs using AMPRNet.

=== What does it cost to use AMPRNet? ===

There is no cost for using any AMPRNet facilities, however, there may be costs associated with Internet access to reach AMPRNet and/or amateur radio equipment costs.

== Connecting to 44Net ==
=== How do I connect to AMPRNet? ===

There are four main methods people use:

* VPN
* BGP routing (See Also [[Announcing your allocation directly]])
* Direct radio links.
* IP Tunneling

For a current overview of how connection models coexist as independent systems, see [[Decentralization]].

Note: Functionally, a VPN and a tunnel do much the same thing, except a VPN is designed for privacy (i.e. strong authentication and encryption), whilst IP tunnelling in the AMPRNet context is actually an all-to-all interconnected mesh of tunnels and is not encrypted (as often the data is transferred over radio).

=== What is a VPN? ===

VPN stands for Virtual Private Network. It is a facility that enables a computer to act (using the Internet) as though is physically connected to another computer network. There are many different ways to set up a VPN, so this is beyond the scope of this FAQ. However, it always involves configuring software and accounts on a computer, to connect to the VPN server. Some amateurs who have connections to AMPRNet have set up VPN servers so that other amateurs can achieve a "virtual" connection to AMPRNet. The technical details, account details, and IP address details must be obtained from the operator of that VPN. One such VPN is listed at [https://wiki.ampr.org/wiki/AMPRNet_VPN AMPRNet VPN].

=== What about radio links? ===

In many places, groups of amateurs have established networks of radio links, and often have used one of the preceding approaches so that those radio networks connect to and become part of AMPRNet. You would need to contact those groups regarding frequencies, modes, and address allocations.

=== Can I use an AMPRNet VPN on my home LAN? ===

Generally, yes. Most home modem/routers have good support for VPN usage, although you mustn't use it for general internet access as it is for amateur radio use only!

== Routing and tunneling ==
=== What is IP tunneling? ===

The information that traverses the Internet does so as "packets" of data, traveling over a variety of routes, between a source and a destination. Each packet contains a header, which tells all the devices along the route information such as the source and destination, plus the payload, which is the data to actually be transferred. Clearly, there must be a path all the way from the sources to the destination, and back.
AMPRNet consists of small, non-connected groups of computers, that would otherwise not be able to connect to one another. However, since internet devices along the route really don't care about the contents of the payload section, you can put a completely new packet into that section, including an entirely different header, and its own payload section. That second header has source and destination addresses completely different from the first header - all that is required is that the first destination recognizes the encapsulated packet, de-encapsulates it, and forwards it to the second header destination. Return traffic follows a corresponding process. In that way, 44-net hosts can communicate with other 44-net hosts, by means of encapsulating their data packets in packets to non-44Net hosts. This is called tunneling (or encapsulating). A later section in this FAQ discusses installing a tunnel.
Tunneling is probably the most commonly used method of accessing AMPRNet.

=== How does AMPR over IP tunnel actually work? ===

AMPR nodes are actually not connected via a single tunnel but via a large mesh network of tunnels. Suppose user1 has public IP address 198.51.100.1 and user2 has 203.0.113.1. These two can normally communicate over the internet. However, if both users have a 44Net IP address, user1 can encapsulate the 44 packet into an outer packet and send it to 203.0.113.1. Similarly, user2 can encapsulate the IP packet with the 44Net addresses and send it to 198.51.100.1. In Linux (and most other systems), this is accomplished using a single ipip device and adding a route using the "nexthop" statement. When a packet is pushed into the ipip device, the outer IP header is added and sent to the router in the nexthop statement. A list of all AMPR users is required and this can be either accomplished by downloading a simple textfile and adding the routes manually or by using RIP44, as discussed in the FAQ section below.

=== What is BGP routing? ===

The Internet has millions of different computers connected to it, each having an address. Devices called routers deliver traffic between computers and can send "advertisements" to other routers to tell those other routers about the locations of some of those addresses. The protocol used is called BGP, Border Gateway Protocol. If you are fortunate enough to have a computer that can send BGP advertisements, then you can advertise that your computer is part of the AMPRNet address range, and hence receive AMPRNet traffic.

Unfortunately, most companies and most commercial ISPs will not permit their users to originate BGP advertisements (especially for address ranges that are not in their usual address range), so BGP is not a viable means to connect to AMPRNet for most people. There are Virtual Private Server (VPS) Providers (or Cloud Providers) who will announce your AMPRNet allocation without the need for your own Autonomous System (AS) number. [[Routing your allocation via BGP]] has a list of VPS/Cloud Providers.

Installing BGP is beyond the scope of this FAQ. Note however that you must have written permission from the administrator of the ARDC 44 address space, before you BGP advertise any part of that space.

=== How do I configure a Tunnel? ===

The technique varies according to the Operating System you use. However, all involve the creation of a new "pseudo" interface - unlike your normal ethernet network connection, this one doesn't actually exist on the back panel of your computer. However, it exists as far as the Operating System is concerned. A normal ethernet device accepts a data packet (consisting of a header and payload, as previously discussed) and sends it out the ethernet cable (often via a modem, to the Internet). A "pseudo" interface however accepts a data packet, encapsulates it in the data portion of a new packet, adds a new and different header, and passes all that to the ethernet device, which then processes this new data packet as normal, sending it to a recipient who will de-encapsulate it. Reception of tunneled traffic is the reverse process.

Consequently, two requirements apply:

# The computer must have full connectivity to the non-44 hosts that will send or receive the tunneled packets containing 44-net traffic. You cannot route ALL traffic to the pseudo interface!
# The pseudo driver must have a mechanism to tell it which non-44 net hosts can handle particular subsets of 44-net traffic - very few can handle the entire 44-net range! It should be noted that the information changes quite frequently, as tunnel hosts come and go, so must be updated as described below.

[https://wiki.ampr.org/wiki/Main_Page AMPRNet Wiki] has links to several different ways of configuring tunnels.

=== How do I obtain and maintain a list of tunnel hosts? ===

There are three main mechanisms:

# Log on to the Portal (as described above) and navigate to the "Gateways/List" section that permits downloading of the "encap" file. Download that file, and use a script on the computer to turn it into commands that update the configuration of the tunnel device.
# Receive the encap file by mail, and use a script to process it. You can register for this email on the Portal "Gateways/Options" page.
# Receive and process "broadcasts" of configuration data that are available. This information is broadcast to all gateways listed on the Portal. There is a software package called "ampr-ripd" that enables this process

=== Can BGP, VPN, and IP tunnel hosts inter-communicate? ===

Yes. The AMPRNet gateway has been configured to support this functionality.

=== What is the AmprGW? ===

The AmprGW is a server run by ARDC at UCSD as part of a long-running Internet research project. It has a number of functions:

# It provides a selective gateway between non-AMPRNet internet devices and the IPIP (mesh) AMPRNet. For this traffic, it filters at the per-host(/32) level. Each host which is to receive traffic from the Internet into AMPRNet must individually be listed in the permissions file, which is built from the AMPR.ORG DNS 'A' records. If there is no DNS A record for a tunneled amprnet destination host, the traffic is not forwarded in either direction. Therefore, if you want hosts on your subnet to be able to communicate with the Internet, you will need to have your local coordinator add them to the AMPR.ORG DNS for you.
# It forwards traffic between Internet hosts (including those AMPRNet that are directly connected to the Internet [BGP-routed]) and IPIP tunneled AMPRNet hosts. Some "validity" filtering is applied during this process - traffic that is invalid or misconfigured will be dropped. Note: AmprGW does NOT forward between different IPIP tunneled AMPRNet hosts. That is why you cannot have just a single IPIP tunnel for all of AMPRNet. Thus the tunneled AMPRNet as a whole forms a fully-connected mesh, not a 'star' configuration.
# AmprGW originates RIP44 broadcasts containing routing information about gateways and the AMPRNet subnets they service. The RIP44 transmissions are sent as IPIP encapsulated UDP packets for port 520 from 169.228.34.84 and sent individually to the commercial (external) address of every gateway. The packets have an inner source address of 44.0.0.1 and an inner destination of 224.0.0.9, the RIP multicast address. They are IPIP encapsulated packets, so without de-encapsulating them, the RIP is not visible to conventional routing software. Specialized software such as 'ampr-ripd' may be employed to make use of the RIP44 broadcasts, to set up AMPRNet routes.

== Address allocation and DNS ==
=== How do I get an address allocation? ===

If you connect to an existing VPN or existing radio network, it is likely that the operators of those facilities will already have address ranges established and will allocate your address(es). If you wish to establish a new tunnel or BGP-based link, then the process is handled by a semi-automated process on our Portal. The steps are:

# Register using your callsign on the Portal [https://portal.ampr.org portal.ampr.org]
# Log in and navigate to the Networks page.
# Click on your country. A list of regions/subnets may appear; if so, click on the appropriate one.
# Click on the subnet and you'll be presented with a simple form to complete.
# If you are requesting a single address for a host, leave the netmask as /32;
# if you are requesting a block/subnet, select the appropriate netwidth. E.g. for a 256 host subnet, select /24.
# Put a short message explaining your request in the Message area of the form. Be sure to indicate if you are planning to directly route a subnet as these require special handling
# Click Send. Your request will be forwarded to the coordinator for your region/subnet. You'll receive a confirming email. The coordinator may contact you for further details if required.

=== Can I have a domain name entry for my AMPRNet host? ===

Yes. Currently, domain name requests are handled by the area coordinators - contact details are on the Portal. Note: the old email robot facility no longer functions.

=== What about IPv6? ===

There is no IPv6 equivalent of AMPRNet at present.

== Security ==
=== Do I need to consider security? ===

Yes! Any computer connected to the Internet must be configured and maintained in a secure fashion, and this includes any computer connected to AMPRNet (regardless of the connection technique). Repeat - you MUST secure your computer! This includes using firewalls, keeping software up to date, using strong passwords, etc etc. In some cases, encryption may also be used.

How to maintain security is beyond the scope of this FAQ. Searching for "How to secure my computer" will return many, many hits though!

=== Can I put my tunnel on my home LAN and use NAT? ===

Yes. However, in general, a home modem using NAT won't be able to correctly process inbound tunneled 44-net traffic and forward it to the correct host - the "port forward" facility in most NAT devices relies on a port number, but there are no port numbers for a tunnel packet! However, most modems have a "DMZ" facility, whereby all unrecognized traffic (and this includes tunneled traffic) can be forwarded to one particular host on the LAN. That host can then be configured to recognize and correctly process tunneled data. However - security alert! - it will also be exposed to all sorts of other, unwanted traffic as well! See the Security section above.

== Troubleshooting ==
=== I rebooted my router and now I can't talk to the Internet, what's going on? ===

If AMPRGW detects errors when attempting to send traffic to a tunnel's configured gateway, it will automatically throttle traffic through that tunnel for approximately one hour. This is meant to prevent endlessly sending traffic to gateways that are no longer in service. An example of the sort of errors that will trigger this are ICMP Host Unreachable messages generated by an upstream provider, such as an ISP. Empirically, several users have observed that rebooting a gateway can pause traffic long enough for this to happen. However, traffic will start flowing again in an hour or so.

=== How can I get help with AMPRNet issues? ===

Many amateurs are willing to assist other hams. You can find some of them on the groups.io 44Net group here [https://ardc.groups.io/g/44net 44Net on groups.io]

== Policy and network constraints ==
=== Why can’t 44Net publish ROAs for its prefixes? ===

Because ARIN does not provide RPKI or IRR services for legacy resources that are not covered by an ARIN agreement.

That means 44Net cannot currently create ARIN-issued ROAs for those resources, even though other registry functions such as Whois/RDAP maintenance and reverse DNS delegation may still be available.

For the detailed explanation, see [[RPKI and ROAs on 44Net]].

=== Why can’t I route my 44Net allocation directly from home? ===

Unfortunately, networks have experienced [http://en.wikipedia.org/wiki/Denial-of-service_attack denial of service attacks] due to [http://en.wikipedia.org/wiki/IP_address_spoofing IP address spoofing].

In order to combat these attacks, most Internet Service Providers (ISPs) have adopted practices defined by the Internet Standards [http://tools.ietf.org/html/bcp38 BCP38] and [https://tools.ietf.org/html/bcp84 BCP84].

Two of these practices are [http://en.wikipedia.org/wiki/Ingress_filtering ingress filtering] and [http://en.wikipedia.org/wiki/Reverse_path_forwarding#Unicast_RPF_.28uRPF.29 Unicast Reverse Path Forwarding].

These practices prevent IP address spoofing by blocking packets whose IP source address is not the in the IP subnet range where the packet originated.

If your ISP implements these practices (and they should), you will be unable to transmit packets using your AMPRNet allocation as the source address directly from your home network.

In addition, only ISPs and other authorized networks can announce routes globally. Your ISP will block any attempts by you to advertise your AMPRNet allocation without their permission. Announcing your AMPRNet allocation directly, without the permission of the AMPRNet network administrator, is a violation of AMPRNet's Terms of Service and Acceptable Use Policy.

The three ways around these restrictions are:

# [[IPIP Mesh/Linux|Creating direct tunnels to other AMPRNet subnets using a gateway]]
# [[Routing your allocation via BGP|Working with AMPRNet and your ISP to properly announce your allocation directly]]
# [[AMPRNet VPN|Accessing AMPRNet via VPN]]

=== What about 44.128.0.0/16? ===

Subnet 44.128.0.0/16 is currently reserved for testing. No operational subnets are planned for this address space. Older documentation incorrectly referred to this block of addresses as "private", that is, unrouted like the 192.168.0.0/16 RFC1918 subnet. This is incorrect; the 44.128.0.0/16 subnet can be routed, but do not use it except for brief test purposes.

== Credits ==

This FAQ was originally commenced by Steve VK5ASF, using material from earlier FAQs, from various contributors to the 44Net mailing list, and from Brian Kantor.

[[Category:Reference]]
[[Category:Getting Started]]

AX.25 on Linux

2026-09-29T19:09:30Z

KI5QKX: Organize IPIP Mesh documentation and navigation

{{DISPLAYTITLE:AX.25 on Linux}}

{{Note|This page is a work in progress. It is not yet complete, and it may contain inaccuracies or outdated information.}}

As of April 2026, the in-tree kernel AX.25 stack has been removed from upstream Linux. This affects systems and applications that depend on Linux kernel AX.25 interfaces, but it does not mean AX.25 packet radio on Linux is going away.

== In this guide ==

* [[AX.25 on Linux/Kernel vs user space]]: How the old kernel model differs from the user space model
* [[AX.25 on Linux/Migration options]]: Common software and migration approaches
* [[AX.25 on Linux/IP over AX.25]]: Possible directions for IP networking over AX.25
* [[AX.25 on Linux/Developing user-space tools]]: Design considerations for new work

== Summary ==

* If your setup uses KISS or AGWPE to talk to a software TNC, hardware TNC, or packet-radio application, you are probably not affected by the kernel removal.
* If your setup uses Linux AX.25 interfaces like <code>ax0</code>, <code>kissattach</code>, <code>/etc/axports</code>, or <code>ax25d</code>, it will not keep working unchanged on future kernels.
* Nothing breaks immediately just because the upstream kernel changed. Existing systems keep working until you update them to a kernel released after the change.

This page explains what changed, how to tell whether your station depends on that older model, and what practical options exist now.

== What is changing ==

* Mainline Linux no longer includes the traditional Linux AX.25, Net/ROM, and ROSE stack.
* Existing documentation that assumes <code>kissattach</code>, <code>/etc/axports</code>, <code>ax</code> interfaces, or <code>ax25d</code> will no longer apply to systems running newer kernels.
* Software that depends specifically on kernel AX.25 interfaces will be unable to run unchanged on newer kernels.
* Software that talks directly to KISS, AGWPE, serial TNCs, TCP TNCs, or its own built-in AX.25 implementation may continue to work without the kernel AX.25 stack.
* The out-of-tree repository <code>linux-netdev/mod-orphan</code> will host the removed code for those who want to inspect it or maintain it separately.

== Timeline ==

This change happened in “upstream Linux” first, referring to the mainline Linux kernel project. Distributions like Debian, Ubuntu, and Fedora decide for themselves when to ship newer kernels, and long-term-support distributions may stay on older kernel lines for quite a while.

That means this probably is not hitting most existing stations tomorrow. In many cases, you will keep working until your distribution moves you to a kernel that no longer includes the in-tree AX.25 code, whether that happens in a major distribution upgrade or in a later kernel update.

So you have some time to plan, but you may want to pay attention to updates that include newer kernels.

== Am I affected? ==

Yes, if your setup uses the Linux kernel AX.25 model. Probably not, if you use software that talks to devices directly.

You are probably using the kernel AX.25 stack if:

* <code>ifconfig</code> or <code>ip link</code> shows <code>ax</code> interfaces like <code>ax0</code>
* You use <code>kissattach</code>
* You configure <code>/etc/axports</code>
* You use <code>ax25d</code>
* Your application is configured to use a Linux AX.25 port or interface rather than KISS, AGWPE, serial, TCP, or a built-in packet engine

You are probably using a user-space approach if:

* <code>ifconfig</code> or <code>ip link</code> does not show any <code>ax</code> interfaces
* You already use a user-space TNC like Dire Wolf without <code>kissattach</code>
* Your application has its own AX.25 support built in, as many APRS tools do
* Your applications talk to KISS or AGWPE directly, whether to a software TNC, hardware TNC, or another packet-radio program

If you are not sure, look at how your application is configured. KISS or AGWPE options are a good sign.

== What should I do? ==

Broadly speaking, there are a few paths: keep the system running as it is, reconfigure applications around a different host-side interface, or replace part of the stack.

=== Freeze (keep it running as is) ===

If you’re using software that depends on kernel AX.25, future kernel updates will break it. If you want to keep that software working, the simplest path may be to stay on the version of Linux you have now.

You can keep using that system for as long as you like, but you will find ample advice to consider the security implications. Older kernels do not receive fixes for newly discovered vulnerabilities, and the longer a system stays pinned to an old kernel, the more exposed it can become. If you choose this path, it is worth taking extra precautions to secure the system.

=== Reconfigure ===

If you’re using software released relatively recently, you may be able to reconfigure it. For example, an APRS application that can use AGWPE or KISS over TCP or serial may only need to be pointed at Dire Wolf or a hardware TNC via a different protocol.

=== Replace ===

This is the likely path when the old application depends on the kernel AX.25 stack and cannot be reconfigured to use anything else. You may be looking at anything from replacing one piece to rebuilding your stack from top to bottom. Depending on your goals, you might consider moving to something that has AX.25 and common packet tools built in, like LinBPQ or JNOS. You might also consider a more modular approach, with a software TNC like Dire Wolf and separate applications for messaging, BBS, or APRS.

=== Revive ===

There is always the option of resurrecting or re-implementing the old kernel code; the kernel maintainers have not ruled out merging up-to-date code back in. If you have the technical interest and motivation, there’s nothing to stop you.

The state of maintenance for the code that was just removed and the state of development in other tools might be considerations when evaluating this path. ARDC did fund [https://www.ardc.net/apply/grants/2021-grants/grant-fixing-the-linux-kernel-ax-25/ an effort related to AX.25 in the kernel] that encountered unexpected challenges and was not able to proceed.

New coding tools may make this a more approachable project than it might have been in the past, with some caveats noted in the [https://docs.kernel.org/process/index.html#an-introduction-to-how-kernel-development-works Linux kernel development documentation], particularly around [https://docs.kernel.org/process/coding-assistants.html the use of large language models].

== Further reading ==

=== ARDC groups.io discussions ===

* [https://ardc.groups.io/g/community/topic/119004386 Boudewijn VE3TOK’s thread and discussion about paths forward]
* [https://ardc.groups.io/g/community/topic/119004386 Bernard F6BVP’s retrospective and thoughts on the change]

=== Kernel discussions ===

* [https://lore.kernel.org/netdev/20260421021824.1293976-1-kuba@kernel.org/ Jakub Kicinski’s April 21, 2026 patch], proposing removal of the in-tree amateur-radio networking subsystem
* [https://lore.kernel.org/lkml/20260423235422.1541768-1-kuba@kernel.org/ Jakub Kicinski’s April 23, 2026 pull-request thread], with more discussion
* [https://lore.kernel.org/netdev/20260424232427.792249-1-stephen@networkplumber.org/ Stephen Hemminger’s April 24, 2026 iproute2 cleanup patch], noting that AX.25, ROSE, and NET/ROM have been removed upstream
* [https://lore.kernel.org/netdev/CAEoi9W6ZRw6aEh62Xbgkg-TW8URHbVp6dHTT9krFiTkotjTuTA@mail.gmail.com/ Dan Cross on the likely user-space direction], including TUN/TAP for IP over AX.25

=== Independent coverage ===

* [https://lwn.net/Articles/1068928/ LWN coverage from April 22, 2026], summarizing the broader kernel code-removal effort
* [https://www.phoronix.com/news/Linux-7.1-PR-Remove-Old-Net Phoronix coverage from April 24, 2026], on the pull request removing legacy networking code, including AX.25

=== Repositories and source trees ===

* [https://github.com/linux-netdev/mod-orphan linux-netdev/mod-orphan], the out-of-tree repository where the removed code is being staged

=== Older HOWTOs ===

* [http://www.tldp.org/HOWTO/AX25-HOWTO/ Jeff Tranter VE3ICH’s 2001 Linux AX.25 HOWTO], useful mainly as historical background now

=== Protocol references ===

* [https://files.tapr.org/tech_docs/AX25/AX25.2.2.1997.pdf AX.25 Link Access Protocol for Amateur Packet Radio, Version 2.2]
* [https://ax25.net/ AX.25 Layer 2]
* [https://www.on7lds.net/42/sites/default/files/AGWPEAPI.HTM AGWPE TCP/IP API reference]
* [https://github.com/wb2osz/direwolf/blob/master/doc/AX25_plus_FEC_equals_FX25.pdf Dire Wolf’s AX.25 framing and FEC documentation]

== Related pages ==

* [[Getting started with Linux and packet radio]]
* [[IPIP Mesh/Linux|Setting up a gateway on Linux]]
* [[IPIP Mesh/Gateways|Gateway]]
* [[Routing]]
* [[MTU and MSS]]

[[Category:Explanation]]
[[Category:Reference]]
[[Category:Infrastructure]]

Provisioning Methods

2026-09-29T19:09:29Z

KI5QKX: Organize IPIP Mesh documentation and navigation

{{DISPLAYTITLE:Provisioning Methods}}

New here? Start with [[GetStarted|Getting started]].

There is no single way to provision 44Net. The network is fundamentally decentralized, and operators participate from within different environments and toward different goals.

The provisioning models people have developed reflect those operational realities rather than a progression of experience, but there are some learning opportunities associated with moving among them or combining them.

To understand more about decentralization and why these approaches exist, see [[Decentralization]].

== Current provisioning models ==

=== [[44Net Connect/Quick Start|44Net Connect]] ===

Provision 44Net to a single device or small network using a tunnel. This model works from typical home networks, cloud hosts, mobile environments, and other locations where direct routing infrastructure is not available.

=== [[IPIP Mesh/Quick Start|IPIP Mesh]] ===

Participate in a shared community routing environment. Independently operated stations link with one another through a mesh of tunnels, and traffic to or from the wider Internet typically transits shared gateways (such as at UCSD). This model is common in long‑running regional and club networks.

=== [[BGP/Quick Start|BGP-announced subnet]] ===

Integrate 44Net directly into independently operated routing infrastructure. Operators announce their allocated prefixes using BGP and maintain their own routing policy and operational practices. This model is suited to research networks, {{Term|IX}}-connected operators, multi-homing, community backbones, and other autonomous environments.

== Comparing the approaches ==

{| class="wikitable"
! Model
! Typical environment
! How routing reaches you
! Operational responsibility
|-
| 44Net Connect
| Single host or small network without direct routing infrastructure
| Tunnel between your device and a point of presence
| Managing the tunnel and the provisioned subnet
|-
| IPIP Mesh
| Regional or community network with shared routing
| Shared mesh gateways (such as UCSD)
| Operating a mesh node and participating in shared routing
|-
| BGP-announced subnet
| Independently routed infrastructure
| Global routing via BGP
| Operating routers, BGP edge, and routing policy
|}

== How to choose ==

If you want to provision 44Net to a single device or a small LAN without operating routing infrastructure, start with '''44Net Connect'''.

If you are participating in a regional or club network that exchanges routes cooperatively, or if you are working with a [[Regional Coordinator]], consider '''IPIP Mesh'''.

If you already operate routed infrastructure and want your 44Net prefixes announced as part of your existing routing environment, use a '''BGP-announced subnet'''.

== Under the hood ==

All provisioning models place your systems into the same shared 44Net address space. The differences are operational: how routes reach your network, where gateways exist, and who is responsible for routing decisions. These distinctions reflect the decentralized structure of 44Net rather than separate networks.

== Learn more ==

* [[GetStarted|Getting started]]
* [[Routing|Routing and connectivity]]
* [[CommunityProjects|Community projects]]
* [[Decentralization|How Connect, IPIP Mesh, and BGP fit together]]

== Older docs and notes ==
Earlier pages that may still be useful:
* [[IPIP Mesh/Gateways|Gateway]]
* [[IPIP Mesh/Registering Your Gateway|Registering Your Gateway]]
* [[Tunnel]]
* [[AMPRNet VPN]]
* [[Routing your allocation via BGP]]
* [[Announcing your allocation directly]]
* [[FAQ|Why can’t I announce my allocation directly?]]
* See [[Archive]] for more.
[[Category:Explanation]]
[[Category:Participation Methods]]

IPIP Mesh

2026-09-29T19:09:29Z

KI5QKX: Organize IPIP Mesh documentation and navigation

{{DISPLAYTITLE:IPIP Mesh (Stub)}}

== What this page is ==
This is an overview stub for the IPIP Mesh participation model on 44Net.
For setup steps, start with [[IPIP Mesh/Quick Start|IPIP Mesh Quick Start]].

== Start here ==
* [[IPIP Mesh/Quick Start|IPIP Mesh Quick Start]]
* [[Provisioning Methods|Provisioning Methods]]
* [[GetStarted|Getting started]]
* [[Routing|Routing and connectivity]]
* [[Community|Community and mailing lists]]

== Existing documentation ==
These pages cover mesh gateways, setup, and routing. Some guides describe older systems and have not been revalidated.

=== Gateways ===
* [[IPIP Mesh/Gateways|How mesh gateways connect]]
* [[IPIP Mesh/Registering Your Gateway|Registering your gateway]]
* [[IPIP Mesh/Amprgw|The shared Internet gateway (Amprgw)]]
* [[IPIP Mesh/Firewalls|Firewall configuration]]

=== Platform guides ===
* [[IPIP Mesh/Linux|Linux]] and [[IPIP Mesh/Ubuntu Linux Gateway Example|Ubuntu example]]
* [[IPIP Mesh/macOS|macOS]] (unfinished)
* [[IPIP Mesh/Cisco|Cisco]]
* [[IPIP Mesh/MikroTik|MikroTik]] and [[IPIP Mesh/MikroTik RouterOS 7 Container|RouterOS 7 container]]
* [[IPIP Mesh/OpenBSD|OpenBSD]]
* [[IPIP Mesh/OpenWrt|OpenWrt]]
* [[IPIP Mesh/Ubiquiti EdgeRouter|Ubiquiti EdgeRouter: single tunnel]]
* [[IPIP Mesh/Ubiquiti EdgeRouter with ampr-ripd|Ubiquiti EdgeRouter with ampr-ripd]]
* [[IPIP Mesh/VyOS|VyOS]]

For other connection methods, see [[:Category:Device and platform guides|device and platform guides]].

=== Routing references and tools ===
* [[IPIP Mesh/RIP|RIP route announcements]]
* [[IPIP Mesh/Encap.txt|Encap.txt]] and [[IPIP Mesh/Encap.txt/get-encap|get-encap script]]
* [[IPIP Mesh/Ampr-ripd|ampr-ripd]], [[IPIP Mesh/Rip44d|rip44d]], and [[IPIP Mesh/RIP44.lua|RIP44.lua]]
* [[IPIP Mesh/Munge script|Munge scripts]] and [[IPIP Mesh/Startampr|startampr]]

== What this page will cover ==
* What the IPIP Mesh model is and where it fits.
* Peering and topology expectations for mesh participants.
* Operational responsibilities in shared routing environments.
* Common validation and troubleshooting workflows.

== Related pages ==
* [[IPIP Mesh/Quick Start|IPIP Mesh Quick Start]]
* [[Decentralization|How Connect, IPIP Mesh, and BGP fit together]]
* [[Provisioning Methods|Provisioning Methods]]
* [[Contributing|Contributing]]

== Contribute / next steps ==
If you run an IPIP Mesh node and can share practical guidance, please contribute through [[Contributing]] so this stub can be expanded into a full reference page.
[[Category:Explanation]]
[[Category:Participation Methods]]
[[Category:IPIP Mesh]]

IPIP Mesh/Quick Start

2026-09-29T19:09:28Z

KI5QKX: Organize IPIP Mesh documentation and navigation

{{DISPLAYTITLE:IPIP Mesh Quick Start (Stub)}}

== What this page is ==
This is an orientation stub for joining the shared IPIP Mesh model on 44Net.
A full quick start procedure is not published yet.

== What you can do today ==
* Confirm that a shared mesh model fits your goals in [[Provisioning Methods|Provisioning Methods]].
* Complete account and verification prerequisites in [[GetStarted|Getting started]] and [[Portal/Sign Up|Portal Sign Up]].
* Identify local or regional peers and gateway expectations via [[Community|Community and mailing lists]].
* Review routing responsibilities in [[Routing|Routing and connectivity]].

== What this page will cover ==
* Prerequisites for mesh participation and peering.
* Endpoint setup expectations and addressing model.
* Shared gateway behavior and traffic flow patterns.
* Operational coordination with regional maintainers.
* Validation and troubleshooting checklist.

== Related pages ==
* [[Provisioning Methods|Provisioning Methods]]
* [[GetStarted|Getting started]]
* [[Routing|Routing and connectivity]]
* [[Community|Community and mailing lists]]
* [[Portal/Request Address Space|Request Address Space]]
* [[Contributing|Contributing]]
* [[Decentralization|How Connect, IPIP Mesh, and BGP fit together]]

== Contribute / next steps ==
If you already operate in the mesh, contribute a minimal reproducible setup path with topology notes and failure modes. Submit through [[Contributing]] so this stub can become a complete Quick Start.

== Older docs and notes ==
See [[IPIP Mesh#Existing documentation|the IPIP Mesh documentation directory]] for platform guides and routing tools. Earlier pages that may still be useful:
* [[IPIP Mesh/Gateways|Gateway]]
* [[IPIP Mesh/Registering Your Gateway|Registering Your Gateway]]
* [[IPIP Mesh/Encap.txt|Encap.txt]]
* [[IPIP Mesh/Encap.txt/get-encap|Encap.txt/get-encap]]
* [[IPIP Mesh/Rip44d|Rip44d]]
* [[IPIP Mesh/RIP44.lua|RIP44.lua]]
* [[IPIP Mesh/Amprgw|Amprgw]]
* [[IPIP Mesh/Ampr-ripd|Ampr-ripd]]
* [[IPIP Mesh/Linux|Setting up a gateway on Linux]]
* [[IPIP Mesh/OpenBSD|Setting up a gateway on OpenBSD]]
* See [[Archive]] for more.
[[Category:Tutorial]]
[[Category:How-To]]
[[Category:Participation Methods]]
[[Category:IPIP Mesh]]
[[Category:Getting Started]]

Main Page

2026-09-29T19:09:28Z

KI5QKX: Organize IPIP Mesh documentation and navigation

{{DISPLAYTITLE:44Net Main Page}}
<div class="toclimit-3">
__TOC__
</div>

{{Lead|44Net is a community of amateur radio operators using portable, public, static IP addresses to connect stations, run services, and experiment with networks.}}

[[About 44Net|About 44Net and its history →]]

{{Section|variant=secondary|
=== Get started with 44Net ===

{{SectionLayout|min=16rem|gap=0.75rem|
{{SectionCard|
==== 44Net Connect ====
The recommended way to get 44Net, using your existing Internet connection and a WireGuard tunnel.

[[44Net Connect/Quick Start|Set up a Connect tunnel →]]
}}

{{SectionCard|
==== IPIP Mesh ====
Run a gateway in the community-operated mesh, connecting to other 44Net networks through IP-in-IP tunnels.

[[IPIP Mesh/Gateways|How the mesh works →]]
}}

{{SectionCard|
==== BGP-announced subnet ====
Have an ISP or hosting provider announce your subnet to the Internet, or announce it through your own network.

[[BGP/Quick Start|Arrange a BGP announcement →]]
}}
}}
}}

{{Section|variant=primary|
== What you need ==

=== 1. Equipment ===
A computer, mobile device, Raspberry Pi, or a router from common manufacturers including Netgear, Ubiquiti, or MikroTik. Setup depends on the model and connection method. Browse the [[:Category:Device and platform guides|device and platform guides]] to find a starting point.

=== 2. Internet connection ===
44Net does not provide Internet connections, it provides resources. Some use 44Net over RF links, but most participants use an existing broadband Internet connection, including cable, fiber, cellular, or satellite. For more on Internet connection requirements, see [[Internet Requirements|requirements for your connection]].

=== 3. A valid amateur radio operator's license ===
44Net is a community of licensed amateur radio operators, and you must be licensed to participate. For more about this, see [[Verification|license requirements]].
}}

{{Section|
== What people build ==
You can run a single system, collaborate on shared projects, or build independent networks. As with amateur radio in general, 44Net is what we make of it, and there is no single “right” way to participate!

{{SectionLayout|min=16rem|class=mw-section__layout--build|
{{SectionCard|
=== Individual projects ===
Remote station operation, self-hosted services, cloud services with {{Term|BYOIP}}.

==== Examples: ====
* [https://ni2o.ampr.org NI2O’s bit of Cyberspace]
* [https://yo2loj.ampr.org YO2LOJ’s map of 44Net]
}}

{{SectionCard|
=== Shared infrastructure ===
Club networks, linked repeaters, and services for the wider community.

==== Examples: ====
* [https://www.irlp.net The Internet Radio Linking Project]
* [https://hamgate.ampr.org HamGate Northeast US Networks]
}}

{{SectionCard|
=== Autonomous networks ===
Multi-site links, resilient backbones, and
globally-routed independent systems.

==== Examples: ====
* [https://www.darc.de/der-club/distrikte/c/hamnet/ HamNET broadband RF network]
* [https://www.arednmesh.org AREDN Emergency Data Network]
}}
}}

'''Looking for ideas? Try one of these:''' [[Minecraft|Run a Minecraft server]] · [[Home Assistant|Connect Home Assistant]]

[[What People Build|See more projects →]]
}}

{{Section|variant=secondary|
== Work on your network ==
* [[Portal/Introduction|Manage your Portal account and resources]]
* [[DNS/Portal|Set up DNS names]]
* [[44Net Connect/Supported Platforms|Find Connect instructions for your device]]
* [[Routing|Understand routing and check traffic paths]]
* [[Firewalling Basics|Configure a firewall]]
* [[Get Help|Get help with a problem]]
}}

== Join us ==
You are welcome in the [[Community|community discussions]], whether you have a project underway or are just curious. Ask questions, share what you are trying, or listen for a while. As you learn, your [[Contributing|notes and contributions]] can help the next person get started.

== A shared project ==
44Net is a project of [[ARDC|Amateur Radio Digital Communications (ARDC)]]. As part of the 44Net community, ARDC works alongside operators and volunteers to steward the address space and provide support on the community's behalf. Together, we all help keep 44Net useful by looking after our systems, sharing what we learn, and making room for others.

For details about participating, see [[Eligibility|eligibility]] and the [[EULA|terms of use]]. Earlier documentation is in the [[Archive|archive]].

[[Category:Explanation]]
[[Category:Getting Started]]

Services

2026-09-29T19:09:28Z

KI5QKX: Organize IPIP Mesh documentation and navigation

{| class="wikitable sortable"
|-
! Maintainer !! Service Name!! URL/IP !! Service Type !! Description !! Other Information
|-
| AMPR ||[[Portal]] || https://portal.ampr.org || HTTPS || Used to request allocations, manage user profile information, [[IPIP Mesh/Gateways|Gateway]] entries and ampr.org DNS entries|| NONE
|-
| AMPR ||Website || https://www.ampr.org || HTTPS || AMPRNet Main Page|| NONE
|-
| AMPR ||Wiki || https://wiki.ampr.org || HTTPS || This Wiki|| NONE
|-
| AMPR ||44Net discussion group || https://ardc.groups.io/g/44net || HTTPS || AMPR discussion group|| NONE
|-
| AMPR ||ARDC announcements || https://ardc.groups.io/g/main || HTTPS || ARDC announcements|| NONE
|-
| AMPR ||AMPRNet Gateway [[IPIP Mesh/Amprgw|(AMPRGW)]] || amprgw.ucsd.edu/169.228.34.84 || IP and IPENCAP [[Tunnel]]|| Routes traffic between the public internet and AMPRNet hosts connected via the IPIP Mesh and originates [[IPIP Mesh/RIP|RIP]] packets || Gateways use IP Protocol 4 (IPENCAP) to receive traffic via AMPRGW. Allocation must be registered in the [[Portal]] with a ampr.org DNS entry, and gateways must run an AMPRNet routing protocol (i.e. [[IPIP Mesh/RIP|RIP]]44 or [[IPIP Mesh/Munge script|munge script]])
|-
| AMPR ||[[IPIP Mesh/RIP|RIP]]44 || provided via [https://en.wikipedia.org/wiki/Broadcasting_%28networking%29 broadcast] from 44.0.0.1 to all [[IPIP Mesh/Gateways|gateway]]s registered in the [[Portal]] || Routing Information (modified RIPv2 protocol) || distributed by main AMPRNet Router to multicast address 224.0.0.9|| 1.) an enabled IPENCAP tunnel, and 2.) [[IPIP Mesh/Ampr-ripd|ampr-ripd]] or [[IPIP Mesh/Rip44d|rip44d]] must be running and properly configured on your registered gateway
|-
| Various Operators||[[Ampr.org]] DNS and Reverse DNS (44.in-addr.arpa) ||
ns.ardc.net 
a.gw4.uk 
ns2.us.ardc.net 
ns1.de.ardc.net 
(These hosts are authoritative for AMPR.ORG and most of the '[0-191].44.in-addr.arpa' reverse zones. 
 
44.0.0.0/9 thru 44.128.0.0/10 hosts may use dns-mdc.ampr.org (44.60.44.3) as a recursive DNS server. It also has a copy of HAMWAN.ORG 
srv.kz2x.ampr.org (44.44.48.29) is a recursive resolver available to 44.0.0.0/9 and 44.128.0.0/10 
|| DNS || name resolution services||
|-
| Various Operators||Network Tools||
http://whatismyip.ampr.org 
http://yo2loj.ampr.org/nettools.php 
http://kb3vwg-010.ampr.org/AMPRNet_access_only/tools/ 
http://speedtest.ampr.org 
http://lg.vk7sh.asmpr.org 
|| HTTP|| source IP checker, speed test, Ping, Traceroute, etc.||
'''kb3vwg-010.ampr.org''' only available from hosts with an AMPRNet IP address 
'''lg.vk7sh.asmpr.org''' only available from hosts with an AMPRNet IP address
|-
| Various Operators ||Network Time Protocol || ntp.vk2hff.ampr.org (Stratum 1, AU) time.kz2x.ampr.org (Stratum 1, US) kb3vwg-001.ampr.org (Stratum 2, US) gw-44-137.pi9noz.ampr.org (Stratum 2)|| NTP|| Stratum 2 Network Time Server - References US, Canadian and Mexican|| '''kb3vwg-001.ampr.org''' only available from hosts with an AMPRNet IP address '''time.kz2x.ampr.org''' only available from hosts with an AMPRNet IP address
|-
| N1URO ||AMPRNet/RF faxing || http://wiki.ampr.org/wiki/axMail-FAX || Facsimile || Online IP based Facsimile service. You have the ability to send emergency communications from packet via Fax. || [http://axmail.sourceforge.net axMail-FAX] Sofware is here.
|-
| [http://allstarlink.org AllStar Link] || AllStar || http://allstarlink.org || Linking of repeaters || AllStar Link core network services are provided via redundant datacenters using 44Net IP space. || [https://wiki.allstarlink.org/wiki/Main_Page ASL wiki]
|-
| N2NOV and G1FEF || Hub_NA and Hub_EU for WWconvers Chat System || 44.68.41.2:3600 convers.g1fef.co.uk:3600 || Telnet || Only connections from other 44Net addresses allowed using port 3600. Stations like JNOS with a built-in local chat server can link to it. Individuals without a local chat portal can use an IRC client to a public IP address that must be arranged with the owner. || None
|-
| N2NOV || AMPRNet NE US Regional Portal || http://n2nov.ampr.org/hamgate.html || HTTP || AMPRNet NE US Regional Portal || None
|-
| N0QVC || Network Tools JNOS Bulletin Board Convers (Chat) Server || http://n0qvc.ampr.org http://44.27.24.17 telnet://jnos.n0qvc.ampr.org telnet://44.27.24.18 telnet://jnos.n0qvc.ampr.org:81 telnet://44.27.24.18:81 || HTTP Telnet Telnet || Source IP checker, Ping, Traceroute, etc. BBS Chat || Services only available from hosts with an AMPRNet IP address
|-
| [https://flscg.org/ FSG]|| HamWAN Remote || https://flscg.org/2022/04/hamwan-remote/ || VPN/BGP || We provide a VPN based remote site connection to [https://flscg.org/hamwan/ HamWAN Tampa] and can announce your IP space. Performance of over 1gbit/s is possible and we provide an local connection point for amateurs in the South Eastern United States. || https://wiki.w9cr.net/index.php/HamWAN_Remote_Site
|-
| [https://hamwan.org HamWAN]||HamWAN Open Peering||https://hamwan.org/Labs/Open%20Peering%20Policy.html||BGP/IPSec(AH)||We provide IPsec VPN w/ BGP peering + Internet announcing.||
|-}

Services previously available on AMPRNet but no longer actively supported can be viewed on the [[Services/Historic|Historic Services]] page.

[[Category:Reference]]
[[Category:Infrastructure]]
[[Category:Core Services]]

K2IE

2026-09-29T19:09:27Z

KI5QKX: Organize IPIP Mesh documentation and navigation

#REDIRECT [[IPIP Mesh/OpenWrt]]

Archive/Home

2026-09-29T19:09:27Z

KI5QKX: Organize IPIP Mesh documentation and navigation

Welcome to the AMPRNet Wiki.

44Net is shorthand for Internet network 44 (44.0.0.0/9 and 44.128.0.0/10), also known as AMPRNet. Since its allocation to amateur radio in the mid-1980s, the network has been used by amateur radio operators to conduct scientific research and to experiment with digital communications over radio. The goals are to of advance the state of the art of Amateur Radio networking, and to educate amateur radio operators in these techniques.

To request an assignment of IPv4 addresses see below.

__NOTOC__
== Starting points ==
* [[IPIP Mesh/Quickstart|Quickstart]] guide for getting onto the 44Net
* Basic information about 44Net and the [[ampr.org]] domain
* [[Services]] available on 44Net
* If you are looking to get an IP assignment from ARDC please read the [[Portal]] page.
* Frequently Asked Questions (FAQ) [[FAQ]]
* [[Getting started with Linux and packet radio]]
* [[Networks that use 44Net]]

== Portal how to's ==
* Portal Introduction [[Portal intro]]
* Organization Setup [[Organizations in the Portal]]
* Call Sign Verification [[Portal Call Sign Verification]]

== How to connect to the 44Net ==

* Instructions for [[IPIP Mesh/Linux|setting up a Linux gateway]]
* Instructions for [[IPIP Mesh/MikroTik|setting up a gateway on MikroTik Routers running ROS6]].
* Instructions for [[IPIP Mesh/MikroTik RouterOS 7 Container|setting up a gateway on MikroTik Routers running ROS7 using a container on arm32, arm64 and x86-64]]
* Instructions for [[IPIP Mesh/OpenBSD|setting up an OpenBSD gateway]]
* Instructions for [[IPIP Mesh/Cisco|setting up a gateway on Cisco Routers]].
* Instructions for [[IPIP Mesh/OpenWrt|setting up a gateway on OpenWRT]].
* Instructions for [[IPIP Mesh/Ubiquiti EdgeRouter|setting up a gateway on Ubiquiti EdgeRouter]].
* Instructions for [[IPIP Mesh/VyOS|setting up a gateway on a VyOS instance]].
* Instructions for [[IPIP Mesh/Ubiquiti EdgeRouter with ampr-ripd|Installing ampr-ripd on a Ubiquiti EdgeRouter or EdgeRouter X]].
* Instructions for [[Announcing_your_allocation_directly|directly announcing your assignment via your Internet Service Provider (ISP)]].
* Instructions for [[OH7LZB_VPN|Accessing 44Net via VPN]] (experimental).
* [[FAQ]]
* If you already operate a [[IPIP Mesh/Gateways|gateway]] please ensure you have registered on the [[Portal]] and "claimed" your [[IPIP Mesh/Gateways|gateway]].
* After your gateway is operational, consider '''[[IPIP Mesh/Firewalls|Firewalls]]''' and other best practices

== Groups.io ==
We are now on Groups.io Please consider joining https://ardc.groups.io/g/44net

== Mailing list ==
To keep up-to-date on AMPRNet information please consider joining the [[44Net mailing list]].

== Contribute! ==
If you wish to contribute to the wiki, please send an email to <tt>wiki (at) ampr.org</tt> introducing yourself. Please specify your full name and your amateur radio callsign. A login will then be created for you.

== Terms of service ==
Use of AMPRNet address space is governed by these [https://www.ampr.org/terms-of-service/ Terms of Service]

== Other useful features ==
* Instruction on using the [[ampr-map]] position reporting

== All pages ==
[https://wiki.ampr.org/wiki/Special:AllPages Here's a list of all pages currently on the 44Net Wiki]
[[Category:Explanation]]
[[Category:Archive]]

GetStarted

2026-09-29T19:09:27Z

KI5QKX: Organize IPIP Mesh documentation and navigation

{{DISPLAYTITLE:Get Started with 44Net}}

Welcome. This page helps you bring 44Net to your device or network and choose how you want to participate.

Start by creating an account, then select the participation model that matches your environment.

== Step 1: Create your Portal account ==

An account is required before requesting address space, managing DNS, or participating fully.

* [[Portal/Sign Up|Create a Portal account and verify your callsign]]

Once your account is ready, you can decide how you want to participate.

== Step 2: Choose an operating model ==

44Net can be operated in several different ways.
These methods are independent by design; see [[Decentralization]] for a conceptual overview.

If you want an overview of provisioning methods first, see [[Provisioning Methods|Provisioning Methods]].

=== Get connected quickly: 44Net Connect ===

Put 44Net on a single device or small network from almost any connection, including home networks, cloud hosts, or mobile devices.

* Start here: [[44Net Connect/Quick Start|44Net Connect Quick Start]]

Ideal when you want a flexible endpoint you control without operating shared infrastructure.

=== Participate via the IPIP Mesh ===

Join the long‑standing shared 44Net community network built from interconnected tunnel endpoints and regional collaboration.

* Start here: [[IPIP Mesh/Quick Start|IPIP Mesh Quick Start]]

Well suited for persistent stations participating in community routing environments.

=== Operate routed infrastructure: BGP announce ===

Integrate 44Net directly into an independently operated routed network using BGP.

* Start here: [[BGP/Quick Start|BGP Direct Announce Quick Start]]

Appropriate when you already manage routing infrastructure and participate in Internet routing, or if you have access to an upstream provider that can announce on your behalf.

=== Learn, explore, or contribute ===

You do not need infrastructure to participate.

* Browse documentation and projects
* Join discussions
* Help test, document, or support community efforts

Start with:

* [[Main Page|Explore the Wiki]]
* [https://ardc.groups.io/g/main ARDC 44Net discussion group]

== Step 3: Head out ==

After choosing a path, common next steps include:

* Request address space: [[Portal/Request Address Space|Requesting Address Space]]
* Claim DNS under <code><callsign>.ampr.org</code>: [[DNS/Portal/Subdomains|Claiming DNS]]
* Continue with Portal documentation: [[Portal/Introduction|Portal Introduction]]
* Find specific topics: [[Special:Search|Search the Wiki]]

== Older docs and notes ==
Earlier pages that may still be useful:
* [[IPIP Mesh/Quickstart|Quickstart]]
* [[Requesting a block]]
* [[Getting started with Linux and packet radio]]
* See [[Archive]] for more.
[[Category:Tutorial]]
[[Category:Explanation]]
[[Category:Getting Started]]

IPIP Mesh/MikroTik RouterOS 7 Container

2026-09-29T19:09:26Z

KI5QKX: Organize IPIP Mesh documentation and navigation

{{Section nav|hub=IPIP Mesh|title=IPIP Mesh|category=IPIP Mesh}}

Setting up a gateway in a ROS7 Mikrotik router running in a container on arm and arm64 models and x86-64 CHR

'''This is an experimental software build for the 'enthusiasts' out there.'''

Source code is available in git.ampr.org: https://git.ampr.org/yo2loj/ampr-ros7-container/-/tree/main

<h1>Info</h1>

These are the steps for setting up a fully functional AMPR gateway on an arm/arm64 MikroTik router
Tested and found working on CRS2116 and RB3011 for now.

MikroTik ARM64 devices:
Routers: CCR2004, CCR2116, CCR2216, RB5009
Switches: CRS520
Wireless and 5G: Netmetal ax, LHG-LTE6, ATL-LTE18
SOHO: hAP-ax2, cAP-ax, hAP-ax3, Chateau-ax
Others: AMPERE

MikroTik ARM32 devices:
Routers: L009, RB3011, RB4011, RB1100AHx4,
Switches: CRS305, CRS309, CRS310, CRS317, CRS320, CRS326, CRS328
Wireless and 5G: SXTsq-5ac, NetBox-5ax, LHGXL-5ac
SOHO: hAP-ax lite, hap-ac2, cAP-ac, wAP-ac, cAPXL-ac, hAP-ac3, Chateau
Routerboard: L11UG, L23UGSR, RB450Gx4

MikroTik x86-64 devices:
Others: Cloud Hosted Router

Containers are not available on MIPSBE, MMIPS, SMIPS, TILE or PPC architectures.

== General concept ==
Mikrotik routers running ROS 7 (7.15.3 being current at the time of writing) based on arm and arm64 processor, as well as CHR setups are able to run software containers (similar to docker).
This opens the possibility to host a virtualized gateway in such a container, allowing a simple and efficient setup on modern systems.

The gateway will be hosted in a VRF on the router, providing gateway services using policy routing.

As a concept, the container has a single VETH interface which will decapsulate all incoming IPIP traffic from the tunnels, and encapsulate all outgoing traffic towards them.
The container itself is isolated behind a bridge and offers some basic filtering function (e.g. restrict access from internet hosts).
It will receive the RIPv2 broadcasts from the AMPR gateway and provide the obtained routes as RIP broadcasts to the router itself inside the mentioned VRF.

The container does not save anything to disk (which would be a bad idea on the router's flash memory), so the AMPR routes are lost on container or router restart, and you need to wait the now classical 5 minutes. But this should be no problem on a 24/7 on router.

== Limitations ==

The router does not forward multicast frames at all, nor does it send out broadcasts.
Incoming broadcasts are accepted and forwarded to the local VRF.

The container itself needs to sit behind a bridge due to a kernel bug in the version used by Mikrotik which sends out "Port unreachable" ICMP messages on incoming IPIP traffic if it is handled in user space (The same thing causing the need of a kernel filter in amprd. This is fixed in newer kernel releases but it will take a while for it to make its way into ROS). Bridge filtering is used to mask those messages.

<h1>New router 5 minutes set up</h1>

As a prerequisite, get your internet connection working based on the default mikrotik configuration.
Basically set up your ISP uplink either via DHCP or by setting up a PPPoE or similar connection.
Leave the default firewall rule as they are.
Alternatively, you can start with a completely empty router, with only a active internet connection.

First you need to enable container support according to the info provided by Mikrotik.
In a console type in:
/system/device-mode/update container=yes
The system will want you to do a hard reset at this point to confirm the request. This means you need physical access to the device.

Next, you need to install the container package for your firmware version. Download the "extra" firmware package from MikroTik for your FW version and extract the "container-7.x.y-<arch>.npk" file. Upload it to your router and restart. This will install the package onto the router. After restart, you will have a new option available: /containers

== Installation script ==
Next we need to install the container according to your hardware.
Please chose the correct setup script variant:

ARM32 - ampr_arm32.rsc
ARM64 - ampr_arm64.rsc
CHRx86 - ampr_x86_64.rsc

Unfortunately, containers are not available on Mips, Tile or PowerPC devices.

The example assumes you use an arm32 device. Please use the proper one...

Open a route console window.

1. Check is the remote server is available:
[admin@MikroTik] > ping yo2loj.ro
SEQ HOST SIZE TTL TIME STATUS
0 89.33.44.100 56 58 10ms574us
1 89.33.44.100 56 58 9ms141us
2 89.33.44.100 56 58 9ms5us
sent=3 received=3 packet-loss=0% min-rtt=9ms5us avg-rtt=9ms573us max-rtt=10ms574us

2. Download the configuration script
[admin@MikroTik] > /tool fetch url="http://yo2loj.ro/containers/ampr_arm32.rsc"
status: finished
downloaded: 5KiB
total: 5KiB
duration: 1s

3. Run the configuration script
[admin@MikroTik] > import ampr_arm32.rsc
AMPR: Creating bridge and VRF
AMPR: Setting up RIP
AMPR: Creating container envs
AMPR: Setting up firewall rules
AMPR: Creating container update script
AMPR: Creating routing rules
AMPR: Installing container
No container is installed
status: finished
downloaded: 366KiB
total: 366KiB
duration: 1s
AMPR: Script finished successful
AMPR: Now update your container envs and start the container

Your container is now installed.
You need to configure its environment variables according to the description given below.

After configuration is complete, go to "containers" and star it up.
It should show "running" and you should see it's messages in the log window.

After at most 5 minutes, you should get the tunnel routes in your vrf, and your gateway should be fully up and running.

If logging/debugging is not needed anymore, please disable it by clicking on the container and unchecking te logging box.

== Container configuration parameters ==
You need to adapt the pre-existing container environment variables to your particular gateway before starting it again.
The following ENV parameters are preset in Container-> Envs:
AMPR_SUBNETS - holds your local subnets as defined in the Portal, as comma separated list of <SUBNET>/<MASK> tupples, e.g. "44.128.0.0/24,44.128.1.0/24"
ALL_VIA_AMPRGW - enables forwarding of all AMPR destinations via AMPRGW, values are "0" or "1"
FORWARD_INTERNET - enables forward of traffic from/to internet hosts, values are "0" or "1"
IGNORED_SUBNETS - allows you to ignore specific subnets provided by RIP, by <SUBNET>/<MASK> or gateway address e.g. "44.128.0.0/16"
CALL_HOME - the classic string, <CALLSIGN>@<LOCATOR> to show up on the map. You will get a yellow dot. e.g. "YO2LOJ@KN05OR". Leaving the field empty disables call home.

Please note that the provided default will allow you to play around, but will not provide a working set up.

Next, you need to set up a local AMPR LAN on your router router, or, if you have only a single IP address assigned, add it to one of your router's interfaces with a /32 netmask
Anyway, you need to add a src-nat rule to the router's IP address to get your traffic flowing (let's assume its 44.128.0.1).
The address shall be set on an interface OUTSIDE OF THE VRF.

For a single address:
/ip address add address=44.128.0.1 interface=bridge
or even on the loopback interface:
For a single address:
/ip address add address=44.128.0.1 interface=lo

For a subnet:
/ip address add address=44.128.0.1/24 interface=<interface name>

And your src-nat NAT rules:
/ip firewall nat add action=src-nat chain=srcnat out-interface=bridge-ampr-gw to-addresses=44.128.0.1
/ip firewall nat add action=src-nat chain=srcnat out-interface=vrf-ampr to-addresses=44.128.0.1

Of course you need to set up additional firewall rules and stuff, but if you do not enable internet forwarding, you should be pretty safe being exposed only to AMPR partners.

Please note that for your firewall rules the incoming interface from the tunnels is "vrf_ampr" and the outgoing interface is "bridge-ampr-gw" for forwarded and "vrf-ampr" for local outgoing data.

== Additional optional configuration ==

You may notice that on an external traceroute your router's IP address will show up as 172.17.0.1.
To fix this small glitch, you need to modify your existing "rip-ampr-in" RIP input filter rule to provide the correct preferred source address.

Modify the existing rule from
accept;

to set your router's local AMPR IP as its preferred source
set pref-src 44.128.0.1;
accept;

Also, if you want to access the AMPR network from a LAN not using AMPR addresses, you need to set up a forwarding rule and a SRC-NAT one:

/ip firewall filter
add action=accept chain=forward comment="from LAN" in-interface=<YourLANInterface> dst-address-list=ampr_addr
and
/ip firewall nat
add action=src-nat chain=srcnat comment="NAT to AMPR" dst-address-list=Ampr out-interface=bridge-ampr-gw \
src-address-list=!ampr_addr to-addresses=44.128.0.1

<h1>Configuration on an existing working router - 6 steps</h1>

1 - Bridge, VETH, VRF and interface setup
2 - RIP setup
3 - Firewall rules, Filter, NAT and Mangle
4 - Container environment setup
5 - Container installation (architecture dependent)
6 - Container configuration and final touches

== Preliminary: prepare the router to accept containers ==
First, you need to install container support on your router.
In a console issue:
/system/device-mode/update container=yes
The system will want you to do a hard reset at this point to confirm the request.
This means you need physical access to the device.

Next, you need to install the container package for your firmware version.
Download the "extra" firmware package from MikroTik for your FW version and extract the "container-7.x.y-<arch>.npk" file.
Upload it to your router and restart. This will install the package onto the router.
After restart, you will have a new option available: /containers

== Step 1: Bridge, VETH, VRF and interface setup ==

First create a bridge which will be used for your containr. Let's call it 'bridge-ampr-gw':
/interface bridge add comment="AMPR container" name=bridge-ampr-gw
Assign a network to it. The typical docker IP will be ok:
/ip address add address=172.17.0.1/24 interface=bridge-ampr-gw
Create a virtual ethernet interface for the container itself (call it veth-ampr):
/interface veth add name=veth-ampr address=172.17.0.2/24 comment="AMPR container interface" \
gateway=172.17.0.1
Add the VETH port to the bridge we created above:
/interface bridge port add bridge=bridge-ampr-gw interface=veth-ampr
Because of a kernel anomaly preventing proper userspace IPIP handling, we need to filter icmp messages on the bridge from the container itself:
/interface bridge filter add action=drop chain=input in-interface=veth-ampr ip-protocol=icmp \
mac-protocol=ip src-address=172.17.0.2/32
Now we create a vrf called "vrf-ampr" and add the bridge to it:
/ip vrf add interfaces=bridge-ampr-gw name=vrf-ampr

All the above steps are available here as a rsc file: http://yo2loj.ro/containers/1_ampr_bridge_vrf.rsc

== Step 2: RIP setup ==

First, create a simple accept routing filter to be used by RIP:
/routing filter rule add chain=rip-ampr-in disabled=no rule="accept;"
Next, create a RIP instance for your VRF using the above filter and the defined VRF:
/routing rip instance add afi=ipv4 in-filter-chain=rip-ampr-in name=rip-ampr vrf=vrf-ampr
And now add a passive (receive only) interface to our instance:
/routing rip interface-template add instance=rip-ampr interfaces=bridge-ampr-gw mode=passive

All the above steps are available here as a rsc file: http://yo2loj.ro/containers/2_rip.rsc

== Step 3: Firewall rules, filter, NAT and mangle ==

Now we need to forward out IPIP tunnels to the container, and extract our data from the VRF.
For our convenience we will set up an address list to handle AMPR space as one entity
(if you already have such a list on the router, you can use it)
/ip firewall address-list
add address=44.0.0.0/9 list=ampr_addr
add address=44.128.0.0/10 list=ampr_addr
Also, we can use an interface list called WAN for the internet access interfaces (like the one in the default config).
If you prefer individual interfaces, you can of course use them in your rules.

Filters are needed to allow data input and forward to/from the router.
Accept RIP from the VRF:
/ip firewall filter
add action=accept chain=input comment="RIP via VRF" dst-port=520 in-interface=vrf-ampr protocol=udp
Accept input from the AMPR address space to the router (important for ping and traceroute):
/ip firewall filter
add action=accept chain=input comment="AMPR via Tunnels" dst-address-list=ampr_addr in-interface=vrf-ampr \
src-address-list=ampr_addr
And we need to accept some forwarding for the IPIP tunnels, from VRF to our AMPR space and between AMPR hosts:
/ip firewall filter
add action=accept chain=forward comment="IPIP Tunnels from ISP" in-interface-list=Internet protocol=ipencap
add action=accept chain=forward comment="IPIP Tunnels from VRF" in-interface=vrf-ampr protocol=ipencap
add action=accept chain=forward comment="VRF to AMPR" dst-address-list=ampr_addr in-interface=vrf-ampr
add action=accept chain=forward comment="AMPR to AMPR" dst-address-list=ampr_addr src-address-list=ampr_addr

Next, we need to forward incoming IPIP traffic to our container (note that WAN interface list, use your interface if you like):
/ip firewall nat
add action=dst-nat chain=dstnat comment="NAT ENCAP" in-interface-list=WAN protocol=ipencap \
to-addresses=172.17.0.2

Now to be able to traverse int and from the VRF, we need some mangle rules.

Incoming IPIP traffic will be marked with the vrf routing mark:
/ip firewall mangle
add action=mark-routing chain=prerouting comment="AMPR IPIP incoming to VRF" in-interface-list=Internet \
new-routing-mark=vrf-ampr passthrough=no protocol=ipencap
Outgoing IPIP traffic will be marked for the main routing table (or the one you need to reach your ISP)
/ip firewall mangle
add action=mark-routing chain=prerouting comment="AMPR IPIP outgoing via ISP" in-interface=vrf-ampr \
new-routing-mark=main passthrough=no protocol=ipencap
Traffic to our local router IPs will be directed via our bridge
/ip firewall mangle
add action=route chain=prerouting comment="AMPR VRF route local" dst-address-type=local in-interface=vrf-ampr \
passthrough=no route-dst=172.17.0.1
And finally, the incoming AMPR traffic will go to the main routing table
/ip firewall mangle
add action=mark-routing chain=prerouting comment="AMPR VRF forward" in-interface=vrf-ampr new-routing-mark=main\
passthrough=no

All the above steps are available here as a rsc file: http://yo2loj.ro/containers/3_firewall.rsc

== Step 4 - Container environment setup ==
This step prepares the environment variables for the container.

/container envs
add comment="My subnets, as defined in the Portal" key=AMPR_SUBNETS name=ampr-cfg value=\
44.128.0.0/24,44.128.1.0/24
add comment="Default gateway is AMPRGW instead of Internet" key=ALL_VIA_AMPRGW name=ampr-cfg value=0
add comment="Forward internet traffic" key=FORWARD_INTERNET name=ampr-cfg value=0
add comment="Call home callsign and locator" key=CALL_HOME name=ampr-cfg value=test@AA00aa
add comment="Ignored subnets in RIP" key=IGNORED_SUBNETS name=ampr-cfg value=44.128.0.0/16

Just paste them into the console or import the rsc script as it is. You will edit those later.

The rsc file is here: http://yo2loj.ro/containers/4_container_env.rsc

== Step 5 - Container installation ==
Now you need to download the container which fits your architecture.
The following rsc files will install a script which, when run will import and install the container.
The same scripts will update and replace the container if run again.

ARM32 - http://yo2loj.ro/containers/5_container_arm32.rsc
ARM64 - http://yo2loj.ro/containers/5_container_arm64.rsc
CHRx86 - http://yo2loj.ro/containers/5_container_x86_64.rsc

Of course, instead of the script, you can download the appropriate tar container files yourself:
ARM32 - http://yo2loj.ro/containers/ampr-arm32.tar
ARM64 - http://yo2loj.ro/containers/ampr-arm64.tar
CHRx86 - http://yo2loj.ro/containers/ampr-x86-64.tar
and install them manually. Please set them to use the env variables "ampr-cfg".

Or, you can compile and pack the container yourself from source. At the time of writing, the current version is 1.2.0:
http://yo2loj.ro/containers/ampr-container-1.2.0-release.tgz

== Step 6 - Container configuration and final touches ==

You need to edit your env variables according to the description given in the new router setup.

Start your container and wait 5 min. You should see AMPR routes showing up in the VRF's routing table
(Some 840 of them if ALL_VIA_AMPRGW is not enabled, otherwise you will get only 2 routes, 44.0.0.0/9 and 44.128.0.0/10).

You may notice that on an external traceroute your router's IP address will show up as 172.17.0.1.
To fix this small glitch, you need to modify your existing "rip-ampr-in" RIP input filter rule to provide the correct preferred source address.

Modify the existing rule from
accept;

to set your router's local AMPR IP as its preferred source
set pref-src 44.128.0.1;
accept;

Now, activate the use of the whole system.
Set up a routing rule set to force all outgoing AMPR traffic to do a lookup in the VRF routing table:
/routing rule
add action=lookup disabled=yes dst-address=44.0.0.0/9 table=vrf-ampr
add action=lookup disabled=yes dst-address=44.128.0.0/10 table=vrf-ampr
If no route is found in that table, the lookup will continue via the main table towards your default route.

Your local AMPR network and additional routing will go into the main table and the lookup will be done AFTER passing through the VRF's routing table.
This means that a matching route in the VRF, including a default 0.0.0.0/0 will take precedence over any route defined in the main table.

Also, if you want to access the AMPR network from a LAN not using AMPR addresses, you need to set up a forwarding rule and a SRC-NAT one:

/ip firewall filter
add action=accept chain=forward comment="from LAN" in-interface=LAN dst-address-list=ampr_addr
and
/ip firewall nat
add action=src-nat chain=srcnat comment="NAT to AMPR" dst-address-list=Ampr out-interface=bridge-ampr-gw \
src-address-list=!ampr_addr to-addresses=<your router's AMPR ip>

== Additional info ==
All available files are here: http://yo2loj.ro/containers/

Rip Rip Hurray! de YO2LOJ

[[Category:How-To]]
[[Category:How-To Guides]]
[[Category:Infrastructure]]
[[Category:Gateways]]
[[Category:Device and platform guides]]

Setting up a gateway in a ROS7 Mikrotik router container on arm32 arm64 and x86-64

2026-09-29T19:09:25Z

KI5QKX: KI5QKX moved page Setting up a gateway in a ROS7 Mikrotik router container on arm32 arm64 and x86-64 to IPIP Mesh/MikroTik RouterOS 7 Container: Group IPIP Mesh documentation under IPIP Mesh

#REDIRECT [[IPIP Mesh/MikroTik RouterOS 7 Container]]

IPIP Mesh/MikroTik RouterOS 7 Container

2026-09-29T19:09:25Z

KI5QKX: KI5QKX moved page Setting up a gateway in a ROS7 Mikrotik router container on arm32 arm64 and x86-64 to IPIP Mesh/MikroTik RouterOS 7 Container: Group IPIP Mesh documentation under IPIP Mesh

Setting up a gateway in a ROS7 Mikrotik router running in a container on arm and arm64 models and x86-64 CHR

'''This is an experimental software build for the 'enthusiasts' out there.'''

Source code is available in git.ampr.org: https://git.ampr.org/yo2loj/ampr-ros7-container/-/tree/main

<h1>Info</h1>

These are the steps for setting up a fully functional AMPR gateway on an arm/arm64 MikroTik router
Tested and found working on CRS2116 and RB3011 for now.

MikroTik ARM64 devices:
Routers: CCR2004, CCR2116, CCR2216, RB5009
Switches: CRS520
Wireless and 5G: Netmetal ax, LHG-LTE6, ATL-LTE18
SOHO: hAP-ax2, cAP-ax, hAP-ax3, Chateau-ax
Others: AMPERE

MikroTik ARM32 devices:
Routers: L009, RB3011, RB4011, RB1100AHx4,
Switches: CRS305, CRS309, CRS310, CRS317, CRS320, CRS326, CRS328
Wireless and 5G: SXTsq-5ac, NetBox-5ax, LHGXL-5ac
SOHO: hAP-ax lite, hap-ac2, cAP-ac, wAP-ac, cAPXL-ac, hAP-ac3, Chateau
Routerboard: L11UG, L23UGSR, RB450Gx4

MikroTik x86-64 devices:
Others: Cloud Hosted Router

Containers are not available on MIPSBE, MMIPS, SMIPS, TILE or PPC architectures.

== General concept ==
Mikrotik routers running ROS 7 (7.15.3 being current at the time of writing) based on arm and arm64 processor, as well as CHR setups are able to run software containers (similar to docker).
This opens the possibility to host a virtualized gateway in such a container, allowing a simple and efficient setup on modern systems.

The gateway will be hosted in a VRF on the router, providing gateway services using policy routing.

As a concept, the container has a single VETH interface which will decapsulate all incoming IPIP traffic from the tunnels, and encapsulate all outgoing traffic towards them.
The container itself is isolated behind a bridge and offers some basic filtering function (e.g. restrict access from internet hosts).
It will receive the RIPv2 broadcasts from the AMPR gateway and provide the obtained routes as RIP broadcasts to the router itself inside the mentioned VRF.

The container does not save anything to disk (which would be a bad idea on the router's flash memory), so the AMPR routes are lost on container or router restart, and you need to wait the now classical 5 minutes. But this should be no problem on a 24/7 on router.

== Limitations ==

The router does not forward multicast frames at all, nor does it send out broadcasts.
Incoming broadcasts are accepted and forwarded to the local VRF.

The container itself needs to sit behind a bridge due to a kernel bug in the version used by Mikrotik which sends out "Port unreachable" ICMP messages on incoming IPIP traffic if it is handled in user space (The same thing causing the need of a kernel filter in amprd. This is fixed in newer kernel releases but it will take a while for it to make its way into ROS). Bridge filtering is used to mask those messages.

<h1>New router 5 minutes set up</h1>

As a prerequisite, get your internet connection working based on the default mikrotik configuration.
Basically set up your ISP uplink either via DHCP or by setting up a PPPoE or similar connection.
Leave the default firewall rule as they are.
Alternatively, you can start with a completely empty router, with only a active internet connection.

First you need to enable container support according to the info provided by Mikrotik.
In a console type in:
/system/device-mode/update container=yes
The system will want you to do a hard reset at this point to confirm the request. This means you need physical access to the device.

Next, you need to install the container package for your firmware version. Download the "extra" firmware package from MikroTik for your FW version and extract the "container-7.x.y-<arch>.npk" file. Upload it to your router and restart. This will install the package onto the router. After restart, you will have a new option available: /containers

== Installation script ==
Next we need to install the container according to your hardware.
Please chose the correct setup script variant:

ARM32 - ampr_arm32.rsc
ARM64 - ampr_arm64.rsc
CHRx86 - ampr_x86_64.rsc

Unfortunately, containers are not available on Mips, Tile or PowerPC devices.

The example assumes you use an arm32 device. Please use the proper one...

Open a route console window.

1. Check is the remote server is available:
[admin@MikroTik] > ping yo2loj.ro
SEQ HOST SIZE TTL TIME STATUS
0 89.33.44.100 56 58 10ms574us
1 89.33.44.100 56 58 9ms141us
2 89.33.44.100 56 58 9ms5us
sent=3 received=3 packet-loss=0% min-rtt=9ms5us avg-rtt=9ms573us max-rtt=10ms574us

2. Download the configuration script
[admin@MikroTik] > /tool fetch url="http://yo2loj.ro/containers/ampr_arm32.rsc"
status: finished
downloaded: 5KiB
total: 5KiB
duration: 1s

3. Run the configuration script
[admin@MikroTik] > import ampr_arm32.rsc
AMPR: Creating bridge and VRF
AMPR: Setting up RIP
AMPR: Creating container envs
AMPR: Setting up firewall rules
AMPR: Creating container update script
AMPR: Creating routing rules
AMPR: Installing container
No container is installed
status: finished
downloaded: 366KiB
total: 366KiB
duration: 1s
AMPR: Script finished successful
AMPR: Now update your container envs and start the container

Your container is now installed.
You need to configure its environment variables according to the description given below.

After configuration is complete, go to "containers" and star it up.
It should show "running" and you should see it's messages in the log window.

After at most 5 minutes, you should get the tunnel routes in your vrf, and your gateway should be fully up and running.

If logging/debugging is not needed anymore, please disable it by clicking on the container and unchecking te logging box.

== Container configuration parameters ==
You need to adapt the pre-existing container environment variables to your particular gateway before starting it again.
The following ENV parameters are preset in Container-> Envs:
AMPR_SUBNETS - holds your local subnets as defined in the Portal, as comma separated list of <SUBNET>/<MASK> tupples, e.g. "44.128.0.0/24,44.128.1.0/24"
ALL_VIA_AMPRGW - enables forwarding of all AMPR destinations via AMPRGW, values are "0" or "1"
FORWARD_INTERNET - enables forward of traffic from/to internet hosts, values are "0" or "1"
IGNORED_SUBNETS - allows you to ignore specific subnets provided by RIP, by <SUBNET>/<MASK> or gateway address e.g. "44.128.0.0/16"
CALL_HOME - the classic string, <CALLSIGN>@<LOCATOR> to show up on the map. You will get a yellow dot. e.g. "YO2LOJ@KN05OR". Leaving the field empty disables call home.

Please note that the provided default will allow you to play around, but will not provide a working set up.

Next, you need to set up a local AMPR LAN on your router router, or, if you have only a single IP address assigned, add it to one of your router's interfaces with a /32 netmask
Anyway, you need to add a src-nat rule to the router's IP address to get your traffic flowing (let's assume its 44.128.0.1).
The address shall be set on an interface OUTSIDE OF THE VRF.

For a single address:
/ip address add address=44.128.0.1 interface=bridge
or even on the loopback interface:
For a single address:
/ip address add address=44.128.0.1 interface=lo

For a subnet:
/ip address add address=44.128.0.1/24 interface=<interface name>

And your src-nat NAT rules:
/ip firewall nat add action=src-nat chain=srcnat out-interface=bridge-ampr-gw to-addresses=44.128.0.1
/ip firewall nat add action=src-nat chain=srcnat out-interface=vrf-ampr to-addresses=44.128.0.1

Of course you need to set up additional firewall rules and stuff, but if you do not enable internet forwarding, you should be pretty safe being exposed only to AMPR partners.

Please note that for your firewall rules the incoming interface from the tunnels is "vrf_ampr" and the outgoing interface is "bridge-ampr-gw" for forwarded and "vrf-ampr" for local outgoing data.

== Additional optional configuration ==

You may notice that on an external traceroute your router's IP address will show up as 172.17.0.1.
To fix this small glitch, you need to modify your existing "rip-ampr-in" RIP input filter rule to provide the correct preferred source address.

Modify the existing rule from
accept;

to set your router's local AMPR IP as its preferred source
set pref-src 44.128.0.1;
accept;

Also, if you want to access the AMPR network from a LAN not using AMPR addresses, you need to set up a forwarding rule and a SRC-NAT one:

/ip firewall filter
add action=accept chain=forward comment="from LAN" in-interface=<YourLANInterface> dst-address-list=ampr_addr
and
/ip firewall nat
add action=src-nat chain=srcnat comment="NAT to AMPR" dst-address-list=Ampr out-interface=bridge-ampr-gw \
src-address-list=!ampr_addr to-addresses=44.128.0.1

<h1>Configuration on an existing working router - 6 steps</h1>

1 - Bridge, VETH, VRF and interface setup
2 - RIP setup
3 - Firewall rules, Filter, NAT and Mangle
4 - Container environment setup
5 - Container installation (architecture dependent)
6 - Container configuration and final touches

== Preliminary: prepare the router to accept containers ==
First, you need to install container support on your router.
In a console issue:
/system/device-mode/update container=yes
The system will want you to do a hard reset at this point to confirm the request.
This means you need physical access to the device.

Next, you need to install the container package for your firmware version.
Download the "extra" firmware package from MikroTik for your FW version and extract the "container-7.x.y-<arch>.npk" file.
Upload it to your router and restart. This will install the package onto the router.
After restart, you will have a new option available: /containers

== Step 1: Bridge, VETH, VRF and interface setup ==

First create a bridge which will be used for your containr. Let's call it 'bridge-ampr-gw':
/interface bridge add comment="AMPR container" name=bridge-ampr-gw
Assign a network to it. The typical docker IP will be ok:
/ip address add address=172.17.0.1/24 interface=bridge-ampr-gw
Create a virtual ethernet interface for the container itself (call it veth-ampr):
/interface veth add name=veth-ampr address=172.17.0.2/24 comment="AMPR container interface" \
gateway=172.17.0.1
Add the VETH port to the bridge we created above:
/interface bridge port add bridge=bridge-ampr-gw interface=veth-ampr
Because of a kernel anomaly preventing proper userspace IPIP handling, we need to filter icmp messages on the bridge from the container itself:
/interface bridge filter add action=drop chain=input in-interface=veth-ampr ip-protocol=icmp \
mac-protocol=ip src-address=172.17.0.2/32
Now we create a vrf called "vrf-ampr" and add the bridge to it:
/ip vrf add interfaces=bridge-ampr-gw name=vrf-ampr

All the above steps are available here as a rsc file: http://yo2loj.ro/containers/1_ampr_bridge_vrf.rsc

== Step 2: RIP setup ==

First, create a simple accept routing filter to be used by RIP:
/routing filter rule add chain=rip-ampr-in disabled=no rule="accept;"
Next, create a RIP instance for your VRF using the above filter and the defined VRF:
/routing rip instance add afi=ipv4 in-filter-chain=rip-ampr-in name=rip-ampr vrf=vrf-ampr
And now add a passive (receive only) interface to our instance:
/routing rip interface-template add instance=rip-ampr interfaces=bridge-ampr-gw mode=passive

All the above steps are available here as a rsc file: http://yo2loj.ro/containers/2_rip.rsc

== Step 3: Firewall rules, filter, NAT and mangle ==

Now we need to forward out IPIP tunnels to the container, and extract our data from the VRF.
For our convenience we will set up an address list to handle AMPR space as one entity
(if you already have such a list on the router, you can use it)
/ip firewall address-list
add address=44.0.0.0/9 list=ampr_addr
add address=44.128.0.0/10 list=ampr_addr
Also, we can use an interface list called WAN for the internet access interfaces (like the one in the default config).
If you prefer individual interfaces, you can of course use them in your rules.

Filters are needed to allow data input and forward to/from the router.
Accept RIP from the VRF:
/ip firewall filter
add action=accept chain=input comment="RIP via VRF" dst-port=520 in-interface=vrf-ampr protocol=udp
Accept input from the AMPR address space to the router (important for ping and traceroute):
/ip firewall filter
add action=accept chain=input comment="AMPR via Tunnels" dst-address-list=ampr_addr in-interface=vrf-ampr \
src-address-list=ampr_addr
And we need to accept some forwarding for the IPIP tunnels, from VRF to our AMPR space and between AMPR hosts:
/ip firewall filter
add action=accept chain=forward comment="IPIP Tunnels from ISP" in-interface-list=Internet protocol=ipencap
add action=accept chain=forward comment="IPIP Tunnels from VRF" in-interface=vrf-ampr protocol=ipencap
add action=accept chain=forward comment="VRF to AMPR" dst-address-list=ampr_addr in-interface=vrf-ampr
add action=accept chain=forward comment="AMPR to AMPR" dst-address-list=ampr_addr src-address-list=ampr_addr

Next, we need to forward incoming IPIP traffic to our container (note that WAN interface list, use your interface if you like):
/ip firewall nat
add action=dst-nat chain=dstnat comment="NAT ENCAP" in-interface-list=WAN protocol=ipencap \
to-addresses=172.17.0.2

Now to be able to traverse int and from the VRF, we need some mangle rules.

Incoming IPIP traffic will be marked with the vrf routing mark:
/ip firewall mangle
add action=mark-routing chain=prerouting comment="AMPR IPIP incoming to VRF" in-interface-list=Internet \
new-routing-mark=vrf-ampr passthrough=no protocol=ipencap
Outgoing IPIP traffic will be marked for the main routing table (or the one you need to reach your ISP)
/ip firewall mangle
add action=mark-routing chain=prerouting comment="AMPR IPIP outgoing via ISP" in-interface=vrf-ampr \
new-routing-mark=main passthrough=no protocol=ipencap
Traffic to our local router IPs will be directed via our bridge
/ip firewall mangle
add action=route chain=prerouting comment="AMPR VRF route local" dst-address-type=local in-interface=vrf-ampr \
passthrough=no route-dst=172.17.0.1
And finally, the incoming AMPR traffic will go to the main routing table
/ip firewall mangle
add action=mark-routing chain=prerouting comment="AMPR VRF forward" in-interface=vrf-ampr new-routing-mark=main\
passthrough=no

All the above steps are available here as a rsc file: http://yo2loj.ro/containers/3_firewall.rsc

== Step 4 - Container environment setup ==
This step prepares the environment variables for the container.

/container envs
add comment="My subnets, as defined in the Portal" key=AMPR_SUBNETS name=ampr-cfg value=\
44.128.0.0/24,44.128.1.0/24
add comment="Default gateway is AMPRGW instead of Internet" key=ALL_VIA_AMPRGW name=ampr-cfg value=0
add comment="Forward internet traffic" key=FORWARD_INTERNET name=ampr-cfg value=0
add comment="Call home callsign and locator" key=CALL_HOME name=ampr-cfg value=test@AA00aa
add comment="Ignored subnets in RIP" key=IGNORED_SUBNETS name=ampr-cfg value=44.128.0.0/16

Just paste them into the console or import the rsc script as it is. You will edit those later.

The rsc file is here: http://yo2loj.ro/containers/4_container_env.rsc

== Step 5 - Container installation ==
Now you need to download the container which fits your architecture.
The following rsc files will install a script which, when run will import and install the container.
The same scripts will update and replace the container if run again.

ARM32 - http://yo2loj.ro/containers/5_container_arm32.rsc
ARM64 - http://yo2loj.ro/containers/5_container_arm64.rsc
CHRx86 - http://yo2loj.ro/containers/5_container_x86_64.rsc

Of course, instead of the script, you can download the appropriate tar container files yourself:
ARM32 - http://yo2loj.ro/containers/ampr-arm32.tar
ARM64 - http://yo2loj.ro/containers/ampr-arm64.tar
CHRx86 - http://yo2loj.ro/containers/ampr-x86-64.tar
and install them manually. Please set them to use the env variables "ampr-cfg".

Or, you can compile and pack the container yourself from source. At the time of writing, the current version is 1.2.0:
http://yo2loj.ro/containers/ampr-container-1.2.0-release.tgz

== Step 6 - Container configuration and final touches ==

You need to edit your env variables according to the description given in the new router setup.

Start your container and wait 5 min. You should see AMPR routes showing up in the VRF's routing table
(Some 840 of them if ALL_VIA_AMPRGW is not enabled, otherwise you will get only 2 routes, 44.0.0.0/9 and 44.128.0.0/10).

You may notice that on an external traceroute your router's IP address will show up as 172.17.0.1.
To fix this small glitch, you need to modify your existing "rip-ampr-in" RIP input filter rule to provide the correct preferred source address.

Modify the existing rule from
accept;

to set your router's local AMPR IP as its preferred source
set pref-src 44.128.0.1;
accept;

Now, activate the use of the whole system.
Set up a routing rule set to force all outgoing AMPR traffic to do a lookup in the VRF routing table:
/routing rule
add action=lookup disabled=yes dst-address=44.0.0.0/9 table=vrf-ampr
add action=lookup disabled=yes dst-address=44.128.0.0/10 table=vrf-ampr
If no route is found in that table, the lookup will continue via the main table towards your default route.

Your local AMPR network and additional routing will go into the main table and the lookup will be done AFTER passing through the VRF's routing table.
This means that a matching route in the VRF, including a default 0.0.0.0/0 will take precedence over any route defined in the main table.

Also, if you want to access the AMPR network from a LAN not using AMPR addresses, you need to set up a forwarding rule and a SRC-NAT one:

/ip firewall filter
add action=accept chain=forward comment="from LAN" in-interface=LAN dst-address-list=ampr_addr
and
/ip firewall nat
add action=src-nat chain=srcnat comment="NAT to AMPR" dst-address-list=Ampr out-interface=bridge-ampr-gw \
src-address-list=!ampr_addr to-addresses=<your router's AMPR ip>

== Additional info ==
All available files are here: http://yo2loj.ro/containers/

Rip Rip Hurray! de YO2LOJ

[[Category:How-To]]
[[Category:How-To Guides]]
[[Category:Infrastructure]]
[[Category:Gateways]]
[[Category:Device and platform guides]]

IPIP Mesh/Linux

2026-09-29T19:09:23Z

KI5QKX: Organize IPIP Mesh documentation and navigation

{{Section nav|hub=IPIP Mesh|title=IPIP Mesh|category=IPIP Mesh}}

There are a few different ways to run an AMPRnet gateway on a Linux system. Each has some benefits, so you'll need to pick your favourite.

Before configuring the Linux gateway you'll need to:
# Using the [[Portal]], request an IP address (or addresses) by clicking on "Request address space" then selecting "IPIP Tunnel Mesh" as the Use Case.
# You will need to have a public static IP address for your gateway.
# Using the [[Portal]], create an entry for your gateway.
# Get some of your AMPRNet IP addresses registered in the [[ampr.org]] DNS.

= Flavours of Linux gateways =

== Native Linux kernel AX.25 and IPIP tunneling ==

Linux contains the necessary building blocks for a gateway without much added software. Radio interfaces are configured much like any other network interfaces such as Ethernet, they're just given amateur radio callsigns in addition to an IP address (callsign will act the role of the Ethernet MAC address). If you're familiar with Linux configuration but have not heard of NOS, or if you wish to go with minimal amount of moving parts, this would probably be your choice.

Setting up a native Linux gateway consists of two main steps:

=== Step 1: Setting up tunnel routing to the rest of the AMPRnet===
Configuring your Linux system to learn about other AMPRNet [[IPIP Mesh/Gateways| gateways]] can be done two ways:

# Automatically learn about other gateways via modified RIPv2 advertisements. Two popular programs to do this are:
## Using [[IPIP Mesh/Ampr-ripd|ampr-ripd]], a C based routing daemon
## Using [[IPIP Mesh/Rip44d|rip44d]], a PERL based routing daemon
# Downloading an [[IPIP Mesh/Encap.txt|encap.txt]] file and setting up routes using a [[IPIP Mesh/Munge script|munge script]] is the traditional method

==== Example gateway configuration instructions ====
* [[IPIP Mesh/Ubuntu Linux Gateway Example|Ubuntu Linux Gateway Example]]
* [http://www.qsl.net/k/kb9mwr//wapr/tcpip/ampr-ripd.html Two Interface Debian Linux Amprnet Gateway Example]
* [https://k7ilo.blogspot.com/p/server-setup.html K7ILO'S Two Interface Debian 11 AmprNet Gateway Build in layman's terms]

=== Step 2: Setting up radio interfaces in Linux===

* [http://www.tldp.org/HOWTO/AX25-HOWTO/ Linux AX.25 set-up]
* 802.11 WiFi on amateur frequencies (2.4 or 5 GHz) is a new popular way to set up fast links.

== Running JNOS (or other NOS) on top of Linux ==

If you're already familiar with running NOS on top of DOS or Linux, or wish to keep the AMPRnet IP packet routing away from the host Linux system, it might make sense to run JNOS as an application on top of Linux.

The downside is that it'll have a slightly higher overhead (consumed memory and CPU), and you'll have two IP routers running on top of each other instead of just one, which is seen as slightly complicated by some.

The upside is that you'll also get the JNOS BBS-type features, and some other traditional services without installing additional software on top.

=See also=

* [[IPIP Mesh/Ubuntu Linux Gateway Example|Ubuntu Linux Gateway Example]]
* [[IPIP Mesh/Startampr|startampr]]

[[Category:How-To]]
[[Category:How-To Guides]]
[[Category:Infrastructure]]
[[Category:Gateways]]
[[Category:Device and platform guides]]

Setting up a gateway on Linux

2026-09-29T19:09:22Z

KI5QKX: KI5QKX moved page Setting up a gateway on Linux to IPIP Mesh/Linux: Group IPIP Mesh documentation under IPIP Mesh

#REDIRECT [[IPIP Mesh/Linux]]