Build a Flipper Zero Sub-GHz Relay Node: External CC1101 Module, Antenna, and Retransmit Logic

The Flipper Zero's built-in sub-GHz radio is capable but power-limited — it's a legally compliant, low-output transceiver, not a high-power transmitter, so anything you're testing at real-world distance (a garage door signal from across a large property, a sensor node at the far end of a shop) can fall outside its comfortable range. Rather than replacing the Flipper's radio, this project builds a standalone relay node: a separate, higher-output sub-GHz module paired with its own microcontroller that listens for a signal, validates it, and retransmits it at greater range or through an obstruction the Flipper alone can't reach — with the Flipper still doing the capture, analysis, and control side of the work over the air or via GPIO.

This is squarely a testing and analysis tool for your own devices and property — extending range on your own garage door test rig, your own sub-GHz sensor lab, or your own gate system to characterize real-world coverage. Treat it the same way this site's guide on Flipper Zero and the law treats every sub-GHz capability: for devices and signals you own or have explicit authorization to test.

How the Relay Works

The node is built around a standalone CC1101-based sub-GHz transceiver module (the same radio chipset family the Flipper itself uses internally) driven by its own microcontroller rather than piggybacking off the Flipper's GPIO in real time. The Flipper captures and analyzes a signal as it always does using its Sub-GHz app, and you export the captured signal file via the SD card or over the Flipper's CLI. The relay node then loads that captured signal — either as a one-time playback trigger or as a continuously-listening repeat node — and retransmits it using its own higher-gain antenna and, where module choice allows, higher legal output power than the Flipper's internal radio.

Parts List

• CC1101 Sub-GHz Transceiver Module (315/433/868/915MHz variant matching your region)
• ESP32 Dev Board (relay node controller)
• 433MHz/915MHz High-Gain SMA Antenna
• MicroSD Card Module (SPI, for signal storage)
• 18650 Battery Holder with Leads
• TP4056 Lithium Charging Module
• IP65 Weatherproof Project Enclosure
• SMA Bulkhead Panel-Mount Connector
• 0.96" I2C OLED Display (status readout)
• Perfboard for Final Assembly

Building the Node

1. Wire the CC1101 module to the ESP32 over SPI (SCK, MISO, MOSI, CS, plus GDO0/GDO2 interrupt lines) — this is the same wiring pattern covered in this site's CAN bus and RS-485 guides for SPI-based radio and communication modules, just applied to a sub-GHz radio instead.
2. Flash the ESP32 with firmware that configures the CC1101 for your target frequency and modulation (OOK or FSK, matching whatever protocol you captured on the Flipper), and implements a simple state machine: listen, capture a valid signal into a buffer, validate it against an expected pattern, then retransmit.
3. Add the SD card module so the node can store captured signal profiles independently, letting you preload known-good signals from the Flipper rather than requiring the node to always capture live.
4. Wire the OLED display to show current mode (listening/relaying), last signal RSSI, and battery voltage — genuinely useful for a field node you're not tethered to a laptop while testing.
5. Mount the CC1101 and its antenna connector in the weatherproof enclosure with the SMA bulkhead passing through the wall cleanly, and route the antenna outside the enclosure — a high-gain antenna sealed entirely inside a metal or heavily shielded box loses most of its range benefit.
6. Power from the 18650 cell through the TP4056 charging module for a rechargeable field-deployable node, or run it on a USB power bank for bench testing.

Pairing With the Flipper

Use the Flipper's own Sub-GHz app to do the actual signal analysis — frequency identification, protocol decode, and rolling-code vs. fixed-code determination, all covered in this site's Sub-GHz reading and replaying guide. The relay node isn't a replacement for that analysis workflow; it's purely a range extension layer that takes an already-understood, already-captured signal and repeats it from a better-positioned antenna. Keep the analysis step on the Flipper, where the tooling for it is mature, and use the standalone node only for the retransmission your captured signal needs to reach farther.

Legal Power and Frequency Limits

Whatever region you're in, sub-GHz ISM band devices have legally defined maximum transmit power and duty-cycle limits, and those limits apply to your DIY relay node exactly as they apply to any other transmitter — building your own hardware doesn't grant an exemption. Check your region's ISM band regulations (FCC Part 15 in the US, ETSI regulations in the EU, and their equivalents elsewhere) before selecting a CC1101 module and antenna combination, and don't assume "higher gain antenna" is automatically legal just because the module itself is available for purchase — antenna gain factors directly into effective radiated power limits in most jurisdictions.

Safety and Responsible Use

Test this only against devices and systems you own or have explicit written authorization to test — a garage door, gate, or sensor system that isn't yours is out of scope regardless of how the relay node is built or used. Label the enclosure clearly if it's left deployed anywhere it might be found by someone unfamiliar with the project, and don't leave a continuously-listening relay node unattended near systems where an accidental retransmission (a captured signal firing at an unexpected moment) could cause a real-world effect, like a gate or door actuating when no one intended it to.

Built and used within those bounds, a dedicated relay node is a genuinely useful addition to sub-GHz testing work — it turns the Flipper into the analysis and capture tool it's best at, while the standalone node handles the antenna and power budget a pocket-sized device was never going to match on its own.