Channel Configuration for Infrastructure Nodes

What Are Channels?

Meshtastic supports up to 8 simultaneous channels (numbered 0 - 7). Channel 0 is the primary channel used for most mesh traffic. Channels 1 - 7 can carry separately encrypted traffic for specific groups or purposes.

PSK - Pre-Shared Key

Each channel has a name and a 32-byte encryptionpre-shared key (PSK). The PSK can be 0 bytes (no encryption), 16 bytes (AES-128), or 32 bytes (AES-256) - it is not always a 32-byte AES-256 key. Two nodes can communicate on a channel only if they share the same name and the same PSK.PSK (same key length and value). The PSK isencrypts usedthe channel payloads with AES (AES-128 for a 16-byte key, AES-256 encryptionfor ofa all32-byte payloads on that channel.key).

The Default Public Key

The Default public channel (LongFast) uses a well-known, publicly published default key (the 1-byte key (AQ==, 0x01) - it is a defined weak key, not an empty/no-encryption PSK, so traffic on it is effectively no private encryption).public. Any node running Meshtastic with the default channel can participate in the public mesh. Using a custom PSK creates a private channel readable only by nodes that hold that key.

Channel Strategy for Community Infrastructure Nodes

• Channel 0 - Default PSK: Keep the primary channel on the public Default key so all community users benefit from your repeater's coverage.
• Channel 1 - Private PSK: Adding a secondary channel with a private key for your personal use or club coordination is acceptable. The repeater will relay packets on both channels.

AdminRemote ChannelAdministration

Meshtastic cansupports designateremote anyadministration channel as the Admin channel. Nodesso that share the admin channel with your repeaternodes can send remote configuration commands - changing settings without physical access to the device. In firmware 2.5 and later, the recommended method is PKC admin keys configured under Security Config: you add the public key(s) of trusted administrator nodes to the remote node's admin-key list, and those nodes can then administer it. The legacy admin channel (a secondary channel named exactly admin, case-sensitive) exists only for managing pre-2.5 nodes; there is no "Is Admin" toggle on a channel.

ThisSetting up remote administration is strongly recommended for unattended permanent deployments.

1. NavigateOn tofirmware 2.5+, open Security Config → Channels and add the public key of each trusted administrator node to the node's admin-key list. (For legacy pre-2.5 nodes only: create a newsecondary channel (e.g.named channelexactly 1)admin.)
2. EnableVerify the Isexact Adminapp togglepath before you publish or commit the change - getting remote admin wrong can lock you out of a remote node entirely.

Back up the configuration (export the config, and for thatlegacy channel.admin Savechannels save the channel configuration as a QR codecode) and store it securely - anyone with thisthe admin keys or legacy admin-channel QR code can reconfigure your node remotely.

Channel Propagation

YourWhat repeatera onlyrelay relaysrebroadcasts depends on its Rebroadcast Mode, not just on which channels it has configured. IfMeshtastic arelays nodebased on the meshunencrypted ispacket usingheader, so under the default ALL mode a customrepeater channelrebroadcasts all packets that yourmatch repeaterits modem settings and frequency - including packets on channels whose PSK it does not knowhave about,and thosecannot packetsdecrypt. willThis notmeans a private channel can be relayed.carried by a public repeater. Only the LOCAL_ONLY or KNOWN_ONLY rebroadcast modes restrict relaying to the repeater's own configured/known channels. (A node still has to be on the same modem preset and frequency to hear and relay at all.) For a public community repeater, keeping only the public Default channel configured is the standard approach.approach, but be aware that under default ALL mode it will still relay other traffic on the same modem settings.

Changing Channels on a Deployed Node

Options for modifying channel config after deployment:

• Via remote admin channel (preferred for remote nodes) - send a channel update from anotheran deviceadministrator node whose key is in the remote node's admin-key list (or, on legacy nodes, that shares the admin channel.channel).
• Via serial/USB - connect a laptop directly to the node.
• Via Bluetooth - only if Bluetooth was left enabled.

Common pitfall: losing the admin keys / admin channel config (or disabling Bluetooth and having no USB access) leaves a remote node inaccessible without a physical site visit. Always saveback up admin keys and any admin-channel QR codes before deployment.