// build a network
This page is about a small private network: at home, with friends or within a small organisation. Think of two to ten people, an always-on machine for the routing work and an interface lock so outsiders cannot just join in.
You keep a small group reachable without a central chat service or open public network. You choose who takes part and how the traffic flows.
A single always-on transport node solves the hardest part: it stays online while the rest can come and go. Laptops and phones connect to it whenever they are on, and everyone has a stable route through the group. If you also want to keep offline messages, you add a propagation node to it.
| Component | Options |
|---|---|
| Always-on machine | A cheap VPS (3-10 EUR/month), a Raspberry Pi 4/5, an old workstation or NUC, or a laptop that does not go to sleep. |
| Clients | Two to ten Ratspeak or Sideband installs, one per person. Desktop or mobile. |
| Optional: LoRa | A Ratdeck, Ratcom or RNode for off-grid coverage when someone is out of WiFi range. |
The transport node runs rnsd (or rnsd-rs). A single executable, light on memory, fine for a Raspberry Pi. The difference is one line: enable_transport = yes. Without that line the node only forwards its own packets. With that line the node becomes the hub that everyone routes through.
# Minimal config for the transport node
[reticulum]
enable_transport = yes
[interfaces]
[[TCP Server]]
type = TCPServerInterface
enabled = yes
listen_ip = 0.0.0.0
listen_port = 4242
Start the daemon and let it run. On a Pi: turn it into a systemd service so it comes back automatically after a reboot. See set up a node for the systemd example.
By default a Reticulum interface accepts traffic from any other node that can reach it. Fine for a public mesh, wrong for a private network.
The solution is IFAC (Interface Access Codes). Pick a network name and a strong shared secret. Write them down somewhere your group can find them: you need them on every device.
# Transport node config with IFAC
[[Groep Server]]
type = TCPServerInterface
enabled = yes
listen_ip = 0.0.0.0
listen_port = 4242
network_name = onze-groep
passphrase = een_sterk_gedeeld_geheim
network_name and passphrase together form the lock. Anyone who connects without the right combination is ignored: they see no announces and cannot request paths.
Each member of the group adds a TCPClientInterface to their config with the same network_name and passphrase. In Ratspeak or another client that runs rnsd separately, this goes in the Reticulum config.
# Client config (each member)
[[Groep]]
type = TCPClientInterface
enabled = yes
target_host = jouw-server.nl
target_port = 4242
network_name = onze-groep
passphrase = een_sterk_gedeeld_geheim
VPS: open port 4242 in your firewall. Pi at home: forward that port on your router. Or use the Pi only on the local network if everyone is on the same WiFi.
A transport node forwards packets but does not store messages. If you want messages to be kept for members who are offline, you also run a propagation node (lxmd) on the same machine.
# On the transport node
lxmd -p &
# On first start lxmd prints the destination hash.
# Share that hash with your group as the Offline Inbox address.
Ratspeak users can set Offline Inbox to Auto (the app picks a reachable propagation node) or to Manual with the specific hash of your node.
| Step | What | Where |
|---|---|---|
| 1 | rnsd with enable_transport = yes | The always-on machine |
| 2 | network_name + passphrase on the server interface | The always-on machine |
| 3 | TCPClientInterface with the same IFAC on every device | Each member |
| 4 | Optional: lxmd -p for offline messages | The always-on machine |