How to Start a Wireless ISP: Spectrum, Towers, Radios and Security

To start a wireless ISP (WISP), you lease tower or rooftop sites, buy upstream internet transit, and deliver it to homes with point to multipoint radios on unlicensed 5 GHz or 6 GHz spectrum, CBRS at 3.5 GHz, or both, fed by point to point backhaul links. In the US you then file Broadband Data Collection reports with the FCC twice a year, meet CALEA obligations, and keep the radio management plane isolated from subscribers.

This guide goes one level down: which spectrum rules apply to a small operator, how sectors and subscriber dishes work, how to run a link budget with real numbers, what the core needs on day one, what the FCC expects, and how to stop one compromised customer radio from becoming a compromised network. It is a sibling to our posts on getting an ASN and announcing your own prefix with BGP and RPKI, GPON and XGS-PON fibre to the home and building a home firewall with VLANs, so we link to those instead of repeating them.

Every rule quoted below was read from the current electronic Code of Federal Regulations (eCFR) or the FCC's own pages in October 2026. Rules change; read the current text before you buy equipment.

Key takeaways

• A WISP sends internet service from radios on towers, rooftops or silos to a dish or panel fixed on each subscriber's building. It fits rural and semi rural areas where fibre is years away.
• Most small US operators start in unlicensed 5.725 to 5.850 GHz under 47 CFR 15.407, where point to multipoint is capped at 36 dBm EIRP, while fixed point to point links may use high gain antennas without reducing conducted power.
• Outdoor 6 GHz use needs standard power devices registered with an FCC approved Automated Frequency Coordination (AFC) system, checked at least daily.
• CBRS General Authorized Access (GAA) needs no licence, but every base station must register with a Spectrum Access System (SAS) and obey it.
• Licensed Part 101 microwave trades paperwork and time for interference protection on your most important backhaul.
• Plan links with ITU-R P.525 free space loss, ITU-R P.530 clearance and fading methods, and a defensible fade margin. The uplink usually fails first.
• The core needs transit, routing (often your own ASN), CGNAT on 100.64.0.0/10 plus IPv6, DHCP, RADIUS subscriber management and monitoring.
• US facilities based broadband providers file Broadband Data Collection data by 1 March and 1 September, and are covered by CALEA.
• Security is mostly segmentation and hygiene: a management VLAN subscribers cannot reach, subscriber isolation, no default credentials and firmware updates that actually happen.

What is a wireless ISP, and where does fixed wireless make sense?

A wireless internet service provider delivers internet access over radio from fixed infrastructure to fixed customer equipment. The customer side is an outdoor radio with an integrated dish or panel antenna, bolted to a roof and aimed at a tower. That radio is the customer premises equipment (CPE). A cable runs inside to a power injector and then to a home router.

On the network side, a tower carries several sector radios. Each sector covers a wedge of the compass, often 60, 90 or 120 degrees, and serves many CPEs at once. That is point to multipoint (PtMP). The tower is fed by point to point (PtP) backhaul: narrow beam links from tower to tower, ending at a site with fibre to your upstream provider.

Fixed wireless versus fibre versus satellite

Fixed wireless wins when homes are too far apart to justify trenching or poles but close enough that one tall structure can see dozens of them. It loses where trees block every path, where homes sit in folded hills, or where a fibre build is already funded. Many WISPs go hybrid: wireless reaches customers quickly, then fibre goes to the densest pockets.

Be honest about capacity. A sector is shared. A subscriber at the far edge with a marginal signal uses more airtime per bit than one near the tower, so the business turns on how many subscribers a sector carries before evening peak feels slow.

Which spectrum can a small US operator use?

Four families matter: unlicensed 5 GHz under Part 15, unlicensed 6 GHz with AFC, CBRS under Part 96, and licensed microwave under Part 101. The 57 to 71 GHz band is a fifth option for short hops.

Unlicensed 5 GHz: the U-NII bands in 47 CFR 15.407

47 CFR 15.407 governs the 5 GHz Unlicensed National Information Infrastructure (U-NII) bands. The parts that matter to a WISP:

• 5.725 to 5.850 GHz (U-NII-3). Maximum conducted power is 1 W, with power spectral density capped at 30 dBm in any 500 kHz. Above 6 dBi of antenna gain, both limits drop by the excess gain, which yields a 36 dBm EIRP ceiling for sectors and CPEs. Fixed point to point links "may employ transmitting antennas with directional gain greater than 6 dBi without any corresponding reduction in transmitter conducted power." The rule excludes point to multipoint, omnidirectional use and collocated transmitters sending the same information from that exemption.
• 15.247 for the same band. 47 CFR 15.247 also covers 5725 to 5850 MHz for digitally modulated systems at 1 W, with the same point to point allowance. The device's FCC grant tells you which rule it was certified under.
• 5.25 to 5.35 and 5.47 to 5.725 GHz (U-NII-2A and 2C). Conducted power is the lesser of 250 mW or 11 dBm plus 10 log B, where B is the 26 dB emission bandwidth in MHz. Devices must use transmit power control and Dynamic Frequency Selection (DFS) to avoid radar, and operators "shall only use equipment with a DFS mechanism that is turned on." DFS channels add room but can force a channel change when radar appears.
• 5.15 to 5.25 GHz (U-NII-1). Outdoor access points may run 1 W conducted with up to 6 dBi, and fixed point to point devices up to 23 dBi without reduction. Deploying more than one thousand outdoor access points here requires a letter to the FCC first.
• 5.850 to 5.895 GHz is indoor only for unlicensed access points, so it does not help an outdoor WISP.

The same section says "All U-NII devices must contain security features to protect against modification of software by unauthorized parties." That does not make a radio secure against network attackers, but it does mean modified firmware that lifts power or country limits is a regulatory problem as well as a security one.

Unlicensed 6 GHz: standard power with AFC

In April 2020 the FCC opened 5.925 to 7.125 GHz to unlicensed use with standard power and low power indoor rules, now in 15.407. For a WISP:

• Standard power access points and fixed client devices in 5.925 to 6.425 GHz and 6.525 to 6.875 GHz may reach 36 dBm EIRP and 23 dBm per MHz, with an extra limit on outdoor EIRP above 30 degrees elevation.
• Low power indoor, very low power and geofenced variable power devices must be indoors or may not be mounted on outdoor structures, so they are not WISP tools.

Before transmitting, a standard power device must register with an FCC approved AFC system, giving latitude and longitude (NAD 83), antenna height above ground, FCC ID and serial number, and must contact the AFC system at least once per day for its available frequencies and maximum power. The AFC system uses FCC databases to protect incumbents, many of them Part 101 microwave links. The rules require that device to AFC communications be secure "to prevent corruption or unauthorized interception of data."

So 6 GHz availability varies by location, your radios depend on an external service, and wrong height or coordinates are a compliance error. The rule caps channel bandwidth in this band at 320 MHz, and requires a contention based protocol for every 6 GHz device class except standard power access points and fixed client devices.

The IEEE 802.11 working group writes the Wi-Fi standards many outdoor radios build on; its site lists IEEE Std 802.11be-2024 among recent amendments. Many WISP radios, though, run proprietary time division protocols on 802.11 chipsets, because the contention based 802.11 MAC handles many distant clients poorly.

CBRS at 3.5 GHz: GAA, PAL and the SAS

The FCC's 3.5 GHz band overview says the Commission adopted rules in 2015 for shared use of 3550 to 3700 MHz, creating the Citizens Broadband Radio Service with three tiers: Incumbent Access, Priority Access and General Authorized Access. A Spectrum Access System coordinates them, using an Environmental Sensing Capability, a sensor network that detects Department of Defense radar.

The rules sit in 47 CFR Part 96:

• 96.11: GAA users may operate across 3550 to 3700 MHz; Priority Access users in 3550 to 3650 MHz.
• 96.33: anyone eligible may operate a CBSD on a GAA basis, and GAA CBSDs "must register with the SAS and comply with its instructions."
• 96.41: End User Devices 23 dBm EIRP per 10 MHz; Category A CBSD 30 dBm per 10 MHz; Category B CBSD 47 dBm per 10 MHz. CBSDs must reduce power on SAS instruction.
• 96.3: definitions of Category A (lower power) and Category B (higher power) CBSDs, GAA users and Priority Access Licensees, who are protected from GAA users within their licence areas. The FCC page says each PAL is a 10 MHz channel in 3550 to 3650 MHz, licensed county by county at auction for a renewable 10 year term.

GAA appeals to a WISP because there is no auction and 3.5 GHz handles partial obstruction better than 5 or 6 GHz. The trade offs: no protection from PAL holders or incumbents, the SAS can move or reduce your channels, and under 96.45 Category B CBSDs must be professionally installed, are limited to outdoor use, and must report antenna gain, beamwidth, azimuth, downtilt and height to the SAS. Most CBRS gear runs LTE or 5G NR, so your core may include a packet core and SIM provisioning; our 5G core explainer covers that stack.

Licensed point to point microwave under Part 101

When one backhaul link carries a whole tower, interference on it is an outage for everyone. Part 101 licensing gives the link a coordinated, protected frequency. 47 CFR 101.103 sets the process: prior coordination with existing licensees and applicants, a 30 day notification period, and written technical details from anyone claiming potential interference within that period. You then apply in the FCC's Universal Licensing System. Higher bands trade range for capacity and suffer more from rain, which is where the ITU-R P.530 rain methods matter. The coordination and equipment cost more, so many operators reserve licensed links for the one or two hops that carry everything.

60 GHz: short, wide and unlicensed

47 CFR 15.255 covers 57 to 71 GHz. General devices are limited to 40 dBm average EIRP, but outdoor fixed point to point transmitters may reach 82 dBm average EIRP, reduced by 2 dB for every dB the antenna gain falls below 51 dBi. Oxygen absorption near 60 GHz keeps links short and limits interference between neighbours, so 60 GHz shows up as short, high capacity hops between buildings, often with a 5 GHz fallback.

Comparison: which spectrum for which job?

"Relative cost" means equipment and paperwork effort compared with the other rows, not a quoted price.

How do point to point and point to multipoint links work?

Sectors, CPEs and airtime

A sector antenna's horizontal beamwidth matches the wedge it covers; narrower beams give more gain and range but need more sectors. Most WISP sector systems use time division duplexing, alternating downlink and uplink on one channel while a scheduler hands airtime to each CPE. Scheduling matters because CPEs on opposite sides of a sector cannot hear each other, so contention would collide constantly.

Each CPE has a high gain antenna aimed at its sector, and under 15.407 a PtMP CPE must cut conducted power as its gain rises above 6 dBi, like the sector. The uplink is usually weaker because the sector antenna has less gain than the subscriber dish.

Collocated sectors can reuse channels only if antennas reject each other well and the radios are synchronised to transmit and receive at the same moments, which many systems do with GPS timing. Unsynchronised collocated radios desensitise each other.

Fresnel zones and line of sight

Radio energy travels through an ellipsoid around the direct path, the first Fresnel zone, and obstacles inside it cause diffraction loss even when you can see the far end. ITU-R P.530 (current version P.530-19, September 2025) is the reference method for terrestrial line of sight design, including clearance criteria and fading. A common planning target is about 60 percent first Fresnel zone clearance over the worst obstacle.

r1 (metres) = 17.32 * sqrt( (d1 * d2) / (f * D) )
  d1, d2 = km from each end to the point; D = path length in km; f = GHz

Earth bulge h (metres) = (d1 * d2) / (12.74 * k), with k = 4/3 for standard refraction

Worked example A: 15 km backhaul at 5.8 GHz. At midpoint, d1 = d2 = 7.5 km.

• d1 times d2 = 56.25; f times D = 87; ratio 0.6466; square root 0.804.
• r1 = 17.32 times 0.804 = 13.9 m. Sixty percent clearance is 8.4 m.
• Earth bulge: 56.25 divided by 16.99 = 3.3 m.
• The line between antennas must pass about 11.7 m above the highest obstacle at midpoint. With a 20 m tree line there, the beam must be about 32 m above ground at that point, which sets your antenna heights.

Worked example B: 5 km subscriber path at 5.8 GHz. At midpoint, 6.25 divided by 29 = 0.2155, square root 0.464, r1 = 8.0 m, 60 percent = 4.8 m, earth bulge about 0.4 m. A 25 m tree line halfway needs the path about 30 m up there. With the sector at 45 m and the CPE at 6 m, the line at midpoint is 25.5 m above ground: not enough. You go higher at the tower, put the CPE on a mast, pick another tower, or try CBRS.

Link budgets with numbers

Received power (dBm) = EIRP - path loss - other losses + receive antenna gain
Fade margin (dB)     = received power - receiver sensitivity at the chosen modulation
Free space loss (dB) = 32.4 + 20 log10(f in MHz) + 20 log10(d in km)     (ITU-R P.525)

The free space formula comes from ITU-R P.525 (current version P.525-5, November 2024). Sensitivities below are illustrative, not from any product; use your radios' data sheets.

Worked example 1: PtMP at 5 km, 5.8 GHz.

• Free space loss: 32.4 + 75.3 + 14.0 = 121.7 dB.
• Sector with a 17 dBi antenna: conducted power drops 11 dB from 30 dBm to 19 dBm; EIRP 36 dBm.
• CPE with a 23 dBi dish: conducted power drops 17 dB to 13 dBm; EIRP 36 dBm.
• Other losses (cables, light foliage, pointing): 2 dB, assumed.
• Downlink at the CPE: 36 minus 121.7 minus 2 plus 23 = minus 64.7 dBm.
• Uplink at the sector: 36 minus 121.7 minus 2 plus 17 = minus 70.7 dBm.
• Against an illustrative minus 75 dBm sensitivity for a mid range modulation, downlink margin is 10.3 dB and uplink margin only 4.3 dB.

The 6 dB gap is the difference in receive antenna gain. A 4 dB margin falls to a lower modulation on a wet, windy day. Fixes: a narrower, higher gain sector, a closer tower, or a lower planned modulation for that customer.

Worked example 2: PtP backhaul at 15 km, 5.8 GHz.

• Free space loss: 32.4 + 75.3 + 23.5 = 131.2 dB.
• 30 dBi dishes at both ends, 23 dBm conducted (no gain penalty for fixed point to point in this band); EIRP 53 dBm.
• Received: 53 minus 131.2 minus 2 plus 30 = minus 50.2 dBm.
• Against an illustrative minus 65 dBm for the top planned modulation, fade margin is 14.8 dB.

At 5.8 GHz rain matters little over 15 km. On a licensed link in a higher band, add a rain attenuation calculation from P.530 for your region and availability target, which usually means bigger dishes or shorter hops.

Worked example 3: the CBRS difference. At 3600 MHz, 20 log10(f) is 71.1, so free space loss at 5 km is 117.5 dB, about 4.2 dB less than at 5.8 GHz. Add milder diffraction and Category B power of up to 47 dBm per 10 MHz, and CBRS often rescues homes that fail a 5 GHz survey, subject to what the SAS grants.

What does the network core need?

A minimal core for a few hundred subscribers fits in one rack at your fibre landing site.

Upstream transit and routing

You buy IP transit at a site with fibre: a data centre, carrier hotel or local exchange co-location. With one upstream, provider assigned addresses are fine. With two, you want your own Autonomous System Number to multihome with BGP. ARIN's ASN guide explains that an AS is a group of prefixes with a single routing policy and that 16 bit and 32 bit ASNs exist, with private ranges reserved. Our ASN, BGP and RPKI post walks through the request and route signing.

CGNAT for IPv4

RFC 6598 (April 2012) reserves 100.64.0.0/10 as Shared Address Space for carrier grade NAT, so subscriber addressing never collides with the private ranges customers use at home. RFC 6888 (April 2013, Best Current Practice) lists CGN requirements, including:

• REQ-4: a CGN must support limiting external ports per subscriber, so one infected device cannot exhaust the pool.
• REQ-7: endpoint independent filtering is recommended, so games and peer to peer applications work.
• REQ-12: do not log destination addresses or ports unless required, for privacy.
• REQ-14: port allocation should minimise log volume, which is why fixed port blocks per subscriber are common.

You need the address and port mapping to answer lawful requests about who used a public address at a given time. Set retention with counsel.

IPv6 from day one

IPv6 removes NAT for traffic that supports it. Hand each subscriber router a prefix with DHCPv6 prefix delegation, now part of RFC 8415. RFC 7084 requires IPv6 customer edge routers to support prefix delegation (WPD-1) and recommends default inbound filtering per RFC 6092 (S-1). Check any router you supply against it.

Subscriber management

RADIUS (RFC 2865), from June 2000, ties a connection to an account: the access gateway sends an Access-Request, and the server replies with attributes such as the framed IP address and, through vendor specific attributes, the rate limit. Accounting records session start, stop and usage.

Monitoring

Poll every radio and switch with SNMPv3 (authentication and privacy on), graph signal, modulation, airtime and capacity per sector, alert when peak use nears capacity, and ping every CPE so you know who is down before they call. Keep logs off box. That data also calibrates your BDC propagation maps.

What are the regulatory and business steps in the US?

This is not legal advice; talk to a communications lawyer and check your state's rules, which this post does not cover.

Broadband Data Collection, which replaced Form 477

The FCC's Broadband Data Collection feeds the National Broadband Map. Under 47 CFR 1.7004, filings are due by 1 March (data as of 31 December) and 1 September (data as of 30 June). The BDC filers page says facilities based fixed or mobile broadband providers with one or more end user connections on the as of date must file, and 47 CFR 1.7001 defines those providers.

Fixed wireless providers may submit a location list or propagation maps. Maps must assume at least a 75 percent cell edge probability of the maximum advertised speeds, at least a 50 percent cell loading factor and receiver heights of four to seven metres, and must name the planning tool, version, developer and granularity, with an affirmation that the model was calibrated against real measurements. Each filing needs a corporate officer's certification and one from a qualified engineer as the rule defines (for example, a relevant degree plus at least seven years of broadband network design experience).

The FCC's Form 477 resources page says data as of 31 December 2022 and later goes into the BDC system and that block level deployment data collection has been discontinued.

CALEA and the SSI plan

The FCC's CALEA page says the 1994 Act requires carriers to be able to comply with lawful surveillance requests, and that in 2005 the Commission extended it to facilities based broadband internet access providers and interconnected VoIP. Covered carriers must file and maintain a System Security and Integrity (SSI) plan under 47 CFR 1.20005, filed electronically since 29 June 2023. 47 CFR 1.20003 requires a senior officer or employee responsible for ensuring interception happens only with lawful authorisation, plus written procedures. Carriers may build a solution, buy one from equipment makers or use a trusted third party. Treat that capability as sensitive: restrict who configures it, log every use, keep it unreachable from subscriber networks.

CPNI and privacy

The CPNI rules in 47 CFR Part 64 Subpart U implement section 222 of the Communications Act (64.2001) and cover telecommunications carriers and interconnected VoIP. The FCC's 2024 order reclassifying broadband as a telecommunications service was set aside by the Sixth Circuit on 2 January 2025, which held that broadband providers offer an information service. So federal CPNI rules reach you if you also sell voice such as interconnected VoIP, while state privacy and breach laws apply regardless. Treat subscriber data with that level of care anyway.

Towers, structures and RF exposure

• 47 CFR 17.7 requires FAA notification for construction more than 60.96 m (200 feet) above ground, and for shorter structures near airports that exceed set slopes, such as 100 to 1 within 6.10 km of a runway longer than 0.98 km.
• Tower owners will want a structural analysis of your antennas and mounts against the tower's design standard (in the US commonly ANSI/TIA-222), plus approved shelter space and power. This is the most common launch delay.
• The FCC's exposure limits in 47 CFR 1.1310 apply to your sites. Have a power down and lockout procedure for climbers working near live sectors.

Beyond that: incorporate, insure for tower work, publish terms of service, an acceptable use policy and a privacy policy, and use billing that can suspend and restore service through RADIUS.

What does subscriber and network security look like?

A WISP is hundreds or thousands of small Linux based devices on roofs you cannot touch, joined by radio. The threats are ordinary but the blast radius is large: a weak management plane lets one compromised CPE pivot to every radio.

Isolate the management plane

Put every radio, switch and router management interface in a management VLAN or VRF that carries no subscriber traffic, then enforce it:

• Management addresses come from a range subscribers never receive and cannot route to.
• The management network terminates on a firewall that accepts only your operations network or a VPN jump host.
• Management services are off on CPE ports facing the customer.
• No radio or router management interface is reachable from the public internet.

Our home firewall post shows the same VLAN and firewall patterns at small scale.

Isolate subscribers from each other

Turn on client or layer 2 isolation on every sector so one CPE cannot send frames to another. At aggregation, use per subscriber VLANs or port isolation instead of one flat broadcast domain. Otherwise one infected home can scan its neighbours, and a customer router plugged in backwards becomes a rogue DHCP server for the whole sector. Add source address validation at the subscriber edge, as described in BCP 38 (RFC 2827), so subscribers can only send from addresses you assigned.

Credentials and access

• Remove default credentials before any device ships. CISA's Secure by Design alert on default passwords (15 December 2023) targets manufacturers, but the lesson holds for operators: static defaults are exploited at scale.
• Use unique per device passwords, and central authentication with individual staff accounts.
• Manage over SSH and HTTPS only; disable Telnet and plain HTTP; use SNMPv3 and remove default community strings.
• Restrict who can change CALEA configuration, RADIUS, AFC and SAS credentials and core routing.

Firmware updates

Radio firmware is a software supply chain: a Linux kernel, a web server, a TLS library, an SNMP agent, driver blobs and vendor code. Keep an inventory of model and firmware version per device, follow vendor advisories, test on a lab sector and a few friendly customers, then roll out in waves with a rollback plan. Never load unofficial firmware that changes power or frequency limits.

Protect AFC and SAS dependencies

6 GHz standard power radios depend on AFC and CBRS radios on a SAS. Protect the credentials or certificates used for registration, restrict which hosts talk to those services, and alert when a radio misses a check in, because losing authorisation means losing service.

CPE hardening checklist

Step by step: from first tower to first subscriber

Step 1: plan the first tower site

1. Map likely customers using address lists, parcel data and the National Broadband Map.
2. Find tall structures with a view over them: towers, water tanks, grain elevators, hilltops with power.
3. Ask owners about height, rent terms, power, access and their structural review process. Start early.
4. Check FAA notification under 47 CFR 17.7 if you build or extend anything.
5. Confirm fibre at the site, or a line of sight path to a site that has it.

Step 2: run a path profile and link budget

1. Build a terrain profile from elevation data, add tree and building heights from a survey, and check 60 percent Fresnel clearance plus earth bulge along the path (example A).
2. Run the backhaul link budget (example 2) and keep 10 to 15 dB of fade margin on unlicensed backhaul.
3. Model sector coverage at real CPE heights and run the uplink budget (example 1).
4. Test with a CPE on a mast before promising anyone service.

Step 3: build a small core

These commands change network configuration. Run them on a lab box first, keep console access, and confirm interface names with ip -br link before you apply anything. Addresses are documentation ranges (203.0.113.0/24, 2001:db8::/32).

# VLANs on the aggregation trunk: 10 = management, 100 = subscribers
ip link add link eth1 name eth1.10 type vlan id 10
ip link add link eth1 name eth1.100 type vlan id 100
ip addr add 10.10.0.1/24 dev eth1.10          # radio and switch management
ip addr add 100.64.0.1/22 dev eth1.100        # subscriber CGNAT range (RFC 6598)
ip -6 addr add 2001:db8:100::1/64 dev eth1.100
ip link set eth1.10 up && ip link set eth1.100 up

# nftables: source validation, management isolation and CGNAT
nft -f - <<'EOF'
table inet edge {
  chain forward {
    type filter hook forward priority filter; policy drop;
    ct state established,related accept
    iifname "eth1.100" ip saddr != 100.64.0.0/22 drop
    iifname "eth1.100" ip6 saddr != 2001:db8:100::/48 drop
    iifname "eth1.100" oifname "eth1.10" drop
    iifname "wg-ops" oifname "eth1.10" accept
    iifname "eth1.100" oifname "wan0" accept
  }
}
table ip cgnat {
  chain postrouting {
    type nat hook postrouting priority srcnat; policy accept;
    ip saddr 100.64.0.0/22 oifname "wan0" snat to 203.0.113.16-203.0.113.31 persistent
  }
}
EOF
nft list ruleset

Production CGN should add per subscriber port limits and port block logging (RFC 6888 REQ-4 and REQ-14). For two upstreams, a minimal BGP stanza in an open source routing suite, with strict prefix lists so you never leak routes (64500 and 64496 are documentation ASNs):

router bgp 64500
 neighbor 198.51.100.1 remote-as 64496
 address-family ipv4 unicast
  network 203.0.113.0/24
  neighbor 198.51.100.1 prefix-list OUR-PREFIXES out
  neighbor 198.51.100.1 prefix-list DEFAULT-ONLY in
 exit-address-family
!
ip prefix-list OUR-PREFIXES seq 10 permit 203.0.113.0/24
ip prefix-list DEFAULT-ONLY seq 10 permit 0.0.0.0/0

Then connect your DHCP or PPPoE gateway to a RADIUS server, define rate plans as reply attributes, and point SNMPv3 polling and syslog at a monitoring host on the management VLAN.

Step 4: onboard the first subscriber

Common mistakes

• No line of sight survey. Imagery misses tree growth and summer leaf cover. Survey at real CPE height.
• Ignoring tower leases and structural reviews. Radios arrive before the owner approves the structural analysis or power. Start this first.
• Flat networks. Every CPE and sector in one VLAN, with management reachable from subscriber addresses.
• Years old firmware. Radios installed and forgotten, with no inventory or update cadence.
• Default or shared credentials on radios and routers.
• Planning only the downlink. The uplink, with lower sector gain, fails first.
• DFS disabled or wrong country profile, which breaks 15.407.
• Wrong AFC or SAS registration data, leading to wrong channel and power decisions.
• Overselling sectors past their peak hour airtime.
• No CGNAT logging plan when a lawful request arrives.

FAQ

Do I need an FCC license to start a wireless ISP?

Not for unlicensed Part 15 bands or CBRS GAA, if you use certified equipment within its rules. You do need SAS registration for CBRS, AFC registration for 6 GHz standard power, Part 101 licences for licensed microwave, Broadband Data Collection filings and CALEA compliance as a facilities based broadband provider.

What is the range of a 5 GHz point to multipoint sector?

It depends on line of sight, antenna gains and the modulation you need. At the 36 dBm EIRP limit, a few kilometres with good margins is typical; our example shows healthy downlink but thin uplink margin at 5 km.

What is the difference between CBRS GAA and PAL?

GAA is licence by rule: eligible operators may transmit once their CBSDs register with a SAS, but get no protection from PAL holders or incumbents. A Priority Access License is a county licence in 3550 to 3650 MHz that is protected from GAA users.

Can I use 6 GHz outdoors for fixed wireless?

Yes, as a standard power access point or fixed client device in 5.925 to 6.425 GHz and 6.525 to 6.875 GHz at up to 36 dBm EIRP, after registering with an approved AFC system and checking in at least daily.

Do I need my own ASN and IP addresses?

Not at first. With two upstreams and failover you control, get an ASN and addresses from ARIN and announce them with BGP and RPKI.

Is CGNAT acceptable for WISP subscribers?

For most browsing and streaming, yes, especially with IPv6 alongside. Use 100.64.0.0/10, follow RFC 6888, and offer public IPv4 to customers who host services.

Do I still file FCC Form 477?

No. Data as of 31 December 2022 and later goes into the Broadband Data Collection system, with filings due 1 March and 1 September.

How do I stop customers reaching my radios' management interfaces?

Use a separate management VLAN or VRF, block subscriber VLANs from it at your edge, disable management on customer facing CPE ports and enable client isolation on every sector.

Where Safeguard fits

Safeguard does not plan radio links, manage spectrum, scan radio firmware or manage devices. Its fit for a WISP is indirect: the software you build and run around the network, such as provisioning and billing code, the containers that run RADIUS and monitoring, AFC or SAS integration scripts, and the open source libraries inside them. Safeguard scans repositories, container images and SBOM files for known vulnerable components, shows which projects contain a given component version, and can open fix pull requests when a fixed version exists (autonomous remediation is generally available and ships switched off).

That surrounding software pulls in open source dependencies that need patching like any other application. Radio firmware fixes must still come from the radio vendor, so the steps below apply to the code and images you build and run.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Gold Registry provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

These demos show dependency, image and remediation workflows, not radio planning or spectrum management. You can download Safeguard and follow the CLI docs to try them on your own projects.

This demo sets up the Safeguard runner on your own machine, approves it with its device code and scans from the terminal. Pointed at the container images that run your RADIUS server, monitoring stack or provisioning portal, the same scan lists the packages and versions inside each image and their known vulnerabilities.

Click through it at your own pace, or open it full screen.

This demo is a real CLI session: asked to fix the lodash CVE in a repository, it reads the finding and the advisory, asks before any command that changes something, moves lodash to 4.17.21, runs npm install and npm test with your approval, and pushes nothing. The same flow applies to a vulnerable library in your customer portal or billing integration.

Click through it at your own pace, or open it full screen.

This demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. You can then ask which of your projects ship a given package version, such as a TLS or SNMP library shared by your provisioning and monitoring services, and get the answer from your own scan data.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• eCFR: 47 CFR 15.407, U-NII devices
• eCFR: 47 CFR 15.247, 902 to 928 MHz, 2400 to 2483.5 MHz and 5725 to 5850 MHz
• eCFR: 47 CFR 15.255, 57 to 71 GHz
• FCC: FCC Opens 6 GHz Band to Wi-Fi and Other Unlicensed Uses
• FCC: 3.5 GHz Band Overview
• eCFR: 47 CFR 96.3, Definitions
• eCFR: 47 CFR 96.11, Frequencies
• eCFR: 47 CFR 96.33, Authorization
• eCFR: 47 CFR 96.41, General radio requirements
• eCFR: 47 CFR 96.45, Category B CBSDs
• eCFR: 47 CFR 101.103, Frequency coordination procedures
• ITU-R P.530, terrestrial line of sight systems
• ITU-R P.525, free space attenuation
• IEEE 802.11 Working Group
• ARIN: Autonomous System Numbers
• RFC 6598: Shared Address Space
• RFC 6888: Common Requirements for Carrier Grade NATs
• RFC 8415: DHCPv6
• RFC 7084: IPv6 Customer Edge Router Requirements
• RFC 2865: RADIUS
• RFC 2827 (BCP 38): Network Ingress Filtering
• FCC: Broadband Data Collection
• FCC: BDC filers
• eCFR: 47 CFR 1.7001
• eCFR: 47 CFR 1.7004
• FCC: Form 477 resources
• FCC: CALEA
• eCFR: 47 CFR 1.20003
• eCFR: 47 CFR 64.2001
• Sixth Circuit: Ohio Telecom Association v. FCC (2 January 2025)
• eCFR: 47 CFR 17.7, FAA notification
• eCFR: 47 CFR 1.1310, RF exposure limits
• CISA: Secure by Design Alert on eliminating default passwords

Last reviewed: 25 October 2026. FCC rules, AFC and SAS operations and BDC guidance change; check the linked rules and FCC pages before you deploy.