Meshtastic Managed Mode and Admin Channels

For deployed infrastructure nodes — community repeaters, fixed gateways — you want to prevent unauthorized configuration changes while still being able to administer the node remotely. Meshtastic provides two tools for this: Managed Mode and Admin Channels.

Managed Mode

When Managed Mode is enabled, the node ignores configuration packets from the local Bluetooth connection unless they come from an authorized admin. This prevents anyone who walks up to the repeater and pairs their phone from changing the configuration.

meshtastic --set device.role MANAGED

With Managed Mode active:

• Local BLE configuration is blocked (requires admin channel for config changes)
• USB serial connection can still configure the device (physical access = admin)
• The node continues to route and relay normally

Admin Channel

The Admin Channel is an encrypted control channel that allows authorized administrators to configure any node in the mesh remotely — even nodes that are out of direct radio range (configuration packets are relayed through the mesh).

Setting Up an Admin Channel

1. Create a channel with a random PSK and name it "admin" (or any name you choose)
2. Add this channel to all nodes you want to manage
3. Only administrators should have the admin channel PSK

meshtastic --ch-set name "admin" --ch-index 1
meshtastic --ch-set psk random --ch-index 1

Remote Configuration via Admin Channel

Once an admin channel is configured, you can send configuration commands to remote nodes via the app's remote admin feature. The command is encrypted with the admin channel PSK, relayed through the mesh, and executed on the target node. The target node responds with its updated configuration.

Security Considerations

• The admin channel PSK is the master key for your infrastructure — guard it carefully
• Distribute admin channel credentials only to trusted operators
• Consider a separate admin channel per node, or per geographic cluster, to limit blast radius if a key is compromised
• USB serial access always overrides Managed Mode — physical access to the hardware is always root access