Node roles

• Bumblebee = gateway node (the bigger routers). Provides the internet exit through a VPN, serves the free network, fully managed from /iot.
• Bee = relay (small ones: AR300M16, CPE710). Extends coverage, borrows internet from a bumblebee over the mesh — no cables, just power.
• Zero-touch: plug in power → the node configures itself, meshes with any Parahub node in radio range and goes online within 5 min. Free WiFi works ~5 min later.
• Make it yours: parahub.io/iot → "Claim a router" → type the MAC from the sticker. You're the owner; share access via the device card → Sharing.

Ports — where the internet goes

Device	Internet in	Wired clients
AXT1800 / AX53UBUMBLEBEEindoor all-rounder — at your internet source	port labeled WAN	LAN ports
MT3000 / MT6000BUMBLEBEEstrongest gateways — busy venues, many clients	2.5G port (WAN)	LAN port
AR300M16BEEpalm-size relay — fills an indoor dead spot	port labeled WAN	port labeled LAN
AP3000 OutdoorBUMBLEBEEweatherproof omni — streets, squares, terraces	single PoE port	— WiFi only
CPE710BEElong-range dish — beams the mesh to a far building	none — mesh-fed	single PoE port

An empty WAN is fine: the node pulls internet across the mesh from another node. Nothing to configure.

WiFi networks

Name	What it is
Parahubfactory default — rename it to anything	Private, password-protected. One name + password across all nodes; devices roam seamlessly.
parahub.io/free	Public, open, for everyone. Sandboxed away from the private network.
parahub.io/mesh	Node-to-node backhaul. Joins automatically — not for people.

Change the password in /iot → device card → WiFi (rename the network there too). Applies fleet-wide at once — one roaming domain.

Recognize the address

Looks like	It is
10.P1.P2.x	Private LAN of one node (unique per node, derived from its MAC; router itself = .1).
10.G1.G2.x	Guest network of one node — same idea, separate world; .1 serves the node's live status page.
10.250.250.1	"Nearest internet gateway" — answered by whichever bumblebee currently has a healthy VPN.
10.99.0.x	VPN tunnel between a node and the exit server.
200:…	Yggdrasil address of the node itself — management plane, stable across updates.
300:…	A private client's global Yggdrasil IPv6 — reachable from outside only if whitelisted in /iot.
fd00:bee5:…	Guest IPv6 — outbound-only, reaches Parahub services at full speed.

Speed — who gets what

Who	Speed
Free guest	512 kbps each (default). The Parahub portal itself is never throttled.
Mesh Pass	Full speed. Up to 5 devices per account; follows the device across every island.
Private WiFi	Full speed on a bumblebee; on a bee capped at 10 Mbps total (default).

Both defaults are the gateway owner's, tunable in /iot — their uplink carries this traffic. A bee host's private traffic exits via the owner and shows that owner's public IP.

Kill switch: no working VPN on the island ⇒ free guests get no internet at all — never routed through a raw connection. The free network stays up in local mode: Parahub services only.

Free vs private — trust model

• Free = anonymous & sandboxed: no access to anyone's LAN, and it exits always through the VPN chain — a guest's visible IP is the Mullvad Portugal exit, never the host's; DNS resolves inside the tunnel.
• Private = trusted: one big LAN across all nodes, exits through the node's own internet connection.
• Paying for Mesh Pass changes speed only — a guest stays sandboxed and VPN-routed.

Where traffic goes

FREEany node → island's gateway node → VPN → Mullvad PT → Internet

PRIVATEthe node's own internet; if it dies → automatic detour via another bumblebee

MGMTnodes phone home every 5 min; auto-update nightly at 03:00

An island = nodes currently meshed together; a separate group forms its own. One gateway per island, auto-elected among VPN-healthy bumblebees; failover ~5 min. Every VPN down ⇒ a local-only gateway (free up, internet off).

Mesh Pass — full speed in 4 steps

1. Join the parahub.io/free WiFi and open it in your browser.
2. Log in or create an account.
3. Pay with Lightning — or earn the pass.
4. Tap "Enable full speed on this device" — active instantly, on every island.

If something's wrong

• Power-cycle first — always safe. The node rebuilds its config and re-registers by itself; fixes most unreachable-node cases.
• node.parahub.net on the free or private WiFi — live status from the router itself: exit state, neighbor signal, your speed tier. Works with the internet down.
• Check /iot: online badge (heartbeat every 5 min), firmware version, uplink & client charts per node.
• Whole island offline ⇒ the gateway lost uplink/VPN — check that node's cable. Parahub-only internet ⇒ every VPN down (local mode).
• A just-rebooted node without its own uplink can look dead ~20 min — give it time.
• Unexpected reboot ≠ fault — self-healing a dead management link.
• Settings changed outside /iot revert on the nightly update — persistent changes go through /iot.
• Anything deeper — hand it to the AI operator.