TedLee.ca
🌐 44Net · AMPRNet VPN

Network 44 for Amateur Radio — What It Is, How to Connect, What It's Not For

A plain-English guide to 44.0.0.0/9, the amateur radio IP block, and how hams reach it over a VPN.

📄 On This Page

Prepared by Ted Lee, VE7LEE / VE7LE — Webmaster & CCNA (Network Associate). This page summarizes publicly available information from the American Radio Relay Digital Communications (ARDC) organisation and the 44Net Wiki for fellow hams. It is not legal advice — see the disclaimer near the bottom of the page.

📡What Is 44Net (AMPRNet)?

44Net — also called AMPRNet (AMateur Packet Radio NETwork) — is the nickname for a block of public IPv4 addresses, 44.0.0.0/9 and 44.128.0.0/10, that has been set aside for licensed amateur radio operators since the mid-1980s. Every device connected to it gets a real, globally-routable address that starts with 44.

The network is owned and administered by Amateur Radio Digital Communications (ARDC), a non-profit foundation. Its purpose is to let hams experiment with digital networking and internetworking techniques, and to run services for other amateurs — packet BBSs, Winlink gateways, APRS-IS feeds, D-STAR/DMR reflectors, and general TCP/IP experimentation over radio and internet links.

The Global IPv4 Internet Billions of addresses, thousands of networks 44.0.0.0/9 44.128.0.0/10 Amateur Radio — 44Net / AMPRNet Managed by ARDC · non-commercial · licensed hams only

44Net is a reserved slice of ordinary internet address space, set aside for amateur radio digital experimentation.

📋 Quick Reference

Address blocks44.0.0.0/9 and 44.128.0.0/10
Administered byAmateur Radio Digital Communications (ARDC)
EstablishedMid-1980s
Who can use itLicensed amateur radio operators, non-commercially
CostNo cost for 44Net facilities themselves; you pay only for your own internet access / hardware
IPv6No IPv6 equivalent currently exists
Official portalportal.ampr.org — request or manage an address allocation

🔐What the VPN Actually Does

44Net is made of small, scattered pockets of amateur equipment that usually aren't directly connected to one another. A VPN (Virtual Private Network) is one of four common ways hams bridge that gap — the others being BGP routing, direct radio links, and plain IP tunnelling. A VPN lets your home computer or router behave, over the ordinary internet, as if it were plugged straight into the 44Net network — authenticated and encrypted for the trip between your gateway and the VPN server.

The easiest on-ramp today is 44Net Connect, ARDC's official, self-service WireGuard-based VPN system. You sign up, it issues you a 44-address, and you import a small configuration file into a WireGuard client.

Home Shack → VPN Tunnel → 44Net Mesh 🏠 Your Shack / Home LAN WireGuard (encrypted) 🌐 Ordinary Internet (your ISP) 🛰️ 44Net Connect VPN Server → AMPRNet mesh: Winlink · APRS-IS · packet BBS · other 44-addressed ham hosts

Only your 44Net-bound traffic should ride the tunnel — your general web browsing keeps using your normal internet connection.

🛠️How to Get Connected

The exact steps vary by connection method, but for the common case — a home ham wanting VPN access via 44Net Connect — the path looks like this:

  1. Hold a valid amateur radio licence. 44Net is for licensed amateurs only; you'll register using your callsign.
  2. Create a 44Net Connect account at the official self-service portal, connect.44net.cloud. It's WireGuard-based and issues you a 44-address automatically.
  3. Or request a block manually via the ARDC Portal (portal.ampr.org) if you need your own subnet rather than a single connect address — register with your callsign, choose your country/region, and submit a short request to your area coordinator.
  4. Install a WireGuard client on your router, computer, or a small gateway device, and import the configuration you're issued.
  5. Route only 44Net traffic through the tunnel (a "split tunnel") — do not send your default/all-traffic route through it. The VPN is for reaching 44Net, not for general internet access.
  6. Secure the host at the end of your tunnel — firewall, current software, strong credentials — before you plug it into an internet-facing amateur network.
  7. Put it to work: reach Winlink gateways, APRS-IS, packet BBSs, D-STAR/DMR reflectors, or host your own experimental service under your 44-address, with an ampr.org DNS name if you want one.

⚖️What It Can — and Cannot — Be Used For

44Net rides on top of ordinary internet infrastructure, but the address space itself is licensed for amateur radio purposes only. That comes with real restrictions.

✅ Appropriate Uses

  • Amateur radio digital experimentation and networking research
  • Non-commercial services for other licensed hams (Winlink, packet BBS, APRS-IS, reflectors, etc.)
  • Linking radio-based networks into a wider TCP/IP mesh
  • Hosting your own experimental, non-commercial ham-related host or site under your 44-address
  • Learning networking, routing, and tunnelling techniques hands-on

🚫 Not Permitted

  • General-purpose personal internet access, browsing, or streaming
  • Commercial or business use, or any activity for pecuniary gain
  • Advertising your 44Net allocation via BGP without ARDC's written permission
  • Content that obscures its meaning where the traffic will transit onto amateur RF — check your national licence conditions on encryption
  • Illegal content, abuse, spam, or denial-of-service activity
  • Use by anyone without a valid, current amateur radio licence
⚠️ A note on rules and regulations

Amateur radio licence conditions differ by country (in Canada: ISED / RIC-3; in the US: FCC Part 97; and so on). This page is a general orientation, not a compliance checklist. If you plan to bridge 44Net traffic onto RF, host services for others, or you're unsure whether a use is compliant, check your national regulator's rules and ARDC's Acceptable Use Policy before proceeding — and when in doubt on anything with legal weight, consult qualified counsel or your national society (e.g. RAC, ARRL).

🔒Security & Housekeeping

🧱 Firewall your node

Any 44Net-connected host is internet-reachable. Treat it like any internet-facing server: firewall it, patch it, and don't expose services you don't intend to run.

🔑 Use strong credentials

WireGuard's keys and any admin logins on your gateway should be strong and kept private, just as you would for any other network gear.

🚦 Split-tunnel only

Route only 44Net-destined traffic (44.0.0.0/9, 44.128.0.0/10) through the VPN. Never set it as your default route.

🏠 Home routers & NAT

Most home routers handle outbound VPN traffic fine, but inbound tunnelled traffic often needs a DMZ host rather than simple port-forwarding — which increases your exposure, so pair it with a firewall.

🔗Resources & Links