Web-888 Remote Access Setup
Step-by-Step Guide for R-390A Owners Joining the Remote Operation Community

Section 1 — The Web-888: What It Is and Why It Works With the R-390A

The OpenWebRX Software Foundation

The Web-888 runs OpenWebRX, an open-source, browser-based SDR server developed by András Retzler HA7ILM and continued by the community at github.com/jketterl/openwebrx. OpenWebRX provides a complete web interface for SDR reception: a real-time spectrum display (waterfall), audio demodulation in multiple modes (SSB, AM, CW, FM, digital), frequency and bandwidth adjustment, and multi-user simultaneous access. The web interface is designed to be functional on any modern browser without plugins, including mobile browsers.

For the R-390A owner, OpenWebRX provides something specifically valuable: the ability to observe the spectrum around the R-390A’s operating frequency from any internet-connected location, and to hear what the shack antenna is receiving without being physically present. This is the “SDR flexibility” that the remote operation community has been seeking as a companion to their vintage hardware.

Section 2 — Use Cases for the Remote R-390A Owner

Section 3 — Hardware Setup and Antenna Connection to the R-390A System

What You Need

• Web-888 hardware (or RX-888 Mk II + Raspberry Pi 4B/400 running OpenWebRX)
• Gigabit Ethernet cable (standard Cat-5e or Cat-6 patch cable from Web-888 to router or switch)
• Passive RF splitter (Mini-Circuits ZFRSC-42 or homebrew equivalent; see Section 3 below)
• Two short coax jumpers with appropriate connectors (SO-239/PL-259 for the R-390A, adapters as needed for Web-888)
• 5 V USB-C power supply (2 A minimum for the Web-888 alone; 3 A if using a Raspberry Pi combination)

Antenna Connection: The RF Splitter Approach

The Web-888 shares the R-390A’s antenna using a passive RF power splitter — the same approach described in the Hermes Lite 2 companion guide at vk6ada.com.au. The splitter connects between the antenna feedline and both the R-390A antenna input and the Web-888 antenna input. Both receivers see the same RF signal simultaneously; neither is aware of the other.

The splitter introduces approximately 3.5 dB of insertion loss on each port — the price of sharing the antenna passively. For the Web-888 used as a panadapter companion to the R-390A, this loss is acceptable: the Web-888’s 16-bit ADC has sufficient dynamic range that a 3.5 dB signal reduction does not materially affect its spectrum display quality on the HF bands. For the R-390A, the 3.5 dB insertion loss is most noticeable on the upper HF bands (10m, 15m) during marginal propagation; on the lower bands where atmospheric noise dominates, it is largely inaudible.

Physical Installation Checklist

• Mount the Web-888 near the shack router/switch to minimise Ethernet cable run length (under 10 m is ideal for reliable Gigabit operation)
• Connect RF splitter at the antenna feedline entry point — closest practical point to where the antenna enters the shack
• Ensure all coax connectors are tight and weatherproofed if any part of the run is outdoors
• Do not coil excess coax in tight loops; lay it flat or in gentle curves to avoid self-inductance at HF
• Connect the Ethernet cable from the Web-888 to the router or network switch; confirm the link LED on both ends is active (usually solid green for 1 GbE)
• Apply 5 V USB-C power; the Web-888 should begin booting (Linux startup takes approximately 30–60 seconds)

Section 4 — Network Configuration: Static IP and Discovery

• 1
  Find the Web-888’s current IP address After connecting the Web-888 to your router via Ethernet and applying power, the device obtains an IP address from your router’s DHCP server. To find it: log into your router’s administration page (typically 192.168.1.1 or 192.168.0.1 in a browser) and look at the DHCP client list or connected devices list. The Web-888 or its underlying Linux host (e.g., “raspberrypi” or “openwebrx”) should appear as a connected device with an assigned IP address such as 192.168.1.105. Note this address; you will use it in the next step.
• 2
  Verify the Web-888 is accessible on the local network Open a web browser on a computer connected to the same local network and navigate to http://[IP address]:8073 — for example, http://192.168.1.105:8073. Port 8073 is OpenWebRX’s default web interface port. You should see the OpenWebRX interface: a spectrum display (initially silent until a receiver profile is configured) and the waterfall panel. If the browser shows “connection refused” or times out, allow 2–3 minutes more for the Web-888 to complete its boot sequence, then retry. If still not accessible, verify the Ethernet link LED is active.

The DHCP-assigned IP address can change each time the Web-888 reboots or after a router restart. For reliable remote access, the Web-888 must always have the same IP address. Two approaches:

• 3
  Preferred: static DHCP reservation at the router Log into your router’s administration page and locate the DHCP reservation or “static lease” settings (sometimes called “IP binding” or “fixed IP”). Add a reservation that assigns a specific IP address (choose one outside the router’s normal DHCP range, for example 192.168.1.200) to the Web-888’s MAC address (visible in the router’s connected devices list). Reboot the Web-888; it should now receive the reserved IP address. Verify by checking the router’s DHCP client list again. This approach is preferred because it does not require accessing the Web-888’s Linux configuration.
• 4
  Alternative: configure a static IP in the Web-888’s Linux network settings SSH into the Web-888 (SSH must be enabled; consult the Web-888 documentation for the default SSH credentials and host address). Edit /etc/dhcpcd.conf (on Raspberry Pi OS) to add a static IP configuration block specifying the interface, IP address, router gateway, and DNS servers. This approach is more permanent but requires Linux command-line access. The DHCP reservation approach at the router is simpler for operators without Linux experience.

Section 5 — OpenWebRX Software Configuration

• 5
  Access the OpenWebRX administration panel Navigate to http://[Web-888 IP]:8073/settings in your browser. You will be prompted for administrative credentials. On a fresh OpenWebRX installation, the default administrative username is admin and the default password should be changed immediately after first login (see Section 7). Change the admin password before proceeding with any other configuration.
• 6
  Configure the SDR hardware profile In the OpenWebRX settings, navigate to the SDR Devices section. The Web-888 hardware should appear as a detected device (SoapySDR or similar driver interface). Click to configure: set the device type to match your Web-888 hardware (RX-888 Mk II uses the lime or soapy driver depending on the specific firmware). Set the sample rate (384 kHz is a practical starting point for HF panadapter use; higher rates increase bandwidth but also increase CPU load). Set the RF gain to a value appropriate for HF reception with a typical amateur antenna — start conservatively (gain around 40–50% of maximum) and increase if signals are too weak, or reduce if strong local signals are causing ADC overload (visible as mirrored spurious signals in the waterfall).
• 7
  Add frequency band profiles for the HF bands In OpenWebRX, “profiles” define frequency ranges that users can access. Create profiles for the HF bands you want to make accessible: 80m (3.5–4.0 MHz), 40m (7.0–7.3 MHz), 20m (14.0–14.35 MHz), 17m (18.0–18.2 MHz), 15m (21.0–21.45 MHz), 12m (24.89–24.99 MHz), 10m (28.0–29.7 MHz). For each profile, set the centre frequency (middle of the band), the sample bandwidth (to fit the whole band in the waterfall), and the default demodulation mode (USB for 20m and above, LSB for 40m and 80m, USB or CW for 30m). Label each profile clearly so remote users can identify the band from the profile selector in the web interface.
• 8
  Configure station information In the OpenWebRX settings, add your station information: callsign, location (Maidenhead grid locator), antenna description (“Inverted-V dipole, 80m–10m, VK6 shack, shared with Collins R-390A/URR”), and any notes for remote users. This information is displayed in the web interface and, if you choose to list the station publicly, on the sdr.hu or similar public SDR directories. A well-described station attracts serious users and generates useful reception reports from remote operators.
• 9
  Test local access with a simulated remote user On a different device (phone, tablet, or different computer) on your local network, navigate to the Web-888’s web interface. Verify that the waterfall displays correctly, that you can click on a signal in the waterfall to tune to it, that the audio demodulates correctly, and that you can switch between the band profiles you configured. Test all configured profiles and modes before proceeding to remote access configuration. Local access issues are much easier to diagnose than remote access issues.

Section 6 — Remote Access Configuration

• 10
  Configure router port forwarding for OpenWebRX Log into your router administration page and locate the Port Forwarding section (sometimes called “Virtual Servers” or “NAT rules”). Create a rule that forwards external TCP port 8073 to internal port 8073 on the Web-888’s static IP address. External port 8073 is the standard OpenWebRX port that the SDR community recognises; using the same external port avoids confusion. Save the rule; it typically takes effect immediately. Verify from the router’s status page that the rule is active.
• 11
  Set up Dynamic DNS (DDNS) for your home internet connection Most home internet connections have a dynamic public IP address that changes periodically. To access the Web-888 from outside the home network, you need a consistent hostname that always points to your current public IP. Register for a free DDNS service such as No-IP (noip.com), DuckDNS (duckdns.org), or Dynu (dynu.com). These services provide a hostname (e.g., myvk6shack.duckdns.org) that automatically updates when your public IP changes. Install the DDNS client on the Raspberry Pi running the Web-888 (all major services have Linux client packages or scripts). Verify that the DDNS hostname resolves to your current public IP before testing remote access.
• 12
  Test remote access over the internet Disable WiFi on your mobile phone (forcing the phone to use mobile data, not your home WiFi). Open a browser on the phone and navigate to http://[your DDNS hostname]:8073. You should see the OpenWebRX interface loading from the internet via your home router’s port forwarding. If it does not load: verify the port forwarding rule in the router, verify the DDNS hostname resolves to the correct IP address (use a DNS lookup tool or nslookup), and verify that your ISP does not block inbound connections on port 8073 (some ISPs block inbound traffic on residential connections; try a different port if this is the case).

Section 7 — Security: Hardening Your Remote Station

• S-1
  Change all default passwords immediately on first setup Change the OpenWebRX administrative password to a strong unique password (minimum 12 characters, including uppercase, lowercase, numbers, and symbols; use a password manager). Change the Raspberry Pi default SSH password (passwd command via SSH session). Disable the default pi user’s ability to log in without a password, or create a new user with a strong password and disable the default pi account entirely. Default credentials are the most exploited attack vector for IoT devices.
• S-2
  Enable SSH key authentication and disable password authentication Generate an SSH key pair on your local computer (ssh-keygen -t ed25519). Copy the public key to the Raspberry Pi’s ~/.ssh/authorized_keys file. Then disable SSH password authentication in /etc/ssh/sshd_config by setting PasswordAuthentication no and restarting the SSH service. This means the Web-888 can only be accessed via SSH from a computer holding the private key, completely eliminating brute-force password attacks against the SSH service.
• S-3
  Configure the Linux firewall (UFW or nftables) Enable the Uncomplicated Firewall (UFW) on the Raspberry Pi: sudo apt install ufw && sudo ufw default deny incoming && sudo ufw allow 8073/tcp && sudo ufw allow 22/tcp && sudo ufw enable. This blocks all inbound connections except OpenWebRX (port 8073) and SSH (port 22). If you use WireGuard VPN (recommended in the next step), remove the port 8073 rule from UFW and keep only the VPN port open: sudo ufw allow [WireGuard port]/udp.
• S-4
  Recommended: install WireGuard VPN for private access WireGuard is a modern, fast, simple VPN that is ideal for securing remote access to a single device. Install it: sudo apt install wireguard. Generate server and client key pairs. Configure the server (/etc/wireguard/wg0.conf) to listen on a chosen UDP port (e.g., 51820) and define an allowed peer for each remote device you want to allow. Configure the WireGuard client app (available for Windows, macOS, iOS, Android at wireguard.com) with the server’s public key and endpoint. Once the VPN tunnel is established from a remote device, that device has full access to the Web-888 on its local IP address as if it were on the home network — without any port forwarding for the OpenWebRX port in the router. This is the recommended approach for private access.
• S-5
  Keep the operating system and OpenWebRX updated Run sudo apt update && sudo apt upgrade -y regularly (monthly at minimum) to apply security patches to the underlying Raspberry Pi OS. OpenWebRX updates can be applied through its own update mechanism. Outdated software is the second most common attack vector after weak credentials. Consider automating security updates: sudo apt install unattended-upgrades and enabling automatic security update installation.
• S-6
  Configure OpenWebRX user access controls In the OpenWebRX settings, configure whether the receiver requires user login to access the spectrum display (“public receiver” vs “authenticated access only”). For a private receiver, require authentication. Create individual user accounts for each trusted remote user rather than sharing a single password. OpenWebRX supports multiple user accounts; assign each remote user their own credentials. Review the active user list periodically and remove accounts that are no longer needed.

Section 8 — Operating the Remote Station: R-390A-Specific Notes

Using the Panadapter as a Band Reconnaissance Tool

The most effective operating pattern for an R-390A owner with a Web-888 panadapter is band reconnaissance from the remote browser before any physical interaction with the R-390A. Log into the Web-888 interface, tune to a band profile of interest, and observe the waterfall for 2–5 minutes. Identify active signals, assess the general noise floor, note any propagation openings from signal clusters. Make a note of specific frequencies to investigate on the R-390A when you arrive at the shack. This workflow transforms the R-390A from a receiver you can only use when physically present into the final stage of a reconnaissance-then-engagement operating process that begins remotely.

Frequency Correlation Between Web-888 and R-390A

The Web-888’s frequency display in OpenWebRX is calibrated against the Web-888’s own reference oscillator. The R-390A’s frequency is set by its mechanical PTO dial. The two instruments may differ by up to several hundred Hz due to their separate calibration references. When using the Web-888 remotely to identify a signal and then tuning the R-390A to it locally, note any consistent offset between the Web-888’s displayed frequency and the R-390A’s dial reading for the same signal. This offset, once measured, can be applied as a mental correction or noted as a label in the OpenWebRX station description for the benefit of both yourself and any remote users.

Gain Setting Optimisation for Shared Antenna Use

With the antenna split between the R-390A and the Web-888, the Web-888 receives 3.5 dB less signal than if it had the antenna to itself. This means the Web-888’s RF gain control must be set higher than it would be for a dedicated antenna. The correct gain setting is one that produces a clean waterfall on the strongest expected signals (S9+20 or higher on the chosen band) without ADC overload. ADC overload in the Web-888 produces characteristic mirror images of strong signals on both sides of the carrier frequency and symmetrical phantom signals in the spectrum. If you see these artefacts, reduce the RF gain until they disappear. Start with gain at 40% of maximum and adjust upward until the noise floor starts to rise noticeably on a quiet band; the correct gain is just below this level.

Monitoring the R-390A’s Operating Frequency Remotely

If the R-390A is operated locally by a second person while you monitor remotely, the Web-888 panadapter shows you the signal the R-390A is listening to (in the antenna-sharing configuration). You can see the signal strength, the band conditions around the operating frequency, and any signals that the R-390A operator might want to be informed about. This is a practical split-responsibility operating arrangement: the local operator handles the precision R-390A receive, and the remote operator provides band awareness and frequency recommendations via voice or messaging.

Section 9 — Troubleshooting Common Issues

Section 10 — Complete Remote Station Architecture

  ┌──────────────────────────────────────────────────────────────────────────┐
  │   WEB-888 + R-390A REMOTE STATION — COMPLETE NETWORK ARCHITECTURE       │
  └──────────────────────────────────────────────────────────────────────────┘

  AT THE SHACK (home network: 192.168.1.x)
  ─────────────────────────────────────────────────────────────────────────
                         ANTENNA (50 Ω coax)
                                  │
                    ┌─────────────┴─────────────┐
                    │  PASSIVE RF SPLITTER       │
                    │  ZFRSC-42 or equivalent    │
                    └──────────┬────────────────┘
               ┌───────────────┴───────────────────────┐
               ▼                                        ▼
       ┌──────────────┐                      ┌──────────────────┐
       │  R-390A/URR  │                      │   WEB-888 SDR    │
       │  Local use   │                      │ 192.168.1.200    │
       │  only        │                      │ (static IP)      │
       └──────────────┘                      └────────┬─────────┘
                                                       │ Gigabit Ethernet
                                               ┌───────┴────────┐
                                               │  HOME ROUTER   │
                                               │ DHCP server    │
                                               │ Port forward   │
                                               │ 8073 → .200    │
                                               │ (if public RX) │
                                               │ WireGuard VPN  │
                                               │ port → .200    │
                                               └───────┬────────┘
                                                       │
                                               [ISP INTERNET]
                                               Public IP or DDNS hostname
                                               (e.g. myvk6shack.duckdns.org)

  ─────────────────────────────────────────────────────────────────────────
  REMOTE ACCESS OPTIONS (two approaches)
  ─────────────────────────────────────────────────────────────────────────

  OPTION A — Direct port forwarding (public/semi-public receiver)
  Remote browser navigates to: http://myvk6shack.duckdns.org:8073
                                           ↓
                              Router forwards port 8073
                                           ↓
                              Web-888 OpenWebRX interface
                              Authentication required (set up in OpenWebRX)
  Risk: interface exposed to internet; strong auth mandatory; use only
        for public receiver operation with hardened OpenWebRX config

  OPTION B — WireGuard VPN (private access; recommended)
  Remote device connects WireGuard client app:
    → Endpoint: myvk6shack.duckdns.org:51820 (WireGuard UDP port)
    → WireGuard handshake; encrypted tunnel established
                                           ↓
                              Remote device is virtually on local network
                                           ↓
  Remote browser navigates to: http://192.168.1.200:8073 (local IP)
  No port 8073 forwarding in router required
  Only port 51820 UDP open to internet
  All traffic encrypted end-to-end; no authentication required on OpenWebRX
  Risk: minimal; WireGuard is cryptographically modern (ChaCha20/Poly1305)

  ─────────────────────────────────────────────────────────────────────────
  OPENWEBRX WATERFALL IN USE — R-390A COMPANION WORKFLOW
  ─────────────────────────────────────────────────────────────────────────

  [Remote user, any browser] ──────► [Web-888 OpenWebRX web interface]
  Sees: full band waterfall            |── Select band profile (20m, 17m, etc.)
        real-time spectrum             |── Click signal → tunes audio demod
        audio demodulation             |── Note frequency of interesting signal
        signal frequency labels        └── Communicate to shack: "tune R-390A
                                             to 14.225 MHz, strong DX station"

  [Shack operator OR self, physically present]
  Tunes R-390A PTO dial to noted frequency
  R-390A mechanical filter provides:
    ● Superior selectivity to adjacent signals
    ● Clean SSB audio from Collins IF chain
    ● CW with narrow mechanical filter for contest pile-ups

  Result: remote operator provides band awareness + frequency guidance
          R-390A provides precision receive quality for the actual contact

  ─────────────────────────────────────────────────────────────────────────
  MINIMAL PARTS LIST (Approach A, no R-390A modification)
  ─────────────────────────────────────────────────────────────────────────
  Web-888 hardware (assembled, including Ethernet port)
  RF splitter: Mini-Circuits ZFRSC-42 or homebrew 50Ω two-way divider
  Ethernet cable: standard Cat-5e/6 patch cable, 0.5–5m
  Coax jumpers: 2× short RG-58 or RG-8X with appropriate connectors
  USB-C power supply: 5V / 2A minimum
  DDNS: free account at duckdns.org (or similar)
  Router config: one port forwarding rule (or WireGuard for private use)
  No tools required at the R-390A; no chassis work; no soldering

Complete Web-888 + R-390A remote station architecture. Option B (WireGuard VPN) is the recommended configuration for private access. Option A (direct port forwarding) is appropriate for semi-public or public receiver operation with OpenWebRX authentication enabled. Both options assume a static DHCP reservation for the Web-888 at the router.