Network Design (44Net)

Updated July 15, 2026

At a glance

Item	Value
Public node address	`44.27.29.34` (also `node.w5aww.ampr.org`)
AXIP	UDP 10093 on W5AWW-7
WAN	Starlink (CGNAT)
Tunnel	WireGuard toward 44net / AMPRNet
Edge router	MikroTik (RouterOS 7)
Node host	Fedora + LinBPQ on an isolated network

Path overview

Remote AMPRNet peer
        │
        ▼
44net / AMPRNet
        │
        ▼
WireGuard tunnel
        │
        ▼
MikroTik router
        │
        ▼
Isolated LinBPQ network
        │
        ▼
W5AWW-7
44.27.29.34

Principles:

Split tunnel — only AMPRNet ranges use WireGuard; normal internet stays on WAN.
Direct routing of 44.27.29.34 to the node host — not DNAT theater for the public story, and no source NAT of that address out the tunnel.
Isolation — packet host is off the household LAN; no general default route to the internet from the node.
Least privilege — AXIP and admin paths are explicit; secrets never published.

Security and redaction

Placeholders in examples stand in for:

WireGuard private keys and peer public keys
Provider endpoints and tunnel-side addresses
Internal private IPs, interface names, SSIDs, passwords
NetworkManager connection names
Trusted admin source addresses

Never publish WireGuard private keys, Wi‑Fi passphrases, SSH private keys, API tokens, or unredacted router exports.

1. MikroTik WireGuard

Create the interface

/interface wireguard
add name=<WG_INTERFACE> \
    private-key="<PRIVATE_KEY>" \
    mtu=1380 \
    listen-port=<LOCAL_WG_PORT> \
    comment="44net WireGuard tunnel"

Add the peer (AMPRNet ranges only)

/interface wireguard peers
add interface=<WG_INTERFACE> \
    name=<WG_PEER_NAME> \
    public-key="<PROVIDER_PUBLIC_KEY>" \
    allowed-address=44.0.0.0/9,44.128.0.0/10 \
    endpoint-address=<PROVIDER_ENDPOINT> \
    endpoint-port=<PROVIDER_PORT> \
    persistent-keepalive=20s \
    comment="44net WireGuard peer"

44.0.0.0/9
44.128.0.0/10

Tunnel address and AMPRNet routes

/ip address
add address=<TUNNEL_ADDRESS>/32 \
    interface=<WG_INTERFACE> \
    comment="44net tunnel address"

/ip route
add dst-address=44.0.0.0/9 \
    gateway=<WG_INTERFACE> \
    comment="Lower AMPRNet range"

/ip route
add dst-address=44.128.0.0/10 \
    gateway=<WG_INTERFACE> \
    comment="Upper AMPRNet range"

Host route for W5AWW-7

/ip route
add dst-address=44.27.29.34/32 \
    gateway=<LINBPQ_PRIVATE_NEXT_HOP> \
    comment="W5AWW-7 host route"

A /32 marks this address as owned by the node host. Other addresses from 44.27.29.32/27 can be routed later the same way.

2. Isolated LinBPQ network

The LinBPQ server sits on a network separate from ordinary household devices:

Dedicated wireless (or wired) datapath
Private next-hop between router and server
Directly assigned public 44net /32
No normal internet default route
No access to the household LAN
Explicit firewall allow rules only

Public address remains:

44.27.29.34/32

Example bridge / Wi‑Fi datapath (shape only)

/interface bridge
add name=<ISOLATED_BRIDGE> \
    protocol-mode=rstp \
    comment="Isolated LinBPQ network"

/ip address
add address=<ISOLATED_GATEWAY>/<PREFIX> \
    interface=<ISOLATED_BRIDGE> \
    comment="LinBPQ isolated gateway"

/interface wifi datapath
add name=<LINBPQ_DATAPATH> \
    bridge=<ISOLATED_BRIDGE>

/interface wifi
add name=<LINBPQ_WIFI_INTERFACE> \
    master-interface=<PHYSICAL_WIFI_INTERFACE> \
    configuration=<LINBPQ_WIFI_CONFIGURATION> \
    disabled=no

3. Fedora host addressing and routes

Two IPv4 addresses on the isolated connection:

44.27.29.34/32
<PRIVATE_NEXT_HOP_ADDRESS>/<PREFIX>

The /32 on the 44net address avoids treating the whole /27 as on-link on the wireless interface.

sudo nmcli connection modify "<LINBPQ_CONNECTION>" \
  ipv4.method manual \
  ipv4.addresses "44.27.29.34/32,<PRIVATE_ADDRESS>/<PREFIX>" \
  ipv4.gateway "" \
  ipv4.never-default yes \
  ipv4.dns "" \
  ipv6.method disabled

sudo nmcli connection modify "<LINBPQ_CONNECTION>" \
  ipv4.routes \
  "44.0.0.0/9 <PRIVATE_GATEWAY> 44 src=44.27.29.34,44.128.0.0/10 <PRIVATE_GATEWAY> 44 src=44.27.29.34"

Verify

ip route get 44.4.50.2 from 44.27.29.34

Expect src 44.27.29.34 on the isolated interface. After isolation policy is tight, ordinary internet destinations should not have a usable default via this host:

ip route get 1.1.1.1

4. Router firewall policy

Allow inbound AXIP to the public address

/ip firewall filter
add chain=forward \
    action=accept \
    in-interface=<WG_INTERFACE> \
    dst-address=44.27.29.34 \
    protocol=udp \
    dst-port=10093 \
    comment="W5AWW-7 allow inbound AXIP"

Match 44.27.29.34, not the private next-hop.

Allow outbound AMPRNet from the node

/ip firewall filter
add chain=forward \
    action=accept \
    src-address=44.27.29.34 \
    dst-address=44.0.0.0/9 \
    out-interface=<WG_INTERFACE> \
    comment="W5AWW-7 lower AMPRNet outbound"

/ip firewall filter
add chain=forward \
    action=accept \
    src-address=44.27.29.34 \
    dst-address=44.128.0.0/10 \
    out-interface=<WG_INTERFACE> \
    comment="W5AWW-7 upper AMPRNet outbound"

Do not masquerade the 44net address

/ip firewall nat
add chain=srcnat \
    action=accept \
    src-address=44.27.29.34 \
    out-interface=<WG_INTERFACE> \
    place-before=0 \
    comment="Do not NAT W5AWW-7"

Policy goals (after testing)

Allow inbound AXIP UDP 10093 (and established/related)
Allow outbound AMPRNet
Block general internet from the node
Block household LAN access from the node
Restrict admin paths to trusted sources
Never SNAT the public 44net address

Optional: peer-specific AXIP allow

After a link is stable, tighten from “any AMPRNet” to a peer /32:

/ip firewall filter
add chain=forward \
    action=accept \
    in-interface=<WG_INTERFACE> \
    src-address=<TRUSTED_PEER_44NET_ADDRESS>/32 \
    dst-address=44.27.29.34 \
    protocol=udp \
    dst-port=10093 \
    comment="Allow AXIP from trusted peer"

5. Fedora firewall

sudo firewall-cmd --permanent \
  --zone=<LINBPQ_FIREWALL_ZONE> \
  --add-port=10093/udp

sudo firewall-cmd --reload

SSH and other admin services should be limited to known management addresses, not “all of 44net.”

sudo firewall-cmd --permanent \
  --zone=<LINBPQ_FIREWALL_ZONE> \
  --add-rich-rule='rule family="ipv4" source address="<TRUSTED_ADMIN_ADDRESS>/32" port port="22" protocol="tcp" accept'

6. LinBPQ AXIP port shape

PORT
PORTNUM=5
ID=AXIP 44net
DRIVER=BPQAXIP
QUALITY=192
MINQUAL=145
MAXFRAME=4
FRACK=5000
RESPTIME=1000
RETRIES=5
PACLEN=256
CONFIG
UDP 10093
MHEARD
ENDPORT

sudo systemctl restart linbpq
sudo ss -lunp | grep ':10093'

Expect a listener such as 0.0.0.0:10093.

Peer MAP lines live on the AXIP links page—keep this page about infrastructure.

Public verification

dig +short node.w5aww.ampr.org

44.27.29.34

Internal tunnel handshake and private routing checks stay off the public docs.