Radio Links
Connect a field unit and a base station over a radio data link with no IP network beneath it, and check that the radio is fast enough.
- Needs
- A radio at each end that the machine opens as a serial device, on Linux, macOS or BSD
- Uses
- conflux up --uplink
Before and After VeilNet
Use this setup when two machines can reach each other only over a radio data link, with no IP network beneath it.
Today, field radios carry data with no IP network beneath them, so TLS and IPsec have nothing to run on.
VeilNet needs no IP network. With an uplink, conflux runs the overlay directly over the radio link. The field unit and the base station join one realm, and they use the same post-quantum identities and encryption as machines on the internet.
Today these radio links carry data with no IP network beneath them, so TLS and IPsec have nothing to run on. With VeilNet, ML-DSA-87, ML-KEM-1024 and AES-256-GCM protect every link.
One link joins two machines. The field unit and the base station reach only each other, and nothing on an IP network reaches them through the radio.
Choosing a Radio
Conflux opens a radio as a device, such as /dev/ttyUSB0, at the line speed you choose. The radio must carry a realm handshake of 20 to 30 KB well within the 60-second idle timeout. Before you rely on a radio, check its sustained data rate against this table:
| Line speed | Handshake | |
|---|---|---|
| 115200 baud | About 2 s | Comfortable |
| 57600 baud | About 4 s | Fine |
| 19200 baud | About 12 s | Usable |
| 9600 baud | About 25 s | Marginal against a 60-second idle timeout |
| LoRa and other duty-cycled radios | Hours | No |
The handshake carries post-quantum certificates in both directions, so the identity model sets this minimum speed, not the link. Duty-cycled radios fall below it altogether.
A radio link works as follows:
- One link, one peer. A radio link joins exactly two machines.
- One link per machine. A machine uses either one uplink or its IP network. A base station that talks to three field units needs three machines. Each pair forms its own realm, separate from the other pairs and from any realm on an IP network.
- Unix hosts. Uplinks work on Linux, macOS and the BSDs.
Setting Up the Link
Follow Installation on the base station's machine and the field unit's machine. Each machine needs its radio attached, and a network connection for the next two steps.
On a sovereign network, the guardian commissions each machine and issues its manifest. Install it with sudo conflux enrol --manifest FILE, then run conflux up without --taint, because the credential carries the taints. See Joining a sovereign network.
Verifying the Setup
At either end, run sudo conflux status. You should see the link above the mode:
uplink /dev/ttyUSB0:19200 — no host network under it mode tun — interface anchor0
At 19200 baud, the handshake takes about 12 seconds to cross the radio. Then ping the field unit from the base station at its overlay address:
$ ping -c 3 10.128.0.2
Run sudo conflux peers. You should see the field unit with DATA yes.
Conflux counts frames that the line corrupts in anchor_uplink_frames_lost_total, which sudo conflux metrics includes. A rising count points to a problem on the radio link, not on the overlay.
Conflux rebuilds the link when the device disappears, or when the link has carried no connection for 90 seconds. The uplink status row counts each rebuild as N reopens, last …. A field unit that is switched off looks like a dead link, so conflux rebuilds the link then too. This is harmless, and the link comes back when the unit is switched on.
To troubleshoot a link, see Uplink Problems.