# Channel Configuration for Infrastructure Nodes

## What Are Channels?

Meshtastic supports up to **8 simultaneous channels** (numbered 0 - 7). Channel 0 is the *primary channel* used for most mesh traffic. Channels 1 - 7 can carry separately encrypted traffic for specific groups or purposes.

## PSK - Pre-Shared Key

Each channel has a **name** and a **pre-shared key (PSK)**. The PSK can be **0 bytes** (no encryption), **16 bytes** (AES-128), or **32 bytes** (AES-256) - it is not always a 32-byte AES-256 key. Two nodes can communicate on a channel only if they share the same name *and* the same PSK (same key length and value). The PSK encrypts the channel payloads with AES (AES-128 for a 16-byte key, AES-256 for a 32-byte key).

## The Default Public Key

The *Default* public channel (LongFast) uses a **well-known, publicly published default key**(the 1-byte key `AQ==`, 0x01) - it is a defined weak key, not an empty/no-encryption PSK, so traffic on it is effectively public. Any node running Meshtastic with the default channel can participate in the public mesh. Using a **custom PSK** creates a private channel readable only by nodes that hold that key.

## Channel Strategy for Community Infrastructure Nodes

- **Channel 0 - Default PSK:** Keep the primary channel on the public Default key so all community users benefit from your repeater's coverage.
- **Channel 1 - Private PSK:** Adding a secondary channel with a private key for your personal use or club coordination is acceptable. The repeater will relay packets on both channels.

## Remote Administration

Meshtastic supports remote administration so that nodes can send configuration commands - changing settings without physical access to the device. In firmware 2.5 and later, the recommended method is **PKC admin keys**configured under **Security Config**: you add the public key(s) of trusted administrator nodes to the remote node's admin-key list, and those nodes can then administer it. The legacy **admin channel**(a secondary channel named exactly `admin`, case-sensitive) exists only for managing pre-2.5 nodes; there is *no* "Is Admin" toggle on a channel.

**Setting up remote administration is strongly recommended for unattended permanent deployments.**

1. On firmware 2.5+, open **Security Config** and add the public key of each trusted administrator node to the node's admin-key list. (For legacy pre-2.5 nodes only: create a secondary channel named exactly `admin`.)
2. Verify the exact app path before you publish or commit the change - getting remote admin wrong can lock you out of a remote node entirely.
3. Back up the configuration (export the config, and for legacy admin channels save the QR code) and store it securely - anyone with the admin keys or legacy admin-channel QR code can reconfigure your node remotely.

## Channel Propagation

What a relay rebroadcasts depends on its **Rebroadcast Mode**, not just on which channels it has configured. Meshtastic relays based on the *unencrypted* packet header, so under the default `ALL` mode a repeater rebroadcasts **all** packets that match its modem settings and frequency - *including packets on channels whose PSK it does not have and cannot decrypt*. This means a private channel can be carried by a public repeater. Only the `LOCAL_ONLY` or `KNOWN_ONLY` rebroadcast modes restrict relaying to the repeater's own configured/known channels. (A node still has to be on the same modem preset and frequency to hear and relay at all.) For a public community repeater, keeping only the public Default channel configured is the standard approach, but be aware that under default `ALL` mode it will still relay other traffic on the same modem settings.

## Changing Channels on a Deployed Node

Options for modifying channel config after deployment:

- **Via remote admin** (preferred for remote nodes) - send a channel update from an administrator node whose key is in the remote node's admin-key list (or, on legacy nodes, that shares the admin channel).
- **Via serial/USB** - connect a laptop directly to the node.
- **Via Bluetooth** - only if Bluetooth was left enabled.

**Common pitfall:** losing the admin keys / admin channel config (or disabling Bluetooth and having no USB access) leaves a remote node inaccessible without a physical site visit. Always back up admin keys and any admin-channel QR codes before deployment.