Mesh Network
The toaster principle
A Parahub mesh router works like a toaster — plug it in and forget it. Flash the firmware onto a compatible OpenWrt router and it self-configures, self-connects to nearby nodes, and self-updates at night. No manual setup required.
Two networks from one router
Open network, no password. Speed capped at 512 kbps. Guest traffic routes through a VPN tunnel: you are not liable for their internet activity (Mere Conduit principle).
Your private WPA3 network at full speed. Access to home devices, NAS, DLNA. Local to your router and isolated from guests; your own nodes are linked by an encrypted tunnel, so one private network can span buildings.
Full speed for the host
Guests get basic free access. Those wanting more speed scan a QR code and pay satoshis via Lightning — received by the association and spent on the network. While your node is online, your own devices run at full speed on every Parahub node, no payment needed.
Local and global mesh
Nearby nodes connect automatically over Wi-Fi via batman-adv — one shared guest network with seamless roaming, and your own nodes keep a single private network between them. Nodes in different cities connect via Yggdrasil over the regular internet — automatically, no port forwarding needed.
Network Architecture
Each Bumblebee router creates two WiFi networks and a mesh backhaul. Batman-adv connects all routers at Layer 2. Guest traffic exits through a WireGuard VPN tunnel to a Mullvad exit node — the router owner is never the exit point.
Radio 0 (2.4GHz) Radio 1 (5GHz)
├── mesh (802.11s, SAE) ├── mesh (802.11s, SAE)
├── parahub.io/free (open) ├── Parahub (WPA2/WPA3, 802.11r)
├── Parahub (WPA2/WPA3) └── → batman-adv
└── → batman-adv
bat0 (BATMAN_V)
│
┌──────┼──────┐
br-private │ guest (512kbps / paid unlimited)
10.P.P.0/24│ 10.G.G.0/24
Bee: 10Mbps│ gateway: elected Bumblebee
│ │
│ WireGuard VPN ──→ VPS ──→ Mullvad ──→ Internet
│ OR
│ Direct Mullvad (optional upgrade)
│ OR (fallback)
│ Mesh → nearest Bumblebee with VPN
│
ygg0 (Yggdrasil overlay, management)Guest Traffic Flow
- Default: Guest WiFi → WireGuard tunnel → VPS → Mullvad → Internet
- Upgrade: Guest WiFi → Direct Mullvad WireGuard → Internet (lower latency)
- Fallback: Guest WiFi → Mesh → Nearest gateway with VPN → Internet
If the local VPN tunnel is down, the router finds another Bumblebee in the mesh that has a working tunnel and routes through it. If no gateway is available, guest internet stops (kill switch).
Seamless Roaming
All nodes share the same SSID, password, and encryption (WPA2+WPA3). 802.11r Fast Transition enables ~50ms handoffs. 802.11k/v help clients discover and move to better access points. You walk between rooms and your device follows — no reconnection needed.
Auto-Updates
Routers check for new firmware every night at 3 AM. If an update is available, all nodes download it first, then reboot together at XX:15 — so the mesh stays up during download. SHA256 verification prevents corrupted updates.
Verification Commands
After flashing, SSH into the router and check:
batctl if # phy0-mesh0, phy1-mesh0 iwinfo # 5 wireless interfaces cat /etc/parahub/keys # Credentials + Yggdrasil address uci show network.private # Private bridge config wg show # WireGuard handshake status