How to Build Your Own Internet: DIY ISP, Community Mesh and Materials

You cannot build "the internet" on your own, because the internet is tens of thousands of independent networks that agree to exchange traffic. What you can build is a network that joins it: a home or campus network, a neighbourhood mesh, a small wireless ISP or a fiber ISP. The materials are fiber or radios, switches and routers, a few servers, power and backup, an upstream connection and, once you grow, your own autonomous system number and IP addresses from a regional internet registry.

This guide explains how the internet is put together, compares four ways to build your piece of it, lists the equipment by layer, covers spectrum, number resources, regulation, costs and security, and ends with a walkthrough from home lab to a small WISP running BGP. Facts come from the RFC Editor, ARIN, RIPE NCC, APNIC, MANRS, the FCC and the eCFR, the Internet Society, kernel and OpenWrt documentation, and community networks' own sites.

Electrical, tower and radio installation are covered at a planning level only. Climbing, rooftop work, mains power, grounding and lightning protection belong with licensed professionals, and radio operation must follow your national regulator's rules.

Key takeaways

• You join the internet; you do not build it. Every network is an autonomous system, or sits inside one, and exchanges routes with its neighbours using BGP (RFC 4271).
• Start as a customer of someone else's network. Home networks, meshes and small WISPs can all run on an upstream's addresses. You need your own ASN and IP space when you want your own routing policy, usually to connect to two upstreams.
• IPv4 is scarce; IPv6 is not. ARIN's free IPv4 pool ran out in September 2015, and RIPE NCC offers new members a single /24 from a waiting list. ARIN's 2026 fees start at 275 US dollars a year for the smallest holdings.
• Unlicensed spectrum still has rules. FCC Part 15 lets certified radios operate without an individual licence, on condition that they cause no harmful interference and accept interference. CBRS adds a shared 3550 to 3700 MHz band with three tiers.
• Serving the public brings filings. In the US, facilities-based fixed broadband providers file in the FCC's Broadband Data Collection, and CALEA has covered them since 2005.
• Routing security is part of the job. Publish ROAs, validate routes, filter announcements, block spoofed sources (BCP 38) and follow the MANRS actions.
• Your network runs on software. Router operating systems, CPE firmware, mesh and BGP daemons, RADIUS, DNS and monitoring all carry open source dependencies that need patching.

Can you build your own internet?

"Internet" is short for internetwork, a network of networks. No one owns it as a whole. NYC Mesh, a volunteer community network in New York, puts it plainly in its FAQ: the internet is decentralized, no one owns it, and it runs on voluntary agreements between network owners. So "building your own internet" means one of three things:

1. A private network connected to nothing. Useful for local services, events or emergencies, but not "internet" until it connects to someone who is.
2. A network that buys its connection from an upstream provider. Home networks, offices, most community meshes and many small WISPs work this way. You run your side; your upstream carries you to the world.
3. A peer network in its own right. You hold an ASN and IP addresses, speak BGP with two or more upstreams and perhaps an internet exchange point, and the rest of the internet learns your routes directly.

Most projects move through these stages in order.

How the internet is put together

Autonomous systems

ARIN defines an autonomous system as a group of one or more IP prefixes run by one or more operators with a single, clearly defined routing policy. RFC 1930, the 1996 guidelines for registering an AS, uses nearly the same words and advises against getting an AS number unless your routing policy differs from your provider's. ARIN describes three kinds: a stub AS connects to one other AS, a multi-homed AS connects to two or more, and a transit AS carries traffic between others, as ISPs do.

ARIN notes that the move to 4 byte ASNs began in 2007 and all ASNs should now be treated as 4 byte. Private ranges are 64512 to 65534 and 4200000000 to 4294967294. You can use them inside your own network, for example between mesh routers, but never announce them to the internet.

BGP, the protocol that connects them

BGP version 4, specified in RFC 4271 (January 2006), is how autonomous systems tell each other which prefixes they can reach. A session is a TCP connection between two routers. Each announcement carries an AS path, the list of networks the route has crossed, and each router picks among paths by local policy. BGP has no built in check that a network may announce a prefix, which is why RPKI and filtering matter. Our BGP explainer covers path selection.

Inside a network, operators run an interior protocol such as OSPF and use BGP only at the edges. NYC Mesh's FAQ says it uses OSPF to mesh much of its network, while its supernodes run Linux with the BIRD daemon and BGP. Our OSPF explainer shows how link state routing works.

Transit, peering and internet exchange points

• Transit. You pay an upstream to carry your traffic to the whole internet and announce your routes to everyone.
• Peering. Two networks exchange traffic for each other's customers, usually without payment. It reaches only the peer and its customers.

An internet exchange point (IXP) is a shared switching fabric where many networks peer. The Internet Society says IXPs create shorter routes and a cheaper alternative to sending local traffic abroad, and that one needs switches, routers, servers, a neutral location, power, cooling, security and a technical community. PeeringDB is the community database where networks publish peering policies, IXP presence and contacts, with a public API. A small ISP typically buys one or two transit circuits and adds an IXP port if one is nearby.

Submarine cables and long haul fiber

Between cities and continents, traffic rides long haul fiber and submarine cables. TeleGeography estimates over 1.5 million kilometres of submarine cable in service as of early 2026, owned by carrier consortia or privately, with large content providers now among the main builders. A DIY network never builds this layer; you buy capacity from someone present where your upstreams are.

Four ways to build your own piece of the internet

A simple rule: until you know people want the service, start as a mesh or WISP on an upstream's addresses. Get your own ASN and addresses when you need a second upstream or an IXP. Build fiber when demand density and capital justify trenching or pole work.

Materials and equipment by layer

The table lists categories, not brands. Choose by the specifications your design needs: band, throughput, interfaces, certification for your country, power draw, management features and how long the maker ships security updates.

Fiber and optics

A passive optical network (PON) runs one fiber from an optical line terminal (OLT) to an unpowered splitter that feeds many optical network terminals (ONTs) at customer premises, so the outside plant needs no electricity. The ITU-T writes the standards; G.9807.1 defines 10 gigabit symmetric PON, with the current edition dated February 2023 and an amendment in May 2025. Point to point fiber, one strand per building, is common for backhaul and business links. NYC Mesh says it connects some whole buildings by fiber at 10 gigabits or more where wireless is not possible: radio where it is fast, fiber where capacity demands it. Splicing, OTDR testing and pole or trench work are skilled trades, and pole and right of way permissions come from owners and local authorities.

Point to point and point to multipoint radios

Backhaul uses point to point (PtP) links with narrow, high gain antennas between towers or rooftops, needing clear line of sight and Fresnel zone clearance. Access uses point to multipoint (PtMP) sector radios serving many customer radios aimed back at the sector. Survey every link for trees, buildings and seasonal foliage, and budget for interference in shared bands.

Towers and mounts

A rooftop may need only a non penetrating mount with the owner's written permission. A tower is a structure that needs engineering, foundations, grounding, permits and inspections, and trained climbers. In the US, 47 CFR 17.7 requires FAA notification for construction more than 200 feet above ground and for shorter structures that penetrate slopes around airports and heliports. The FCC's Antenna Structure Registration pages point to the TOWAIR tool for those slopes and to the Tower Construction Notification System for notifying tribes and historic preservation officers. Use a licensed tower contractor and structural engineer.

Switches, routers and CPE

Managed switches separate customers, management and backhaul on VLANs; PoE switches power rooftop radios. The edge router must run BGP, apply filters and, if you take full routes, hold the full tables. Many small operators use a Linux server with an open source BGP daemon. For customer premises equipment, RFC 7084 (November 2013) sets basic requirements for IPv6 customer edge routers, including prefix delegation to the LAN. Read it before choosing CPE, and see our IPv4 vs IPv6 guide.

Servers for DNS, DHCP, RADIUS and monitoring

Even a small ISP runs two recursive DNS resolvers (see our DNS protocol explainer), DHCP and DHCPv6 or router advertisements, RADIUS or another AAA service for customer authentication, IP address management so you can answer abuse reports, monitoring and alerting for links, signal levels, power and BGP sessions, and billing. Two small servers running virtual machines will do at first. If you already run a homelab, you know the pattern.

Power and UPS

Every rooftop, tower and hut needs power and batteries sized for your outage target; remote sites may need solar or a generator. Mains wiring, generator transfer and battery banks are work for a licensed electrician. Our guides to building a data center and edge computing cover power and remote sites in depth.

Spectrum: unlicensed, shared and licensed

Radio is the fastest way to reach customers, and spectrum rules decide what you can do. The US is the worked example because its rules are published in the eCFR.

Unlicensed bands under FCC Part 15

Part 15 lets certified devices operate without an individual station licence. The trade off is in 47 CFR 15.5: operation must cause no harmful interference and must accept interference from authorised stations and other devices, you gain no vested right to a frequency, and you must stop if the FCC says your device is causing harmful interference. The main fixed wireless bands are:

• 902 to 928 MHz, 2400 to 2483.5 MHz and 5725 to 5850 MHz under 15.247. For digital modulation, maximum conducted output power is 1 watt. In 2.4 GHz, fixed point to point links may use antennas above 6 dBi only by cutting power 1 dB for every 3 dB of extra gain; in 5725 to 5850 MHz they may use higher gain without that reduction.
• The 5 GHz U-NII bands under 15.407. For 5.725 to 5.850 GHz the rule sets 1 watt conducted power and 30 dBm in any 500 kHz, with reductions for antenna gain above 6 dBi and an exception for fixed point to point use.
• 6 GHz. In FCC 20-51, the Commission adopted unlicensed standard power and low power indoor rules for 5.925 to 7.125 GHz.

Buy certified equipment, set the correct country code, and never raise power or swap antennas beyond the certification.

CBRS: a shared band with three tiers

The Citizens Broadband Radio Service covers 3550 to 3700 MHz under Part 96. Incumbent Access users, such as federal systems, are protected from everyone. Priority Access Licenses are 10 MHz channels in 3550 to 3650 MHz, auctioned by county for renewable 10 year terms, up to seven per county. General Authorized Access is "licensed-by-rule" across the whole band but must not interfere with the tiers above and must accept their interference. A Spectrum Access System coordinates access, sometimes using sensors to detect incumbents. GAA gives a small WISP mid band spectrum without an auction, at the price of SAS registration and channels that can change.

Licensed links and other regulators

Where interference is unacceptable, operators license point to point microwave links, adding coordination and fees in exchange for protection. Other countries differ: in the UK, Ofcom publishes Wireless Telegraphy Exemption Regulations for licence exempt equipment; in the EU, harmonised standards and national authorities set the rules; India, Australia, Canada and others publish their own. Check your regulator before you transmit.

Number resources: ASNs and IP addresses

Running on an upstream's addresses is fine until you want a second upstream. Then you need your own routing policy: an ASN and provider independent addresses that both upstreams can carry.

ARIN's NRPM section 4.10 also sets aside /24 blocks for immediate IPv6 deployment needs such as dual stack DNS or translators. For IPv6 sizing, ARIN says each end site generally receives a /48; give each customer a stable prefix, not a single address.

What it costs to hold resources

Under ARIN's schedule in effect from 1 January 2026, the annual fee depends on total holdings:

Fees can rise by no more than 5 percent a year, and a new schedule takes effect on 1 January 2027, so check before budgeting. Transactional fees are separate. RIPE NCC and APNIC charge through membership. Buying IPv4 on the transfer market costs far more; RIPE NCC says it has no interest in the financial side of transfers. Many small operators run IPv6 widely and a small IPv4 block behind carrier grade NAT. RFC 6598 (April 2012) reserved 100.64.0.0/10 as shared address space for that purpose, so CGN pools do not collide with customers' private ranges.

Upstream connectivity and BGP sessions

1. Order transit from two providers over physically different paths. Agree the session details, the prefixes they will accept and whether they send a default route or a full table.
2. Create route objects and ROAs. ARIN hosts a certificate authority and signs ROAs for resources in its region; only direct resource holders take part, and downstream networks ask their upstream to create ROAs for them.
3. Publish your network in PeeringDB with contacts and policy.
4. Join an IXP if one is in reach.

Start every session from deny all. RFC 8212 (July 2017) changed eBGP defaults so that, without an explicit policy, routes are neither accepted nor advertised.

Legal and regulatory steps

This summarises official sources we checked; it is not legal advice. Ask your regulator and a telecom lawyer before you sell service.

United States.

• Broadband Data Collection. The FCC says facilities-based fixed broadband providers must submit availability and subscription data in the BDC system. The Form 477 interface stopped accepting data on 31 December 2022.
• CALEA. The FCC extended CALEA in 2005 to facilities-based broadband internet access providers and interconnected VoIP providers. Since 29 June 2023, System Security and Integrity Plans must be filed through the FCC's CALEA Electronic Filing System.
• Towers. FAA notification under 47 CFR 17.7, Antenna Structure Registration where required, and the environmental and historic preservation notices on the FCC's ASR pages.
• Spectrum. Part 15 rules, Part 96 SAS registration for CBRS, and licences for licensed links.
• State and local. Business registration, taxes, rights of way, pole attachments and building and electrical permits vary.

Elsewhere. Many countries require a general authorisation, notification or licence to provide public electronic communications, plus lawful interception and consumer protection duties. Start with your regulator's website.

Community networks. Do not assume a members only network is exempt. The Internet Society's community network pages point to its Community Network Do-It-Yourself Toolkit, ten steps from readiness to sustainability, and its Connecting the Unconnected programme funds community, municipal and cooperative networks.

Security essentials for a small network

A small network can harm others by leaking routes, accepting hijacked ones or sending spoofed traffic, and can be harmed through its own routers and CPE.

Sign and validate routes with RPKI

RFC 6480 (February 2012) describes the Resource Public Key Infrastructure, in which holders publish signed Route Origin Authorizations (ROAs) naming the AS allowed to originate a prefix. RFC 6811 (January 2013) defines origin validation, which labels routes Valid, Invalid or NotFound. Create ROAs for every prefix with a tight maximum length, and run a validator that feeds your routers. Origin validation does not check the whole AS path; see what RPKI route origin validation does not stop and BGP hijacking and software distribution.

Filter sessions and block spoofing

RFC 7454 (February 2015), BGP Operations and Security, recommends TCP authentication and the Generalized TTL Security Mechanism on sessions, prefix filters in both directions, rejecting bogons and overly specific prefixes, and a maximum prefix limit per session. RFC 2827 (May 2000), published as BCP 38, recommends ingress filtering so a network forwards only packets whose source addresses belong to it, which blunts reflection and amplification attacks.

Follow the MANRS actions

MANRS asks network operators for four actions: filtering (correct announcements from you and your customers), anti-spoofing (source address validation at least for single-homed stub customers, your users and infrastructure), coordination (current contacts in routing databases) and global information (publish data so others can validate). Its implementation guide targets stub networks and small providers.

Patch CPE and routers

On 31 January 2024, CISA and the FBI issued a Secure by Design alert to small office and home office router makers after activity targeting those routers, particularly by the Volt Typhoon group, urging them to remove web management defects, automate updates and keep management interfaces on LAN side ports. As an operator, buy equipment with a clear update policy, keep management off the internet, inventory firmware versions and patch on a schedule. See is open source router firmware more secure than stock and our firmware supply chain security guide.

Community network examples

These summaries come from each network's own site.

• NYC Mesh (New York). Volunteers who put an antenna on a building's roof and run a cable to the apartment, or connect whole buildings by fiber. Fiber connected "supernodes" are gateways to the internet, hub nodes extend the mesh without their own gateway, and the network depends on donated transit. It suggests that DIY installers who can afford it contribute toward an average equipment cost of 240 US dollars, and reports a ConnectALL grant of 898,035 US dollars.
• Freifunk (Germany and beyond). A non commercial initiative for free wireless networks, where participants' routers relay each other's traffic in meshes, many share internet access, and local communities run their own Freifunk firmware, a Linux distribution.
• guifi.net (Catalonia). A community telecommunications network run on social and collaborative economy principles and treated as a commons.

The Internet Society also reports a 2026 ITU study finding that community networks are key to reaching people beyond commercial networks.

What it costs, from public sources

Primary cost data for network builds is thin and varies hugely by place. The hard figures we confirmed are ARIN's 275 US dollars a year for the smallest holdings and NYC Mesh's suggested average of 240 US dollars of equipment per install. Price everything else locally: transit, IXP port and colocation, fiber construction per metre or per passing, pole attachment and permit fees, tower or roof leases, radios and CPE per customer, routers, servers, UPS and batteries, tools, insurance, legal filings and staff or volunteer time. Get at least three quotes for transit and construction.

Step by step: from home lab to small WISP

Each stage builds on the last. Commands are examples; check your device's documentation first.

Stage 1: a home network that behaves like a tiny ISP

Goal: one router with separate networks for trusted devices, guests and lab, working IPv6, and an update routine.

1. Pick a router OpenWrt supports. OpenWrt describes itself as a Linux operating system for embedded devices with a writable filesystem and package management, and points to its official Firmware Selector for images. Flashing can brick a device: follow the device page exactly and keep the stock image.
2. Record what you run and inspect the network. OpenWrt's documentation says /etc/config/network holds interface settings and is applied by the network service, typically with a static lan on the br-lan bridge and a DHCP wan plus wan6.

# Record the OpenWrt release and board details
cat /etc/openwrt_release
ubus call system board

# Inspect, then move the LAN to a subnet that will not clash later
uci show network.lan
uci set network.lan.ipaddr='192.168.50.1'
uci set network.lan.netmask='255.255.255.0'
uci commit network
service network reload

# Check interface state
ifstatus wan
ifstatus wan6

3. Add VLANs and firewall zones for guests and lab so they cannot reach the trusted LAN. Keep router management on the trusted LAN only.
4. Turn on IPv6. If your provider delegates a prefix, give each internal network a /64. This is the model you will later use for customers.
5. Run a local recursive resolver with DNSSEC validation, ship logs and counters to a small server, and alert on WAN loss.
6. Patch. Follow your firmware's security announcements, upgrade on a schedule and record each version.

Stage 2: a neighbourhood mesh

Goal: a few rooftops linked by radio, sharing one or two gateways, with routing that heals around failures.

1. Organise first. Agree ownership, roof access, cost sharing and acceptable use. Get written permission from building owners, and use trained, insured installers for rooftop and mast work.
2. Survey line of sight and choose hub and gateway sites.
3. Choose a routing approach. The Linux kernel documentation describes batman-adv as working only at layer 2, bridging Ethernet frames so all nodes appear to share one virtual switch and IPv4, IPv6 and DHCP work unchanged above it. For layer 3, Babel (RFC 8966, January 2021) is a loop avoiding distance vector protocol suited to wireless meshes as well as wired links, and OSPF suits stable links.
4. Bring up batman-adv on a test pair using the kernel documentation's commands.

# Create the mesh interface and attach the radio facing other nodes (example: mesh0)
ip link add name bat0 type batadv
ip addr flush dev mesh0
ip link set dev mesh0 master bat0

# Bring it up and address it (use 10.42.0.2/24 on the second node)
ip link set up dev bat0
ip addr add 10.42.0.1/24 dev bat0
ping 10.42.0.2

# batman-adv messages in the kernel log
dmesg | grep batman-adv

5. Add gateways. One node connects upstream and routes an IPv6 prefix or runs NAT; a second gateway at another site adds resilience.
6. Separate management of radios onto a VLAN members cannot reach, publish a status page, and keep a firmware inventory of every device.

Stage 3: a small WISP with its own ASN

Goal: two upstreams, your own prefixes, BGP with RPKI validation and filters, spoof protection and PtMP customer service.

1. Register the business and check obligations, including BDC and CALEA in the US.
2. Get resources. Request an ASN and IPv6 space from your RIR, obtain what IPv4 you can, and create ROAs.
3. Order two transit circuits over diverse paths.
4. Build the edge. This illustrative BIRD 2 configuration uses documentation addresses and private ASNs. It accepts only a default route from the upstream, rejects RPKI invalid routes, announces only your prefix and caps the routes received. Test in a lab first.

# /etc/bird.conf  (BIRD 2.x, illustrative only)
router id 192.0.2.1;
roa6 table r6;

# ROAs from a local RPKI validator over the RPKI to Router protocol
protocol rpki validator1 {
  roa6 { table r6; };
  remote "127.0.0.1" port 3323;
}

define MY_V6 = [ 2001:db8:100::/40 ];

filter upstream_in_v6 {
  if roa_check(r6, net, bgp_path.last) = ROA_INVALID then reject;
  if net = ::/0 then accept;
  reject;
}

filter upstream_out_v6 {
  if net ~ MY_V6 then accept;
  reject;
}

protocol static own_v6 {
  ipv6;
  route 2001:db8:100::/40 unreachable;
}

protocol bgp upstream_a {
  local 2001:db8:ffff::2 as 64500;
  neighbor 2001:db8:ffff::1 as 64510;
  ipv6 {
    import limit 10 action restart;
    import filter upstream_in_v6;
    export filter upstream_out_v6;
  };
}

For a full table, accept routes up to /48, keep the RPKI check and set the import limit a margin above the table size your upstream quotes. Repeat for the second upstream and for IPv4 with a roa4 table, then check:

birdc show protocols
birdc show route protocol upstream_a
birdc show route table r6 count

5. Block spoofed sources (BCP 38) on customer facing interfaces.

# Strict reverse path filtering for IPv4
sysctl -w net.ipv4.conf.all.rp_filter=1

# /etc/nftables.d/antispoof.nft  (customer facing interface: cust0)
table inet antispoof {
  chain forward {
    type filter hook forward priority 0; policy accept;
    iifname "cust0" ip saddr != 100.64.0.0/22 drop
    iifname "cust0" ip6 saddr != 2001:db8:100::/40 drop
  }
}

6. Deploy access through licensed installers, within certified power and antenna limits, registering CBRS devices with a SAS if you use that band.
7. Stand up services: two resolvers, DHCPv6 prefix delegation, RADIUS, IPAM, monitoring and billing.
8. Join MANRS and PeeringDB, keep registry and abuse contacts current, and consider an IXP port.
9. Inventory and patch the software: every router OS, radio firmware, daemon and service, with versions and the open source components they ship.

Where Safeguard fits, honestly

Most of a network build is glass, copper, steel, radios and paperwork, and Safeguard does none of that. It does not manage network devices, scan firmware, protect endpoints or monitor routing. It helps with the software you write and deploy around the network: provisioning and billing apps, automation, dashboards, their container images and any SBOM a supplier gives you. Safeguard scans repositories, images and SBOM files, matches components against vulnerability databases, ranks reachable code paths first, shows which projects contain a given component and version, and enforces policies and gates in CI.

Common mistakes

• Getting an ASN before you need one. A single homed network gains little from it.
• Loose ROAs. A maximum length wider than you announce lets others originate more specific routes that still validate.
• Unfiltered BGP sessions. One mistake can leak a full table. Start from deny all.
• Skipping BCP 38. Spoofable customers make your network part of other people's attacks.
• Exceeding certified power or antenna gain. Part 15 operation depends on staying within the rules.
• DIY climbing and mains work. Use licensed electricians, trained climbers and engineers, with written owner permission for every roof.
• Fit and forget CPE and management on the internet. Inventory firmware, patch, and keep management on a separate VLAN or VPN.
• IPv4 only, one upstream, one path. Design IPv6 first and make sure two transit circuits do not share a duct.
• No software inventory. Every daemon, panel and script has dependencies; if nobody lists them, nobody patches them.

FAQ

Can I build my own internet at home?

You can build your own network and connect it through a provider, but you cannot replace the internet, which is a network of independent networks. A home router with VLANs, IPv6 and a local resolver teaches most ISP skills.

What equipment do I need to start a small ISP?

Upstream transit, BGP capable edge routers, managed switches, access equipment (radios, or fiber with OLTs and ONTs), CPE, servers for DNS, DHCP, RADIUS, monitoring and billing, UPS at every site, and installation and test tools.

Do I need an ASN to start an ISP?

Not at first. You need one when you have your own routing policy, usually with two upstreams. ARIN issues one ASN to any organisation on request; RIPE NCC currently requires the network to be multi-homed.

How much does an ASN cost?

At ARIN, up to three ASNs plus a /24 or smaller of IPv4 and a /40 or smaller of IPv6 cost 275 US dollars a year under the 2026 schedule, which changes on 1 January 2027. RIPE NCC and APNIC charge through membership.

Can I still get IPv4 addresses?

Only small amounts or by transfer. ARIN's free pool ran out in September 2015 and its waiting list is capped at a /22; RIPE NCC gives new members one /24 from a waiting list. Most new networks lean on IPv6 plus carrier grade NAT.

Do I need a licence to run a wireless ISP in the US?

Part 15 equipment needs no individual licence but must be certified and cause no harmful interference. CBRS GAA is licensed by rule with SAS registration; licensed links need licences. Providers also file BDC data, are covered by CALEA, and face state and local rules.

What is the difference between a community mesh and an ISP?

A mesh is usually run by members or volunteers, often not for profit, sharing gateways. An ISP sells service. The technology overlaps; governance, money, scale and legal duties differ.

Is a mesh network the same as the internet?

No. A mesh is a local network where nodes relay traffic for each other. It reaches the internet only through gateway nodes that connect to an upstream provider, which is why NYC Mesh's supernodes have fiber gateways.

How do I keep my network from hijacking other people's routes?

Create ROAs, validate received routes, announce only your own prefixes, set maximum prefix limits, block spoofing per BCP 38 and follow the MANRS actions.

Fix it without waiting for upstream

A DIY network is more software than it looks: router operating systems, mesh and BGP daemons, RADIUS, DNS, provisioning and billing apps all ship open source components, and every new site or rebuilt server pulls them again. Safeguard does not patch radio or router firmware you cannot rebuild yourself, so what follows applies to the software you build and deploy around the network.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session: it reads a finding and its advisory, asks before each command, upgrades a dependency, runs tests with your approval and pushes nothing. The same flow fits a small ISP's own repositories, such as a provisioning portal or the scripts that push router configuration.

Click through it at your own pace, or open it full screen.

The second demo sets up the local runner on your own machine, approves it with a device code and scans from the terminal. That suits a workstation inside your management network scanning a monitoring stack's image or a supplier's SBOM without sending source elsewhere.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. A network engineer can then ask which of the operator's projects contain a component named in a new advisory, as long as those projects are in Safeguard.

Click through it at your own pace, or open it full screen.

To try it on your own projects, download Safeguard at safeguard.sh/download and read the CLI documentation.

Quick check

Sources

• RFC Editor, RFC 4271: A Border Gateway Protocol 4 (BGP-4)
• RFC Editor, RFC 1930: Guidelines for creation, selection, and registration of an Autonomous System
• RFC Editor, RFC 6480: An Infrastructure to Support Secure Internet Routing
• RFC Editor, RFC 6811: BGP Prefix Origin Validation
• RFC Editor, RFC 2827 (BCP 38): Network Ingress Filtering
• RFC Editor, RFC 7454: BGP Operations and Security
• RFC Editor, RFC 8212: Default External BGP Route Propagation Behavior without Policies
• RFC Editor, RFC 8966: The Babel Routing Protocol
• RFC Editor, RFC 7084: Basic Requirements for IPv6 Customer Edge Routers
• RFC Editor, RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space
• ARIN, Autonomous System Numbers
• ARIN, Number Resource Policy Manual
• ARIN, IPv4 Waiting List
• ARIN, Your First IPv6 Request
• ARIN, Fee Schedule
• ARIN, Resource Public Key Infrastructure (RPKI)
• RIPE NCC, AS Numbers
• RIPE NCC, IPv4
• APNIC, Get IP
• MANRS, MANRS for Network Operators
• PeeringDB, Documentation
• Internet Society, Internet Exchange Points
• Internet Society, Community Networks
• TeleGeography, Submarine Cable FAQs
• ITU-T, Recommendation G.9807.1: XGS-PON
• eCFR, 47 CFR 15.5: General conditions of operation
• eCFR, 47 CFR 15.247: Operation within the bands 902 to 928 MHz, 2400 to 2483.5 MHz, and 5725 to 5850 MHz
• eCFR, 47 CFR 15.407: General technical requirements (U-NII)
• eCFR, 47 CFR 17.7: Antenna structures requiring notification to the FAA
• FCC, 3.5 GHz Band Overview (CBRS)
• FCC, FCC Opens 6 GHz Band to Wi-Fi and Other Unlicensed Uses (FCC 20-51)
• FCC, Broadband Data Collection: Who must file
• FCC, Communications Assistance for Law Enforcement Act
• FCC, Antenna Structure Registration
• Ofcom, Licence exempt radio use
• CISA, Secure by Design Alert: Security Design Improvements for SOHO Device Manufacturers (31 January 2024)
• OpenWrt, Project README
• OpenWrt, Network configuration
• Linux kernel documentation, batman-adv
• NYC Mesh, Home
• NYC Mesh, FAQ
• Freifunk, What is Freifunk about?
• guifi.net, Home

Last reviewed: 23 October 2026.