Skip to content

Hardware

Physical setup for Waveshift's optional hardware kit. Cloud-only deployments don't need any of this — skip straight to the Console tour if you're not running hardware.

What's in the kit

A standard Waveshift hardware kit ships with:

  • 1× Control Hub — GL.iNet Brume 2, flashed with Waveshift firmware. One Hub per Site.
  • 5× Nodes — GL.iNet Slate AX, flashed with Waveshift firmware. Plug a Node into the Hub's LAN, hand it to a user, and every device on its Wi-Fi tunnels through your chosen Egress Server.
  • 1× Network switch (8+ ports, unmanaged).
  • 20× Cat 6 Ethernet cables.
  • Power adapters for every device.

The kit is paired with a Bearer router (typically a GL.iNet Beryl) that provides upstream internet to the Hub. Any router capable of handing out DHCP on its LAN side works as a Bearer.

How it fits together

Internet
   │
   ▼
[ Bearer router ]  ──> upstream
   │
   ▼
[ Control Hub ]  ──> orchestrator (via Infrastructure Access Server)
   │
   ▼
[ Network switch ]
   │
   ├── [ Node ]  ──> Wi-Fi → user devices
   ├── [ Node ]  ──> Wi-Fi → user devices
   └── [ Node ]  ──> Wi-Fi → user devices

Each Hub belongs to exactly one Site, and each Node attaches to one Hub. The Hub does two jobs: it carries management traffic (the orchestrator pushes Node configs through it always), and it carries user traffic in tunnel-in-tunnel form while a Node is physically attached (see the Control Hub glossary entry for the ISP-fingerprint reasoning). Once a Node is detached and taken elsewhere, it dials its Egress Server directly over whatever bearer it's plugged into.

Each Hub gets its own Site

Hubs are added to a Waveshift deployment via wsctl, after the deploy, in two steps. First, Node Sites → Add (or wsctl node-site create) registers a new Site with the orchestrator and provisions the Site's Infrastructure Access Server in the public subnet. Then Configure Hub (or wsctl hub configure <site>) pushes the WireGuard keys + a Waveshift API key to the connected Hub and binds it to that Site. Any Nodes connected to the Hub join the same Site by attachment — you don't pick a Site for them. Sites created this way exist alongside any software-only Sites an admin sets up manually for region scoping in Sites administration.

In this section

  • Hardware setup — start-to-finish physical cabling, power-on, and Hub configuration.

Prerequisites

Before unboxing the kit, you should already have:

  • A deployed Waveshift orchestrator (see Deploy walkthrough).
  • A Site created in the orchestrator (created via the wsctl TUI's node-site flow; the Site's WireGuard config is what the Hub will dial in with).
  • Physical access to the installation location.

See also

  • Defaults — the credentials and IPs the Hub ships with.
  • Glossary — what each term in the kit description means.
  • Common issues — symptoms you might hit during physical setup.