44Net Wiki - User contributions [en]

AllStarLink

2026-10-08T22:37:38Z

KN6DWI: Describe how to connect using DroidStar

AllStarLink is an open source<ref>The ASL3 source is [https://github.com/AllStarLink/ASL3 available on GitHub], though installing from source is not recommended.</ref> internet repeater linking system that uses the Asterisk PBX software internally, and provides a web interface for management. It can be used both for connecting repeaters to the internet and for creating reflectors that internet-linked repeaters can connect to. An AllStarLink installation consists of multiple pieces of software: The Asterisk PBX, the app_rpt application made by AllStarLink, and the Allmon3 web interface.

== Step 1: Sign up for AllStarLink ==
Follow AllStarLink's [https://allstarlink.github.io/basics/portal/ instructions for the sign up process]. They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.

During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.

Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is <code>4569</code>.

== Step 2: Install AllStarLink ==
AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes the same, and additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation, which lets you preload Wi-Fi configuration. It also supports managing the Pi's serial port at <code>/dev/serial0</code>, as well as using the GPIO pins for PTT triggering. The Pi image keeps logs and temp files only in memory to reduce writes to the SD card.

=== Raspberry Pi Appliance ===
To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.] This guide is primarily for flashing a fresh image on your Pi. If you want to add an ASL3 appliance to an existing Pi, follow the steps for the Debian appliance.

=== Debian PC or Appliance ===
To install ASL3 on Debian, via any of <code>asl3-appliance</code>, <code>asl3-appliance-pc</code>, or a non-appliance Debian install (<code>asl3</code>), follow [https://allstarlink.github.io/install/debian/install/ the ASL3 Debian install guide.] It covers all three methods, and notes each point where the installation methods diverge.

== Step 3: Configure firewall ==
=== firewalld ===
{{Info|Warn|When using a 44Net Connect tunnel with AllStarLink and <code>firewalld</code>, don't put the 44Net WireGuard interface in the <code>allstarlink</code> zone provided by the appliance. This will make your web management interface publicly available on the internet. Instead, create a 44Net zone, and add the requisite services to that zone.}}

For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has [https://allstarlink.github.io/adv-topics/44net-connect/ a page about 44Net Connect] with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom <code>firewalld</code> service definitions. Your 44Net Connect zone must have the <code>iax2</code> service added for AllStar to function. If you're accepting EchoLink connections, the <code>echolink</code> service must also be added. That can be done with the following commands:

'''IAX2:'''<code>sudo firewall-cmd --zone <your zone here> --add-service iax2 --permanent</code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-service echolink --permanent</code>

Users of the non-appliance version should open <code>UDP 4560-4580</code> for IAX2, and <code>5198-5199</code> for EchoLink.

'''IAX2:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 4560-4580/udp --permanent </code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 5189-5199/udp --permanent</code>

Once you've added your services or ports, don't forget to reload your firewall:

<code>sudo firewall-cmd --reload</code>

=== ufw ===
{{Info|Note|<code>firewalld</code> is the recommended firewall software for devices with 44Net Connect software, because its abstraction of zones makes secure configuration easier to set up and understand. <code>ufw</code> is not recommended, but it can still be used. It will be more involved due to lacking zones. }}

<code>ufw</code> rules allowing IAX2 and EchoLink can be entered as follows:

'''IAX2:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 4560-4580 proto udp</code>

'''Echolink:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 5189-5199 proto udp</code>

These rules can be entered before the 44Net Connect WireGuard interface is actually created, but they won't work until a WireGuard interface is created with exactly the same name. The WireGuard interface will be named after the config file used to create it, so <code>wg0.conf</code> would create the interface <code>wg0</code>.

== Step 4: Enable 44Net Connect tunnel ==
Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel Single Device Tunnel tutorials list], and follow the quick start tutorial for your distribution.

=== Optional: Split Tunnel ===
There are special considerations for operating a 44Net Connect split tunnel on a device with AllStarLink. Nodes register with the central coordination server and report statistics by contacting <code>register.allstarlink.org</code> and <code>stats.allstarlink.org</code>. For the node to be registered with your static 44Net IP, these communications must go out through your VPN tunnel, which by by default they will not. These domains don't have static IPs, so you'll need to deploy a watchdog service to create and update routing rules based on the DNS. The following <code>systemd</code> unit will do this. Place it in <code>/etc/systemd/system/</code>.

<nowiki>
[Unit]
Description=Maintains rules that route traffic to AllStarLink domains through the 44Net split tunnel
Requires=network-online.target
After=network.target network-online.target
Before=asterisk.service allmon3.service

# Change this to the name of your split tunnel service
Requires=wg-quick@wg0-st.service

[Service]
Type=exec

# Make sure you copy the script to this path exactly, or change the path here
ExecStart=/opt/allstarlink/st-routing-watchdog.sh

[Install]
WantedBy=multi-user.target</nowiki>

This <code>systemd</code> unit depends on the following script being placed in <code>/opt/allstarlink/st-routing-watchdog.sh</code> The <code>/opt/allstarlink</code> directory is not automatically created. Make it with <code>sudo mkdir /opt/allstarlink</code> before placing the file there.

<nowiki>
#!/usr/bin/bash

# Change this if you use a different routing table for your WireGuard interface
WG_TABLE=51820

# Initialize variables
REGISTER_IPS=""
STATS_IP=""

del_rules () {
ip rule del to $1 lookup $WG_TABLE

while IFS= read -r line || [[ -n $line ]]; do
ip rule del to $line lookup $WG_TABLE
done < <(printf '%s' "$1")
}

cleanup () {
echo 'Received $1, cleaning up rules and exiting.'
del_rules "$2" "$3"
}
while
# Note that there are multiple IPs for register.allstarlink.org
REGISTER_IPS_NEW=$(dig +short register.allstarlink.org)
STATS_IP_NEW=$(dig +short stats.allstarlink.org)

echo "$REGISTER_IPS_NEW"

# Ensure records are not null
if [[ $REGISTER_IPS_NEW == "" ]]; then
echo "DNS resolution error for register.allstarlink.org"
exit 2
fi;

if [[ $STATS_IP_NEW == "" ]]; then
echo "DNS resolution error for stats.allstarlink.org"
exit 2
fi;

# Fetch TTLs for DNS A records
REGISTER_TTL=$(dig register.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
STATS_TTL=$(dig stats.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
echo "register.allstarlink.org resolves to $REGISTER_IP_NEW"
echo "stats.allstarlink.org resolves to $STATS_IP_NEW"
echo
echo "TTL of register.allstarlink.org: $REGISTER_TTL"
echo "TTL of stats.allstarlink.org: $STATS_TTL"

# Use smaller of the two TTLs
if (( REGISTER_TTL > STATS_TTL )); then
FINAL_TTL=$STATS_TTL
else
FINAL_TTL=$REGISTER_TTL
fi;

# If new IPs don't match old IPs, replace rules.
if [[ $REGISTER_IPS == $REGISTER_IPS_NEW && $STATS_IP == $STATS_IP_NEW ]]; then
echo "IPs have not changed. Rules will not be updated."
else
echo "IPs have changed. Updating rules."

# Create routing rules
# Putting this before deletion of old rules to prevent race condition routing leakage.
# This while loop to read each line from REGISTER_IPS_NEW is from
# https://superuser.com/questions/284187/how-to-iterate-over-lines-in-a-variable-in-bash
while IFS= read -r line || [[ -n $line ]]; do
ip rule add to $line lookup $WG_TABLE
done < <(printf '%s' "$REGISTER_IPS_NEW")

ip rule add to $STATS_IP_NEW lookup $WG_TABLE

# Don't try to delete old rules on first iteration bc they don't exist yet
if [[ $REGISTER_IP != "" ]]; then
del_rules $STATS_IP $REGISTER_IPS
fi;

REGISTER_IPS=$REGISTER_IPS_NEW
STATS_IP=$STATS_IP_NEW
fi;

# Delete routes when program is stopped
# TODO: Invoke cleanup function here to clean up all register rules
trap 'echo "Received SIGINT, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGINT

trap 'echo "Received SIGTERM, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGTERM

# Sleep for duration of TTL
echo "Sleeping for $FINAL_TTL seconds"
echo
sleep $FINAL_TTL

do true; done</nowiki>

After installing these files, make the script executable by running <code>sudo chmod +x /opt/allstarlink/st-routing-watchdog.sh</code>, then enable the <code>systemd</code> unit with <code>sudo systemctl enable asl-st-routing-service --now</code>.

== Step 5: Verify functionality ==
=== asl-node-auth-check ===
AllStarLink comes with the <code>asl-node-auth-check</code> utility that automatically evaluates your connection and registration status. It must be run as superuser. SSH into your ASL3 node and run <code>sudo asl-node-auth-check</code>. If there are no errors, your node is correctly registered. Warnings should be addressed if possible.

Split tunnel users may see a warning that their node is not perceived as registered, but this is acceptable as long as the node functionality is not impaired. Node functionality will be assessed in the next section by connecting with a VoIP app. If the split tunnel or firewall are incorrectly configured, there may be HTTP connection errors.

=== VoIP: Droidstar===
Connectivity can be verified by connecting to your AllStarLink node with a VoIP app. People with android phones can use Droidstar with the following steps:

# Install DroidStar from the Google Play store
# Obtain your node's password from [https://www.allstarlink.org/portal/nodes.php the AllStarLink portal]
# Go to DroidStar settings, and configure your callsign and ASL password.
# Go to the Hosts tab and add a line that says <code>IAX <node number> wt</code>.
# Go to the Main tab, select IAX using the drop-down menu at the top, and select your node number using the drop-down menu under the mode menu. Press connect, and it should connect in a few seconds.

If connection is successful, the button will change to "Connected" and through your client you'll hear the node announce your connection.
If DroidStar remains "Connecting" for more than 30 seconds, you probably have a configuration issue.

== Troubleshooting ==
AllStarLink has a [https://allstarlink.github.io/user-guide/troubleshooting/ troubleshooting guide]. This section includes additional troubleshooting tools, and does not reiterate any of the officially recommended methods.

[[Category:Use Cases]]
[[Category:How-To]]

AllStarLink

2026-10-08T18:25:28Z

KN6DWI: Described usagee of asl-node-auth-check

AllStarLink is an open source<ref>The ASL3 source is [https://github.com/AllStarLink/ASL3 available on GitHub], though installing from source is not recommended.</ref> internet repeater linking system that uses the Asterisk PBX software internally, and provides a web interface for management. It can be used both for connecting repeaters to the internet and for creating reflectors that internet-linked repeaters can connect to. An AllStarLink installation consists of multiple pieces of software: The Asterisk PBX, the app_rpt application made by AllStarLink, and the Allmon3 web interface.

== Step 1: Sign up for AllStarLink ==
Follow AllStarLink's [https://allstarlink.github.io/basics/portal/ instructions for the sign up process]. They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.

During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.

Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is <code>4569</code>.

== Step 2: Install AllStarLink ==
AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes the same, and additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation, which lets you preload Wi-Fi configuration. It also supports managing the Pi's serial port at <code>/dev/serial0</code>, as well as using the GPIO pins for PTT triggering. The Pi image keeps logs and temp files only in memory to reduce writes to the SD card.

=== Raspberry Pi Appliance ===
To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.] This guide is primarily for flashing a fresh image on your Pi. If you want to add an ASL3 appliance to an existing Pi, follow the steps for the Debian appliance.

=== Debian PC or Appliance ===
To install ASL3 on Debian, via any of <code>asl3-appliance</code>, <code>asl3-appliance-pc</code>, or a non-appliance Debian install (<code>asl3</code>), follow [https://allstarlink.github.io/install/debian/install/ the ASL3 Debian install guide.] It covers all three methods, and notes each point where the installation methods diverge.

== Step 3: Configure firewall ==
=== firewalld ===
{{Info|Warn|When using a 44Net Connect tunnel with AllStarLink and <code>firewalld</code>, don't put the 44Net WireGuard interface in the <code>allstarlink</code> zone provided by the appliance. This will make your web management interface publicly available on the internet. Instead, create a 44Net zone, and add the requisite services to that zone.}}

For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has [https://allstarlink.github.io/adv-topics/44net-connect/ a page about 44Net Connect] with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom <code>firewalld</code> service definitions. Your 44Net Connect zone must have the <code>iax2</code> service added for AllStar to function. If you're accepting EchoLink connections, the <code>echolink</code> service must also be added. That can be done with the following commands:

'''IAX2:'''<code>sudo firewall-cmd --zone <your zone here> --add-service iax2 --permanent</code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-service echolink --permanent</code>

Users of the non-appliance version should open <code>UDP 4560-4580</code> for IAX2, and <code>5198-5199</code> for EchoLink.

'''IAX2:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 4560-4580/udp --permanent </code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 5189-5199/udp --permanent</code>

Once you've added your services or ports, don't forget to reload your firewall:

<code>sudo firewall-cmd --reload</code>

=== ufw ===
{{Info|Note|<code>firewalld</code> is the recommended firewall software for devices with 44Net Connect software, because its abstraction of zones makes secure configuration easier to set up and understand. <code>ufw</code> is not recommended, but it can still be used. It will be more involved due to lacking zones. }}

<code>ufw</code> rules allowing IAX2 and EchoLink can be entered as follows:

'''IAX2:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 4560-4580 proto udp</code>

'''Echolink:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 5189-5199 proto udp</code>

These rules can be entered before the 44Net Connect WireGuard interface is actually created, but they won't work until a WireGuard interface is created with exactly the same name. The WireGuard interface will be named after the config file used to create it, so <code>wg0.conf</code> would create the interface <code>wg0</code>.

== Step 4: Enable 44Net Connect tunnel ==
Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel Single Device Tunnel tutorials list], and follow the quick start tutorial for your distribution.

=== Optional: Split Tunnel ===
There are special considerations for operating a 44Net Connect split tunnel on a device with AllStarLink. Nodes register with the central coordination server and report statistics by contacting <code>register.allstarlink.org</code> and <code>stats.allstarlink.org</code>. For the node to be registered with your static 44Net IP, these communications must go out through your VPN tunnel, which by by default they will not. These domains don't have static IPs, so you'll need to deploy a watchdog service to create and update routing rules based on the DNS. The following <code>systemd</code> unit will do this. Place it in <code>/etc/systemd/system/</code>.

<nowiki>
[Unit]
Description=Maintains rules that route traffic to AllStarLink domains through the 44Net split tunnel
Requires=network-online.target
After=network.target network-online.target
Before=asterisk.service allmon3.service

# Change this to the name of your split tunnel service
Requires=wg-quick@wg0-st.service

[Service]
Type=exec

# Make sure you copy the script to this path exactly, or change the path here
ExecStart=/opt/allstarlink/st-routing-watchdog.sh

[Install]
WantedBy=multi-user.target</nowiki>

This <code>systemd</code> unit depends on the following script being placed in <code>/opt/allstarlink/st-routing-watchdog.sh</code> The <code>/opt/allstarlink</code> directory is not automatically created. Make it with <code>sudo mkdir /opt/allstarlink</code> before placing the file there.

<nowiki>
#!/usr/bin/bash

# Change this if you use a different routing table for your WireGuard interface
WG_TABLE=51820

# Initialize variables
REGISTER_IPS=""
STATS_IP=""

del_rules () {
ip rule del to $1 lookup $WG_TABLE

while IFS= read -r line || [[ -n $line ]]; do
ip rule del to $line lookup $WG_TABLE
done < <(printf '%s' "$1")
}

cleanup () {
echo 'Received $1, cleaning up rules and exiting.'
del_rules "$2" "$3"
}
while
# Note that there are multiple IPs for register.allstarlink.org
REGISTER_IPS_NEW=$(dig +short register.allstarlink.org)
STATS_IP_NEW=$(dig +short stats.allstarlink.org)

echo "$REGISTER_IPS_NEW"

# Ensure records are not null
if [[ $REGISTER_IPS_NEW == "" ]]; then
echo "DNS resolution error for register.allstarlink.org"
exit 2
fi;

if [[ $STATS_IP_NEW == "" ]]; then
echo "DNS resolution error for stats.allstarlink.org"
exit 2
fi;

# Fetch TTLs for DNS A records
REGISTER_TTL=$(dig register.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
STATS_TTL=$(dig stats.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
echo "register.allstarlink.org resolves to $REGISTER_IP_NEW"
echo "stats.allstarlink.org resolves to $STATS_IP_NEW"
echo
echo "TTL of register.allstarlink.org: $REGISTER_TTL"
echo "TTL of stats.allstarlink.org: $STATS_TTL"

# Use smaller of the two TTLs
if (( REGISTER_TTL > STATS_TTL )); then
FINAL_TTL=$STATS_TTL
else
FINAL_TTL=$REGISTER_TTL
fi;

# If new IPs don't match old IPs, replace rules.
if [[ $REGISTER_IPS == $REGISTER_IPS_NEW && $STATS_IP == $STATS_IP_NEW ]]; then
echo "IPs have not changed. Rules will not be updated."
else
echo "IPs have changed. Updating rules."

# Create routing rules
# Putting this before deletion of old rules to prevent race condition routing leakage.
# This while loop to read each line from REGISTER_IPS_NEW is from
# https://superuser.com/questions/284187/how-to-iterate-over-lines-in-a-variable-in-bash
while IFS= read -r line || [[ -n $line ]]; do
ip rule add to $line lookup $WG_TABLE
done < <(printf '%s' "$REGISTER_IPS_NEW")

ip rule add to $STATS_IP_NEW lookup $WG_TABLE

# Don't try to delete old rules on first iteration bc they don't exist yet
if [[ $REGISTER_IP != "" ]]; then
del_rules $STATS_IP $REGISTER_IPS
fi;

REGISTER_IPS=$REGISTER_IPS_NEW
STATS_IP=$STATS_IP_NEW
fi;

# Delete routes when program is stopped
# TODO: Invoke cleanup function here to clean up all register rules
trap 'echo "Received SIGINT, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGINT

trap 'echo "Received SIGTERM, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGTERM

# Sleep for duration of TTL
echo "Sleeping for $FINAL_TTL seconds"
echo
sleep $FINAL_TTL

do true; done</nowiki>

After installing these files, make the script executable by running <code>sudo chmod +x /opt/allstarlink/st-routing-watchdog.sh</code>, then enable the <code>systemd</code> unit with <code>sudo systemctl enable asl-st-routing-service --now</code>.

== Step 5: Verify functionality ==
=== asl-node-auth-check ===
AllStarLink comes with the <code>asl-node-auth-check</code> utility that automatically evaluates your connection and registration status. It must be run as superuser. SSH into your ASL3 node and run <code>sudo asl-node-auth-check</code>. If there are no errors, your node is correctly registered. Warnings should be addressed if possible.

Split tunnel users may see a warning that their node is not perceived as registered, but this is acceptable as long as the node functionality is not impaired. Node functionality will be assessed in the next section by connecting with a VoIP app. If the split tunnel or firewall are incorrectly configured, there may be HTTP connection errors.

=== VoIP app ===

== Troubleshooting ==
AllStarLink has a [https://allstarlink.github.io/user-guide/troubleshooting/ troubleshooting guide]. This section includes additional troubleshooting tools, and does not reiterate any of the officially recommended methods.

[[Category:Use Cases]]
[[Category:How-To]]

AllStarLink

2026-10-08T18:03:27Z

KN6DWI: Created verify and troubleshooting sections

AllStarLink is an open source<ref>The ASL3 source is [https://github.com/AllStarLink/ASL3 available on GitHub], though installing from source is not recommended.</ref> internet repeater linking system that uses the Asterisk PBX software internally, and provides a web interface for management. It can be used both for connecting repeaters to the internet and for creating reflectors that internet-linked repeaters can connect to. An AllStarLink installation consists of multiple pieces of software: The Asterisk PBX, the app_rpt application made by AllStarLink, and the Allmon3 web interface.

== Step 1: Sign up for AllStarLink ==
Follow AllStarLink's [https://allstarlink.github.io/basics/portal/ instructions for the sign up process]. They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.

During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.

Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is <code>4569</code>.

== Step 2: Install AllStarLink ==
AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes the same, and additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation, which lets you preload Wi-Fi configuration. It also supports managing the Pi's serial port at <code>/dev/serial0</code>, as well as using the GPIO pins for PTT triggering. The Pi image keeps logs and temp files only in memory to reduce writes to the SD card.

=== Raspberry Pi Appliance ===
To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.] This guide is primarily for flashing a fresh image on your Pi. If you want to add an ASL3 appliance to an existing Pi, follow the steps for the Debian appliance.

=== Debian PC or Appliance ===
To install ASL3 on Debian, via any of <code>asl3-appliance</code>, <code>asl3-appliance-pc</code>, or a non-appliance Debian install (<code>asl3</code>), follow [https://allstarlink.github.io/install/debian/install/ the ASL3 Debian install guide.] It covers all three methods, and notes each point where the installation methods diverge.

== Step 3: Configure firewall ==
=== firewalld ===
{{Info|Warn|When using a 44Net Connect tunnel with AllStarLink and <code>firewalld</code>, don't put the 44Net WireGuard interface in the <code>allstarlink</code> zone provided by the appliance. This will make your web management interface publicly available on the internet. Instead, create a 44Net zone, and add the requisite services to that zone.}}

For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has [https://allstarlink.github.io/adv-topics/44net-connect/ a page about 44Net Connect] with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom <code>firewalld</code> service definitions. Your 44Net Connect zone must have the <code>iax2</code> service added for AllStar to function. If you're accepting EchoLink connections, the <code>echolink</code> service must also be added. That can be done with the following commands:

'''IAX2:'''<code>sudo firewall-cmd --zone <your zone here> --add-service iax2 --permanent</code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-service echolink --permanent</code>

Users of the non-appliance version should open <code>UDP 4560-4580</code> for IAX2, and <code>5198-5199</code> for EchoLink.

'''IAX2:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 4560-4580/udp --permanent </code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 5189-5199/udp --permanent</code>

Once you've added your services or ports, don't forget to reload your firewall:

<code>sudo firewall-cmd --reload</code>

=== ufw ===
{{Info|Note|<code>firewalld</code> is the recommended firewall software for devices with 44Net Connect software, because its abstraction of zones makes secure configuration easier to set up and understand. <code>ufw</code> is not recommended, but it can still be used. It will be more involved due to lacking zones. }}

<code>ufw</code> rules allowing IAX2 and EchoLink can be entered as follows:

'''IAX2:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 4560-4580 proto udp</code>

'''Echolink:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 5189-5199 proto udp</code>

These rules can be entered before the 44Net Connect WireGuard interface is actually created, but they won't work until a WireGuard interface is created with exactly the same name. The WireGuard interface will be named after the config file used to create it, so <code>wg0.conf</code> would create the interface <code>wg0</code>.

== Step 4: Enable 44Net Connect tunnel ==
Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel Single Device Tunnel tutorials list], and follow the quick start tutorial for your distribution.

=== Optional: Split Tunnel ===
There are special considerations for operating a 44Net Connect split tunnel on a device with AllStarLink. Nodes register with the central coordination server and report statistics by contacting <code>register.allstarlink.org</code> and <code>stats.allstarlink.org</code>. For the node to be registered with your static 44Net IP, these communications must go out through your VPN tunnel, which by by default they will not. These domains don't have static IPs, so you'll need to deploy a watchdog service to create and update routing rules based on the DNS. The following <code>systemd</code> unit will do this. Place it in <code>/etc/systemd/system/</code>.

<nowiki>
[Unit]
Description=Maintains rules that route traffic to AllStarLink domains through the 44Net split tunnel
Requires=network-online.target
After=network.target network-online.target
Before=asterisk.service allmon3.service

# Change this to the name of your split tunnel service
Requires=wg-quick@wg0-st.service

[Service]
Type=exec

# Make sure you copy the script to this path exactly, or change the path here
ExecStart=/opt/allstarlink/st-routing-watchdog.sh

[Install]
WantedBy=multi-user.target</nowiki>

This <code>systemd</code> unit depends on the following script being placed in <code>/opt/allstarlink/st-routing-watchdog.sh</code> The <code>/opt/allstarlink</code> directory is not automatically created. Make it with <code>sudo mkdir /opt/allstarlink</code> before placing the file there.

<nowiki>
#!/usr/bin/bash

# Change this if you use a different routing table for your WireGuard interface
WG_TABLE=51820

# Initialize variables
REGISTER_IPS=""
STATS_IP=""

del_rules () {
ip rule del to $1 lookup $WG_TABLE

while IFS= read -r line || [[ -n $line ]]; do
ip rule del to $line lookup $WG_TABLE
done < <(printf '%s' "$1")
}

cleanup () {
echo 'Received $1, cleaning up rules and exiting.'
del_rules "$2" "$3"
}
while
# Note that there are multiple IPs for register.allstarlink.org
REGISTER_IPS_NEW=$(dig +short register.allstarlink.org)
STATS_IP_NEW=$(dig +short stats.allstarlink.org)

echo "$REGISTER_IPS_NEW"

# Ensure records are not null
if [[ $REGISTER_IPS_NEW == "" ]]; then
echo "DNS resolution error for register.allstarlink.org"
exit 2
fi;

if [[ $STATS_IP_NEW == "" ]]; then
echo "DNS resolution error for stats.allstarlink.org"
exit 2
fi;

# Fetch TTLs for DNS A records
REGISTER_TTL=$(dig register.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
STATS_TTL=$(dig stats.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
echo "register.allstarlink.org resolves to $REGISTER_IP_NEW"
echo "stats.allstarlink.org resolves to $STATS_IP_NEW"
echo
echo "TTL of register.allstarlink.org: $REGISTER_TTL"
echo "TTL of stats.allstarlink.org: $STATS_TTL"

# Use smaller of the two TTLs
if (( REGISTER_TTL > STATS_TTL )); then
FINAL_TTL=$STATS_TTL
else
FINAL_TTL=$REGISTER_TTL
fi;

# If new IPs don't match old IPs, replace rules.
if [[ $REGISTER_IPS == $REGISTER_IPS_NEW && $STATS_IP == $STATS_IP_NEW ]]; then
echo "IPs have not changed. Rules will not be updated."
else
echo "IPs have changed. Updating rules."

# Create routing rules
# Putting this before deletion of old rules to prevent race condition routing leakage.
# This while loop to read each line from REGISTER_IPS_NEW is from
# https://superuser.com/questions/284187/how-to-iterate-over-lines-in-a-variable-in-bash
while IFS= read -r line || [[ -n $line ]]; do
ip rule add to $line lookup $WG_TABLE
done < <(printf '%s' "$REGISTER_IPS_NEW")

ip rule add to $STATS_IP_NEW lookup $WG_TABLE

# Don't try to delete old rules on first iteration bc they don't exist yet
if [[ $REGISTER_IP != "" ]]; then
del_rules $STATS_IP $REGISTER_IPS
fi;

REGISTER_IPS=$REGISTER_IPS_NEW
STATS_IP=$STATS_IP_NEW
fi;

# Delete routes when program is stopped
# TODO: Invoke cleanup function here to clean up all register rules
trap 'echo "Received SIGINT, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGINT

trap 'echo "Received SIGTERM, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGTERM

# Sleep for duration of TTL
echo "Sleeping for $FINAL_TTL seconds"
echo
sleep $FINAL_TTL

do true; done</nowiki>

After installing these files, make the script executable by running <code>sudo chmod +x /opt/allstarlink/st-routing-watchdog.sh</code>, then enable the <code>systemd</code> unit with <code>sudo systemctl enable asl-st-routing-service --now</code>.

== Step 5: Verify functionality ==
=== asl-node-auth-check ===

== Troubleshooting ==
AllStarLink has a [https://allstarlink.github.io/user-guide/troubleshooting/ troubleshooting guide]. This section includes additional troubleshooting tools, and does not reiterate any of the officially recommended methods.

[[Category:Use Cases]]
[[Category:How-To]]

AllStarLink

2026-10-08T00:50:30Z

KN6DWI: Phrasing edit to callout

AllStarLink

2026-10-08T00:14:25Z

KN6DWI: Specified 44Net Connect split tunnel

AllStarLink is an open source<ref>The ASL3 source is [https://github.com/AllStarLink/ASL3 available on GitHub], though installing from source is not recommended.</ref> internet repeater linking system that uses the Asterisk PBX software internally, and provides a web interface for management. It can be used both for connecting repeaters to the internet and for creating reflectors that internet-linked repeaters can connect to. An AllStarLink installation consists of multiple pieces of software: The Asterisk PBX, the app_rpt application made by AllStarLink, and the Allmon3 web interface.

== Step 1: Sign up for AllStarLink ==
Follow AllStarLink's [https://allstarlink.github.io/basics/portal/ instructions for the sign up process]. They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.

During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.

Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is <code>4569</code>.

== Step 2: Install AllStarLink ==
AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes the same, and additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation, which lets you preload Wi-Fi configuration. It also supports managing the Pi's serial port at <code>/dev/serial0</code>, as well as using the GPIO pins for PTT triggering. The Pi image keeps logs and temp files only in memory to reduce writes to the SD card.

=== Raspberry Pi Appliance ===
To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.] This guide is primarily for flashing a fresh image on your Pi. If you want to add an ASL3 appliance to an existing Pi, follow the steps for the Debian appliance.

=== Debian PC or Appliance ===
To install ASL3 on Debian, via any of <code>asl3-appliance</code>, <code>asl3-appliance-pc</code>, or a non-appliance Debian install (<code>asl3</code>), follow [https://allstarlink.github.io/install/debian/install/ the ASL3 Debian install guide.] It covers all three methods, and notes each point where the installation methods diverge.

== Step 3: Configure firewall ==
=== firewalld ===
{{Info|Warn|When using a 44Net Connect tunnel with AllStarLink and <code>firewalld</code>, don't put the 44Net WireGuard interface in the <code>allstarlink</code> zone provided by the appliance. This will make your web management interface publicly available on the internet. Instead, create a 44Net zone, and add the requisite services to that zone.}}

For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has [https://allstarlink.github.io/adv-topics/44net-connect/ a page about 44Net Connect] with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom <code>firewalld</code> service definitions. Your 44Net Connect zone must have the <code>iax2</code> service added for AllStar to function. If you're accepting EchoLink connections, the <code>echolink</code> service must also be added. That can be done with the following commands:

'''IAX2:'''<code>sudo firewall-cmd --zone <your zone here> --add-service iax2 --permanent</code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-service echolink --permanent</code>

Users of the non-appliance version should open <code>UDP 4560-4580</code> for IAX2, and <code>5198-5199</code> for EchoLink.

'''IAX2:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 4560-4580/udp --permanent </code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 5189-5199/udp --permanent</code>

Once you've added your services or ports, don't forget to reload your firewall:

<code>sudo firewall-cmd --reload</code>

=== ufw ===
{{Info|Note|<code>firewalld</code> is the recommended firewall software for devices with 44Net Connect software, because its abstraction of zones makes secure configuration easier to set up and understand. <code>ufw</code> can still be used, but it will be more involved due to lacking zones. }}

<code>ufw</code> rules allowing IAX2 and EchoLink can be entered as follows:

'''IAX2:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 4560-4580 proto udp</code>

'''Echolink:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 5189-5199 proto udp</code>

These rules can be entered before the 44Net Connect WireGuard interface is actually created, but they won't work until a WireGuard interface is created with exactly the same name. The WireGuard interface will be named after the config file used to create it, so <code>wg0.conf</code> would create the interface <code>wg0</code>.

== Step 4: Enable 44Net Connect tunnel ==
Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel Single Device Tunnel tutorials list], and follow the quick start tutorial for your distribution.

=== Optional: Split Tunnel ===
There are special considerations for operating a 44Net Connect split tunnel on a device with AllStarLink. Nodes register with the central coordination server and report statistics by contacting <code>register.allstarlink.org</code> and <code>stats.allstarlink.org</code>. For the node to be registered with your static 44Net IP, these communications must go out through your VPN tunnel, which by by default they will not. These domains don't have static IPs, so you'll need to deploy a watchdog service to create and update routing rules based on the DNS. The following <code>systemd</code> unit will do this. Place it in <code>/etc/systemd/system/</code>.

<nowiki>
[Unit]
Description=Maintains rules that route traffic to AllStarLink domains through the 44Net split tunnel
Requires=network-online.target
After=network.target network-online.target
Before=asterisk.service allmon3.service

# Change this to the name of your split tunnel service
Requires=wg-quick@wg0-st.service

[Service]
Type=exec

# Make sure you copy the script to this path exactly, or change the path here
ExecStart=/opt/allstarlink/st-routing-watchdog.sh

[Install]
WantedBy=multi-user.target</nowiki>

This <code>systemd</code> unit depends on the following script being placed in <code>/opt/allstarlink/st-routing-watchdog.sh</code> The <code>/opt/allstarlink</code> directory is not automatically created. Make it with <code>sudo mkdir /opt/allstarlink</code> before placing the file there.

<nowiki>
#!/usr/bin/bash

# Change this if you use a different routing table for your WireGuard interface
WG_TABLE=51820

# Initialize variables
REGISTER_IPS=""
STATS_IP=""

del_rules () {
ip rule del to $1 lookup $WG_TABLE

while IFS= read -r line || [[ -n $line ]]; do
ip rule del to $line lookup $WG_TABLE
done < <(printf '%s' "$1")
}

cleanup () {
echo 'Received $1, cleaning up rules and exiting.'
del_rules "$2" "$3"
}
while
# Note that there are multiple IPs for register.allstarlink.org
REGISTER_IPS_NEW=$(dig +short register.allstarlink.org)
STATS_IP_NEW=$(dig +short stats.allstarlink.org)

echo "$REGISTER_IPS_NEW"

# Ensure records are not null
if [[ $REGISTER_IPS_NEW == "" ]]; then
echo "DNS resolution error for register.allstarlink.org"
exit 2
fi;

if [[ $STATS_IP_NEW == "" ]]; then
echo "DNS resolution error for stats.allstarlink.org"
exit 2
fi;

# Fetch TTLs for DNS A records
REGISTER_TTL=$(dig register.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
STATS_TTL=$(dig stats.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
echo "register.allstarlink.org resolves to $REGISTER_IP_NEW"
echo "stats.allstarlink.org resolves to $STATS_IP_NEW"
echo
echo "TTL of register.allstarlink.org: $REGISTER_TTL"
echo "TTL of stats.allstarlink.org: $STATS_TTL"

# Use smaller of the two TTLs
if (( REGISTER_TTL > STATS_TTL )); then
FINAL_TTL=$STATS_TTL
else
FINAL_TTL=$REGISTER_TTL
fi;

# If new IPs don't match old IPs, replace rules.
if [[ $REGISTER_IPS == $REGISTER_IPS_NEW && $STATS_IP == $STATS_IP_NEW ]]; then
echo "IPs have not changed. Rules will not be updated."
else
echo "IPs have changed. Updating rules."

# Create routing rules
# Putting this before deletion of old rules to prevent race condition routing leakage.
# This while loop to read each line from REGISTER_IPS_NEW is from
# https://superuser.com/questions/284187/how-to-iterate-over-lines-in-a-variable-in-bash
while IFS= read -r line || [[ -n $line ]]; do
ip rule add to $line lookup $WG_TABLE
done < <(printf '%s' "$REGISTER_IPS_NEW")

ip rule add to $STATS_IP_NEW lookup $WG_TABLE

# Don't try to delete old rules on first iteration bc they don't exist yet
if [[ $REGISTER_IP != "" ]]; then
del_rules $STATS_IP $REGISTER_IPS
fi;

REGISTER_IPS=$REGISTER_IPS_NEW
STATS_IP=$STATS_IP_NEW
fi;

# Delete routes when program is stopped
# TODO: Invoke cleanup function here to clean up all register rules
trap 'echo "Received SIGINT, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGINT

trap 'echo "Received SIGTERM, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGTERM

# Sleep for duration of TTL
echo "Sleeping for $FINAL_TTL seconds"
echo
sleep $FINAL_TTL

do true; done</nowiki>

After installing these files, make the script executable by running <code>sudo chmod +x /opt/allstarlink/st-routing-watchdog.sh</code>, then enable the <code>systemd</code> unit with <code>sudo systemctl enable asl-st-routing-service --now</code>.

[[Category:Use Cases]]
[[Category:How-To]]

AllStarLink

2026-10-08T00:05:49Z

KN6DWI: Instruct users to make the script executable and enable the systemd unit

AllStarLink is an open source<ref>The ASL3 source is [https://github.com/AllStarLink/ASL3 available on GitHub], though installing from source is not recommended.</ref> internet repeater linking system that uses the Asterisk PBX software internally, and provides a web interface for management. It can be used both for connecting repeaters to the internet and for creating reflectors that internet-linked repeaters can connect to. An AllStarLink installation consists of multiple pieces of software: The Asterisk PBX, the app_rpt application made by AllStarLink, and the Allmon3 web interface.

== Step 1: Sign up for AllStarLink ==
Follow AllStarLink's [https://allstarlink.github.io/basics/portal/ instructions for the sign up process]. They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.

During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.

Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is <code>4569</code>.

== Step 2: Install AllStarLink ==
AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes the same, and additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation, which lets you preload Wi-Fi configuration. It also supports managing the Pi's serial port at <code>/dev/serial0</code>, as well as using the GPIO pins for PTT triggering. The Pi image keeps logs and temp files only in memory to reduce writes to the SD card.

=== Raspberry Pi Appliance ===
To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.] This guide is primarily for flashing a fresh image on your Pi. If you want to add an ASL3 appliance to an existing Pi, follow the steps for the Debian appliance.

=== Debian PC or Appliance ===
To install ASL3 on Debian, via any of <code>asl3-appliance</code>, <code>asl3-appliance-pc</code>, or a non-appliance Debian install (<code>asl3</code>), follow [https://allstarlink.github.io/install/debian/install/ the ASL3 Debian install guide.] It covers all three methods, and notes each point where the installation methods diverge.

== Step 3: Configure firewall ==
=== firewalld ===
{{Info|Warn|When using a 44Net Connect tunnel with AllStarLink and <code>firewalld</code>, don't put the 44Net WireGuard interface in the <code>allstarlink</code> zone provided by the appliance. This will make your web management interface publicly available on the internet. Instead, create a 44Net zone, and add the requisite services to that zone.}}

For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has [https://allstarlink.github.io/adv-topics/44net-connect/ a page about 44Net Connect] with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom <code>firewalld</code> service definitions. Your 44Net Connect zone must have the <code>iax2</code> service added for AllStar to function. If you're accepting EchoLink connections, the <code>echolink</code> service must also be added. That can be done with the following commands:

'''IAX2:'''<code>sudo firewall-cmd --zone <your zone here> --add-service iax2 --permanent</code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-service echolink --permanent</code>

Users of the non-appliance version should open <code>UDP 4560-4580</code> for IAX2, and <code>5198-5199</code> for EchoLink.

'''IAX2:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 4560-4580/udp --permanent </code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 5189-5199/udp --permanent</code>

Once you've added your services or ports, don't forget to reload your firewall:

<code>sudo firewall-cmd --reload</code>

=== ufw ===
{{Info|Note|<code>firewalld</code> is the recommended firewall software for devices with 44Net Connect software, because its abstraction of zones makes secure configuration easier to set up and understand. <code>ufw</code> can still be used, but it will be more involved due to lacking zones. }}

<code>ufw</code> rules allowing IAX2 and EchoLink can be entered as follows:

'''IAX2:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 4560-4580 proto udp</code>

'''Echolink:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 5189-5199 proto udp</code>

These rules can be entered before the 44Net Connect WireGuard interface is actually created, but they won't work until a WireGuard interface is created with exactly the same name. The WireGuard interface will be named after the config file used to create it, so <code>wg0.conf</code> would create the interface <code>wg0</code>.

== Step 4: Enable 44Net Connect tunnel ==
Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel Single Device Tunnel tutorials list], and follow the quick start tutorial for your distribution.

=== Optional: Split Tunnel ===
There are special considerations for operating a split tunnel on a device with AllStarLink. Nodes register with the central coordination server and report statistics by contacting <code>register.allstarlink.org</code> and <code>stats.allstarlink.org</code>. For the node to be registered with your static 44Net IP, these communications must go out through your VPN tunnel, which by by default they will not. These domains don't have static IPs, so you'll need to deploy a watchdog service to create and update routing rules based on the DNS. The following <code>systemd</code> unit will do this. Place it in <code>/etc/systemd/system/</code>.

<nowiki>
[Unit]
Description=Maintains rules that route traffic to AllStarLink domains through the 44Net split tunnel
Requires=network-online.target
After=network.target network-online.target
Before=asterisk.service allmon3.service

# Change this to the name of your split tunnel service
Requires=wg-quick@wg0-st.service

[Service]
Type=exec

# Make sure you copy the script to this path exactly, or change the path here
ExecStart=/opt/allstarlink/st-routing-watchdog.sh

[Install]
WantedBy=multi-user.target</nowiki>

This <code>systemd</code> unit depends on the following script being placed in <code>/opt/allstarlink/st-routing-watchdog.sh</code> The <code>/opt/allstarlink</code> directory is not automatically created. Make it with <code>sudo mkdir /opt/allstarlink</code> before placing the file there.

<nowiki>
#!/usr/bin/bash

# Change this if you use a different routing table for your WireGuard interface
WG_TABLE=51820

# Initialize variables
REGISTER_IPS=""
STATS_IP=""

del_rules () {
ip rule del to $1 lookup $WG_TABLE

while IFS= read -r line || [[ -n $line ]]; do
ip rule del to $line lookup $WG_TABLE
done < <(printf '%s' "$1")
}

cleanup () {
echo 'Received $1, cleaning up rules and exiting.'
del_rules "$2" "$3"
}
while
# Note that there are multiple IPs for register.allstarlink.org
REGISTER_IPS_NEW=$(dig +short register.allstarlink.org)
STATS_IP_NEW=$(dig +short stats.allstarlink.org)

echo "$REGISTER_IPS_NEW"

# Ensure records are not null
if [[ $REGISTER_IPS_NEW == "" ]]; then
echo "DNS resolution error for register.allstarlink.org"
exit 2
fi;

if [[ $STATS_IP_NEW == "" ]]; then
echo "DNS resolution error for stats.allstarlink.org"
exit 2
fi;

# Fetch TTLs for DNS A records
REGISTER_TTL=$(dig register.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
STATS_TTL=$(dig stats.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
echo "register.allstarlink.org resolves to $REGISTER_IP_NEW"
echo "stats.allstarlink.org resolves to $STATS_IP_NEW"
echo
echo "TTL of register.allstarlink.org: $REGISTER_TTL"
echo "TTL of stats.allstarlink.org: $STATS_TTL"

# Use smaller of the two TTLs
if (( REGISTER_TTL > STATS_TTL )); then
FINAL_TTL=$STATS_TTL
else
FINAL_TTL=$REGISTER_TTL
fi;

# If new IPs don't match old IPs, replace rules.
if [[ $REGISTER_IPS == $REGISTER_IPS_NEW && $STATS_IP == $STATS_IP_NEW ]]; then
echo "IPs have not changed. Rules will not be updated."
else
echo "IPs have changed. Updating rules."

# Create routing rules
# Putting this before deletion of old rules to prevent race condition routing leakage.
# This while loop to read each line from REGISTER_IPS_NEW is from
# https://superuser.com/questions/284187/how-to-iterate-over-lines-in-a-variable-in-bash
while IFS= read -r line || [[ -n $line ]]; do
ip rule add to $line lookup $WG_TABLE
done < <(printf '%s' "$REGISTER_IPS_NEW")

ip rule add to $STATS_IP_NEW lookup $WG_TABLE

# Don't try to delete old rules on first iteration bc they don't exist yet
if [[ $REGISTER_IP != "" ]]; then
del_rules $STATS_IP $REGISTER_IPS
fi;

REGISTER_IPS=$REGISTER_IPS_NEW
STATS_IP=$STATS_IP_NEW
fi;

# Delete routes when program is stopped
# TODO: Invoke cleanup function here to clean up all register rules
trap 'echo "Received SIGINT, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGINT

trap 'echo "Received SIGTERM, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGTERM

# Sleep for duration of TTL
echo "Sleeping for $FINAL_TTL seconds"
echo
sleep $FINAL_TTL

do true; done</nowiki>

After installing these files, make the script executable by running <code>sudo chmod +x /opt/allstarlink/st-routing-watchdog.sh</code>, then enable the <code>systemd</code> unit with <code>sudo systemctl enable asl-st-routing-service --now</code>.

[[Category:Use Cases]]
[[Category:How-To]]

AllStarLink

2026-10-07T23:59:44Z

KN6DWI: Included systemd unit and accompanying script for split tunnel configuration

AllStarLink is an open source<ref>The ASL3 source is [https://github.com/AllStarLink/ASL3 available on GitHub], though installing from source is not recommended.</ref> internet repeater linking system that uses the Asterisk PBX software internally, and provides a web interface for management. It can be used both for connecting repeaters to the internet and for creating reflectors that internet-linked repeaters can connect to. An AllStarLink installation consists of multiple pieces of software: The Asterisk PBX, the app_rpt application made by AllStarLink, and the Allmon3 web interface.

== Step 1: Sign up for AllStarLink ==
Follow AllStarLink's [https://allstarlink.github.io/basics/portal/ instructions for the sign up process]. They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.

During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.

Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is <code>4569</code>.

== Step 2: Install AllStarLink ==
AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes the same, and additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation, which lets you preload Wi-Fi configuration. It also supports managing the Pi's serial port at <code>/dev/serial0</code>, as well as using the GPIO pins for PTT triggering. The Pi image keeps logs and temp files only in memory to reduce writes to the SD card.

=== Raspberry Pi Appliance ===
To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.] This guide is primarily for flashing a fresh image on your Pi. If you want to add an ASL3 appliance to an existing Pi, follow the steps for the Debian appliance.

=== Debian PC or Appliance ===
To install ASL3 on Debian, via any of <code>asl3-appliance</code>, <code>asl3-appliance-pc</code>, or a non-appliance Debian install (<code>asl3</code>), follow [https://allstarlink.github.io/install/debian/install/ the ASL3 Debian install guide.] It covers all three methods, and notes each point where the installation methods diverge.

== Step 3: Configure firewall ==
=== firewalld ===
{{Info|Warn|When using a 44Net Connect tunnel with AllStarLink and <code>firewalld</code>, don't put the 44Net WireGuard interface in the <code>allstarlink</code> zone provided by the appliance. This will make your web management interface publicly available on the internet. Instead, create a 44Net zone, and add the requisite services to that zone.}}

For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has [https://allstarlink.github.io/adv-topics/44net-connect/ a page about 44Net Connect] with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom <code>firewalld</code> service definitions. Your 44Net Connect zone must have the <code>iax2</code> service added for AllStar to function. If you're accepting EchoLink connections, the <code>echolink</code> service must also be added. That can be done with the following commands:

'''IAX2:'''<code>sudo firewall-cmd --zone <your zone here> --add-service iax2 --permanent</code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-service echolink --permanent</code>

Users of the non-appliance version should open <code>UDP 4560-4580</code> for IAX2, and <code>5198-5199</code> for EchoLink.

'''IAX2:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 4560-4580/udp --permanent </code>

'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 5189-5199/udp --permanent</code>

Once you've added your services or ports, don't forget to reload your firewall:

<code>sudo firewall-cmd --reload</code>

=== ufw ===
{{Info|Note|<code>firewalld</code> is the recommended firewall software for devices with 44Net Connect software, because its abstraction of zones makes secure configuration easier to set up and understand. <code>ufw</code> can still be used, but it will be more involved due to lacking zones. }}

<code>ufw</code> rules allowing IAX2 and EchoLink can be entered as follows:

'''IAX2:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 4560-4580 proto udp</code>

'''Echolink:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 5189-5199 proto udp</code>

These rules can be entered before the 44Net Connect WireGuard interface is actually created, but they won't work until a WireGuard interface is created with exactly the same name. The WireGuard interface will be named after the config file used to create it, so <code>wg0.conf</code> would create the interface <code>wg0</code>.

== Step 4: Enable 44Net Connect tunnel ==
Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel Single Device Tunnel tutorials list], and follow the quick start tutorial for your distribution.

=== Optional: Split Tunnel ===
There are special considerations for operating a split tunnel on a device with AllStarLink. Nodes register with the central coordination server and report statistics by contacting <code>register.allstarlink.org</code> and <code>stats.allstarlink.org</code>. For the node to be registered with your static 44Net IP, these communications must go out through your VPN tunnel, which by by default they will not. These domains don't have static IPs, so you'll need to deploy a watchdog service to create and update routing rules based on the DNS. The following <code>systemd</code> unit will do this. Place it in <code>/etc/systemd/system/</code>.

<nowiki>
[Unit]
Description=Maintains rules that route traffic to AllStarLink domains through the 44Net split tunnel
Requires=network-online.target
After=network.target network-online.target
Before=asterisk.service allmon3.service

# Change this to the name of your split tunnel service
Requires=wg-quick@wg0-st.service

[Service]
Type=exec

# Make sure you copy the script to this path exactly, or change the path here
ExecStart=/opt/allstarlink/st-routing-watchdog.sh

[Install]
WantedBy=multi-user.target</nowiki>

This <code>systemd</code> unit depends on the following script being placed in <code>/opt/allstarlink/st-routing-watchdog.sh</code>

<nowiki>
#!/usr/bin/bash

# Change this if you use a different routing table for your WireGuard interface
WG_TABLE=51820

# Initialize variables
REGISTER_IPS=""
STATS_IP=""

del_rules () {
ip rule del to $1 lookup $WG_TABLE

while IFS= read -r line || [[ -n $line ]]; do
ip rule del to $line lookup $WG_TABLE
done < <(printf '%s' "$1")
}

cleanup () {
echo 'Received $1, cleaning up rules and exiting.'
del_rules "$2" "$3"
}
while
# Note that there are multiple IPs for register.allstarlink.org
REGISTER_IPS_NEW=$(dig +short register.allstarlink.org)
STATS_IP_NEW=$(dig +short stats.allstarlink.org)

echo "$REGISTER_IPS_NEW"

# Ensure records are not null
if [[ $REGISTER_IPS_NEW == "" ]]; then
echo "DNS resolution error for register.allstarlink.org"
exit 2
fi;

if [[ $STATS_IP_NEW == "" ]]; then
echo "DNS resolution error for stats.allstarlink.org"
exit 2
fi;

# Fetch TTLs for DNS A records
REGISTER_TTL=$(dig register.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
STATS_TTL=$(dig stats.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
echo "register.allstarlink.org resolves to $REGISTER_IP_NEW"
echo "stats.allstarlink.org resolves to $STATS_IP_NEW"
echo
echo "TTL of register.allstarlink.org: $REGISTER_TTL"
echo "TTL of stats.allstarlink.org: $STATS_TTL"

# Use smaller of the two TTLs
if (( REGISTER_TTL > STATS_TTL )); then
FINAL_TTL=$STATS_TTL
else
FINAL_TTL=$REGISTER_TTL
fi;

# If new IPs don't match old IPs, replace rules.
if [[ $REGISTER_IPS == $REGISTER_IPS_NEW && $STATS_IP == $STATS_IP_NEW ]]; then
echo "IPs have not changed. Rules will not be updated."
else
echo "IPs have changed. Updating rules."

# Create routing rules
# Putting this before deletion of old rules to prevent race condition routing leakage.
# This while loop to read each line from REGISTER_IPS_NEW is from
# https://superuser.com/questions/284187/how-to-iterate-over-lines-in-a-variable-in-bash
while IFS= read -r line || [[ -n $line ]]; do
ip rule add to $line lookup $WG_TABLE
done < <(printf '%s' "$REGISTER_IPS_NEW")

ip rule add to $STATS_IP_NEW lookup $WG_TABLE

# Don't try to delete old rules on first iteration bc they don't exist yet
if [[ $REGISTER_IP != "" ]]; then
del_rules $STATS_IP $REGISTER_IPS
fi;

REGISTER_IPS=$REGISTER_IPS_NEW
STATS_IP=$STATS_IP_NEW
fi;

# Delete routes when program is stopped
# TODO: Invoke cleanup function here to clean up all register rules
trap 'echo "Received SIGINT, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGINT

trap 'echo "Received SIGTERM, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGTERM

# Sleep for duration of TTL
echo "Sleeping for $FINAL_TTL seconds"
echo
sleep $FINAL_TTL

do true; done</nowiki>
[[Category:Use Cases]]
[[Category:How-To]]

AllStarLink

2026-10-02T23:13:46Z

KN6DWI: Described necessary systemd unit (but not included yet bc the unit is WIP)

AllStarLink

2026-10-02T00:02:24Z

KN6DWI: Discuss special considerations for split tunnel

AllStarLink

2026-10-01T22:58:23Z

KN6DWI: Added permanent flags and reminder to reload firewall to firewalld section

AllStarLink

2026-10-01T22:37:11Z

KN6DWI: Fix link formatting

AllStarLink

2026-10-01T22:09:45Z

KN6DWI: Tell user that rules can be created before the WG interface

AllStarLink

2026-10-01T18:59:47Z

KN6DWI: Wrote instructions for firewall rule configuration

AllStarLink

2026-09-30T23:35:39Z

KN6DWI: Started section on configuring firewall

AllStarLink

2026-09-30T23:08:19Z

KN6DWI: Mentioned how to add ASL3 appliance to existing Pi

Talk:AllStarLink

2026-09-30T23:07:01Z

KN6DWI: Created page

This page serves primarily to index AllStarLink's guides. They're very good, but indexed rather weirdly. There's no central index page, but they can be accessed from the sidebar on https://allstarlink.github.io/.

AllStarLink

2026-09-30T22:58:38Z

KN6DWI: Added links to Pi and Debian guides

AllStarLink

2026-09-30T19:07:52Z

KN6DWI: Started ASL installation instructions

AllStarLink

2026-09-30T18:23:44Z

KN6DWI: Added default IAX port

AllStarLink

2026-09-30T18:23:02Z

KN6DWI: Instruct users to read the AllStarLink sign up documentation

AllStarLink

2026-09-30T18:04:13Z

KN6DWI: Wrote instructions for signing up for allstar portal

AllStarLink

2026-09-29T19:04:53Z

KN6DWI: Added footnote with link to ASL3 repository

AllStarLink

2026-09-29T18:59:24Z

KN6DWI: Added section headers

AllStarLink is an open source internet repeater linking system that uses the Asterisk PBX software internally, and provides a web interface for management. It can be used both for connecting repeaters to the internet and for creating reflectors that internet-linked repeaters can connect to. An AllStarLink installation consists of multiple pieces of software: The Asterisk PBX, the app_rpt application made by AllStarLink, and the Allmon3 web interface.

== Step 1: Sign up for an AllStar Account ==
== Step 2: Create a server ==
== Step 3: Create a node ==
== Step 4: Install AllStarLink ==
== Step 5: Configure firewall ==
== Step 6: Enable 44Net Connect tunnel ==

[[Category:Use Cases]]
[[Category:How-To]]

AllStarLink

2026-09-28T23:32:17Z

KN6DWI: Fixed typo in category

AllStarLink

2026-09-28T23:32:01Z

KN6DWI: Added categories

AllStarLink

2026-09-28T23:31:32Z

KN6DWI: Created page

44Net Connect/Quick Start

2026-09-28T17:47:40Z

KN6DWI: Copied over callouts from redundant page to be merged with this one

<div class="toclimit-3">
__TOC__
</div>
{{DISPLAYTITLE:44Net Connect Quick Start}}

Use this guide to quickly set up your first 44Net Connect tunnel and get your device participating on the Internet as a native 44Net host.

=== What you need ===

* A 44Net Portal account
* A verified amateur radio callsign
* A device capable of running WireGuard
* Some sort of Internet access

If you haven't set up your Portal account or verified your callsign yet, see [[GetStarted|44Net: Get Started]] for instructions. For a partial list of supported devices and device-specific tutorials, see [[44Net Connect/Supported Platforms|Supported Platforms]].

== Create your Connect tunnel ==
{{Info|Tip|The Connect dashboard is where you will manage your tunnels, view your assigned 44Net addresses, and access your WireGuard configurations. Consider bookmarking the dashboard for easy access.}}

{{Info|Note|The Connect dashboard is separate from the Portal dashboard. You will use your Portal account credentials to log in, but the two dashboards have different functions. The Portal dashboard is for managing your account, verifying your callsign, and accessing support resources, while the Connect dashboard is specifically for managing your WireGuard tunnels and configurations. You will need to log in to both dashboards at different times depending on what you want to do.}}

{{Step|
=== Step 1: Sign in to 44Net Connect ===
{{StepImage|file=Click to Log In.png}}
{{StepText|
* Visit [https://connect.44net.cloud The 44Net Connect dashboard].
* Click the “Log In to Get Started” button.
* Sign in with your 44Net Portal account credentials.

}}
}}

{{Step|
=== Step 2: Create your first tunnel ===
{{StepImage|file=Create Tunnel.png}}
{{StepText|
* On the dashboard page, click the “Create Tunnel” button.
}}
}}

{{Step|
=== Step 3: Choose region and node ===
{{StepImage|file=Choose Region and Node.png}}
{{StepText|
* In the list of regions, click the region closest to you.
* Nodes available in that region will appear.
* Click a node to select it as your endpoint.

You can change endpoints later if needed.
}}
}}

{{Step|
=== Step 4: Name your tunnel ===
{{StepImage|file=Name Tunnel.png}}
{{StepText|
* Enter a name for your tunnel (e.g. “Home Laptop” or “Raspberry Pi”)
}}
}}

{{Step|
=== Step 5: Save your new tunnel ===
{{StepImage|file=Complete Tunnel Creation.png}}
{{StepText|
* Check or uncheck the option to receive tunnel details via email.
* Click the “Create Tunnel” button.
* Review the confirmation dialog and click “Save Changes” to proceed.
}}
}}

== Configure your WireGuard client ==

{{Step|
=== Step 6: Get your configuration ===
{{StepImage|file=Copy Configuration.png|width=260px}}
{{StepText|
* Scroll down to find your tunnel configuration.
* Click the “Copy to Clipboard” button to copy the configuration text.
}}
}}

{{Step|
=== Step 7: Create a new tunnel ===
{{StepImage|file=Paste Configuration.png|width=260px}}
{{StepText|
==== Windows or macOS: ====
* Open your WireGuard client.
* Click the “+ Add Tunnel“ button to add a new tunnel.
* Delete the default template text and paste in your configuration.
* Give your tunnel a name in the “Name” field.
* Click the “Save” button.

==== Linux ====
* Create a new file for your WireGuard configuration, e.g. <code>/etc/wireguard/wg0.conf</code>.
* Paste the configuration text into the file and save it.

==== Other platforms ====
* Use the configuration text with your platform’s WireGuard implementation. Refer to your platform’s documentation for details on how to set up a WireGuard tunnel.

}}
}}

== Activate and connect ==

{{Step|
=== Step 8: Activate your tunnel ===
{{StepImage|file=Activate.png|width=260px}}
{{StepText|
==== Windows or macOS: ====
* In your WireGuard client, select the tunnel you just created.
* Click the “Activate” button to start the tunnel.

==== Linux ====
* Run the command <code>wg-quick up wg0</code> (replace <code>wg0</code> with the name of your configuration file if different).

==== Other platforms ====
* Use your platform’s method for starting the WireGuard tunnel. Refer to your platform’s documentation for details.
}}
}}

{{Step|
=== Step 9: Confirm handshake ===
{{StepImage|file=Confirm.png|width=260px}}
{{StepText|
==== Windows or macOS: ====
* In your WireGuard client, look for the “Handshake” field in your tunnel status.
* If the handshake is successful, you should see a recent timestamp indicating the last successful handshake with the Connect endpoint.

==== Linux ====
* Run the command <code>wg</code> to check the status of your WireGuard interfaces.
* Look for the interface corresponding to your Connect tunnel and check the “latest handshake” timestamp.

==== Other platforms ====
* Use your platform’s method for checking WireGuard tunnel status and confirm that the handshake with the Connect endpoint is successful.

==== In the Connect dashboard ====
* Your tunnel status should show as “Active” with a green indicator.
}}
}}

Once the tunnel is active, your system operates as a native 44Net host. Inbound and outbound traffic is routed through the Connect endpoint, giving your device a direct connection to the Internet.

Your device is now reachable on the Internet at its 44Net IP address.
[[Category:Tutorial]]
[[Category:How-To]]
[[Category:Participation Methods]]
[[Category:44Net Connect]]
[[Category:Getting Started]]

Forgejo

2026-09-15T23:07:17Z

KN6DWI: Provide possible explanation for permission denied publickey

Forgejo is an open source {{Term|git forge}} that aims to implement {{Term|federation}} using the [https://activitypub.rocks/ ActivityPub] protocol. It can be self-hosted to provide code collaboration services similar to GitHub, such as remote git repositories, issue tracking, and pull/merge requests.

== Step 0 (Optional): Change your SSH to a nonstandard port ==
Git forges provide the ability to interact via HTTP or SSH. If you want users to interact with your Forgejo instance using the standard SSH port, and you have an existing SSH server on the same device, you must move your regular SSH server to another port. Forgejo supports SSH over other ports, but all of your users will have to specify that port in their <code>git clone</code> commands or configure it in their <code>~/.ssh/ssh_config</code> file.

To change your SSH port, edit <code>/etc/ssh/sshd_config</code>, uncomment the line starting with <code>Port</code>, and change the number to something other than 22. Open the corresponding port in your firewall. For more information on firewall configuration, see [[Firewalling Basics]].

== Step 1: Install Forgejo ==
Go to the [https://codeberg.org/forgejo-contrib/delightful-forgejo#packaging delightful forgejo] repository and check whether Forgejo has been packaged for your operating system or distribution. If so, install using your package manager. Otherwise, go to the [https://forgejo.org/docs/latest/admin/installation/ Forgejo installation page], decide whether you're going to install from binary or from a docker container, and follow the corresponding instructions. Make sure you complete initial setup before moving to the next step.

== Step 2: Open Forgejo ports in your device firewall ==
If you installed using Docker or Docker Compose, and want to use nonstandard ports, change the Docker port mappings. You will not need to open the ports in your firewall, because Docker port mappings are done via an <code>iptables</code> chain that takes precedence over user-configured rules. This means ports mapped using Docker will be immediately publicly accessible once you enable your 44Net Connect tunnel, so don't enable it until you've completed initial setup.

If you installed Forgejo from a binary, the ports used for the web UI are not editable from the web UI. Instead, edit the config file at <code>/etc/forgejo/app.ini</code>, and change the <code>HTTP_PORT</code> and <code>SSH_PORT</code> lines. Then, open the corresponding ports in your firewall. The default ports are 3000 for the web UI, and 222 for SSH. For more information on firewall configuration, see [[Firewalling Basics]].

Note that you cannot put the web UI on the same port as Forgejo's SSH access.

== Step 3: Set up 44Net Connect tunnel ==
Set up a single device tunnel on the machine that will host your Forgejo instance. Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel#Tutorials list of single device tunnel tutorials] and follow the one for your operating system.

== Step 4: Validate Forgejo functionality ==
Make sure your Forgejo instance is working by testing a few operations.
=== Create a repository using the web UI ===
Log into Forgejo and go to the Forgejo home page. Click the plus button at the top right, and click "New Repository." Fill in the details (specifics don't matter, since this is a test), and if the repository is successfully created, move on to the next step.

[[File:forgejo_create_repo.png]]

=== Clone the repository over HTTP ===
Copy the HTTP URL from Forgejo, go to your terminal, and run <code>git clone <URL></code>. It should go through "Enumerating objects," "Counting objects," and "Compressing objects" before finishing.

[[File:forgejo_clone_http.png| A screenshot of the HTTP git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]

If the clone completes without error, delete the folder and move on to cloning via SSH. If you get some error such as "Repository not found" or similar, you may have a configuration issue, and should proceed to the troubleshooting section.

=== Clone the repository over SSH ===
Copy the SSH URL from Forgejo, go to your terminal, and run <code>git clone <URL></code>. Just like before, it should go through "Enumerating objects," "Counting objects," and "Compressing objects" before finishing.
[[File:forgejo_clone_ssh.png| A screenshot of the SSH git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]

If the clone completes without error, delete the folder and move on to cloning via SSH. If you get some error such as "Repository not found" or "Permission denied: pubkey," you may have a configuration issue, and should proceed to the troubleshooting section.

=== Make a commit and push it to the remote repository ===
After cloning the repository, make a commit and push it to the remote repository with the following steps:
# Create or modify a file in the repository's folder
# Add your changes with <code>git add <file></code>
# Commit your changes with <code>git commit -m <message></code>
# Push to the remote repository with <code>git push</code>

The push command should proceed through enumerating objects, counting objects, delta compression, compressing objects, and writing objects, then finish. If it throws an error (any line starting with <code>fatal</code>), then you may have a configuration issue and should consult the troubleshooting section. If these are all working, you should be good to go!

== Troubleshooting ==
=== Can't connect to Forgejo web UI ===
* Make sure you're accessing the correct port. Unless you specify the port, your browser will default to port 80 for HTTP or port 443 for HTTPS. The default port for the web UI is 3000.
* Use <code>systemctl status <name of unit></code> to make sure your 44Net Connect tunnel is up. The name of the tunnel's <code>systemd</code> unit should be <code>wg-quick@<name of config file></code>.
* If you're using Docker, make sure your port mappings are correct. Those can be viewed by running <code>sudo docker ps -a</code> to list all containers. Containers created using Docker compose can have their port mappings viewed in their compose file.
* If you're not using Docker, ensure your device firewall has the correct ports open. <code>firewall-cmd</code> users should also make sure their 44Net Connect WireGuard interface is in the correct zone.

=== Can't clone repository over SSH ===
Forgejo does not operate on the same SSH port as your system's <code>sshd</code> server. The default port for Forgejo SSH is 222. Unless you change this to 22 (and move your <code>sshd</code> port somewhere else), you'll have to specify the correct port when cloning the repository. For example, <code>git clone ssh://git@yoursite.org:<port here>/username/repository</code>.

If you're getting <code>Permission denied (publickey)</code>, you may be attempting to SSH into the <code>sshd</code> port rather than the Forgejo port.

Forgejo

2026-09-15T23:05:06Z

KN6DWI: Removed extraneous link

Forgejo

2026-09-15T21:52:04Z

KN6DWI: Wrote instructions for pushing commit to remote

Forgejo is an open source {{Term|git forge}} that aims to implement {{Term|federation}} using the [https://activitypub.rocks/ ActivityPub] protocol. It can be self-hosted to provide code collaboration services similar to GitHub, such as remote git repositories, issue tracking, and pull/merge requests.

== Step 0 (Optional): Change your SSH to a nonstandard port ==
Git forges provide the ability to interact via HTTP or SSH. If you want users to interact with your Forgejo instance using the standard SSH port, and you have an existing SSH server on the same device, you must move your regular SSH server to another port. Forgejo supports SSH over other ports, but all of your users will have to specify that port in their <code>git clone</code> commands or configure it in their <code>~/.ssh/ssh_config</code> file.

To change your SSH port, edit <code>/etc/ssh/sshd_config</code>, uncomment the line starting with <code>Port</code>, and change the number to something other than 22. Open the corresponding port in your firewall. For more information on firewall configuration, see [[Firewalling Basics]].

== Step 1: Install Forgejo ==
Go to the [https://codeberg.org/forgejo-contrib/delightful-forgejo#packaging delightful forgejo] repository and check whether Forgejo has been packaged for your operating system or distribution. If so, install using your package manager. Otherwise, go to the [https://forgejo.org/docs/latest/admin/installation/ Forgejo installation page](https://forgejo.org/releases/) , decide whether you're going to install from binary or from a docker container, and follow the corresponding instructions. Make sure you complete initial setup before moving to the next step.

== Step 2: Open Forgejo ports in your device firewall ==
If you installed using Docker or Docker Compose, and want to use nonstandard ports, change the Docker port mappings. You will not need to open the ports in your firewall, because Docker port mappings are done via an <code>iptables</code> chain that takes precedence over user-configured rules. This means ports mapped using Docker will be immediately publicly accessible once you enable your 44Net Connect tunnel, so don't enable it until you've completed initial setup.

If you installed Forgejo from a binary, the ports used for the web UI are not editable from the web UI. Instead, edit the config file at <code>/etc/forgejo/app.ini</code>, and change the <code>HTTP_PORT</code> and <code>SSH_PORT</code> lines. Then, open the corresponding ports in your firewall. The default ports are 3000 for the web UI, and 222 for SSH. For more information on firewall configuration, see [[Firewalling Basics]].

Note that you cannot put the web UI on the same port as Forgejo's SSH access.

== Step 3: Set up 44Net Connect tunnel ==
Set up a single device tunnel on the machine that will host your Forgejo instance. Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel#Tutorials list of single device tunnel tutorials] and follow the one for your operating system.

== Step 4: Validate Forgejo functionality ==
Make sure your Forgejo instance is working by testing a few operations.
=== Create a repository using the web UI ===
Log into Forgejo and go to the Forgejo home page. Click the plus button at the top right, and click "New Repository." Fill in the details (specifics don't matter, since this is a test), and if the repository is successfully created, move on to the next step.

[[File:forgejo_create_repo.png]]

=== Clone the repository over HTTP ===
Copy the HTTP URL from Forgejo, go to your terminal, and run <code>git clone <URL></code>. It should go through "Enumerating objects," "Counting objects," and "Compressing objects" before finishing.

[[File:forgejo_clone_http.png| A screenshot of the HTTP git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]

If the clone completes without error, delete the folder and move on to cloning via SSH. If you get some error such as "Repository not found" or similar, you may have a configuration issue, and should proceed to the troubleshooting section.

=== Clone the repository over SSH ===
Copy the SSH URL from Forgejo, go to your terminal, and run <code>git clone <URL></code>. Just like before, it should go through "Enumerating objects," "Counting objects," and "Compressing objects" before finishing.
[[File:forgejo_clone_ssh.png| A screenshot of the SSH git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]

If the clone completes without error, delete the folder and move on to cloning via SSH. If you get some error such as "Repository not found" or "Permission denied: pubkey," you may have a configuration issue, and should proceed to the troubleshooting section.

=== Make a commit and push it to the remote repository ===
After cloning the repository, make a commit and push it to the remote repository with the following steps:
# Create or modify a file in the repository's folder
# Add your changes with <code>git add <file></code>
# Commit your changes with <code>git commit -m <message></code>
# Push to the remote repository with <code>git push</code>

The push command should proceed through enumerating objects, counting objects, delta compression, compressing objects, and writing objects, then finish. If it throws an error (any line starting with <code>fatal</code>), then you may have a configuration issue and should consult the troubleshooting section. If these are all working, you should be good to go!

== Troubleshooting ==
=== Can't connect to Forgejo web UI ===
* Make sure you're accessing the correct port. Unless you specify the port, your browser will default to port 80 for HTTP or port 443 for HTTPS. The default port for the web UI is 3000.
* Use <code>systemctl status <name of unit></code> to make sure your 44Net Connect tunnel is up. The name of the tunnel's <code>systemd</code> unit should be <code>wg-quick@<name of config file></code>.
* If you're using Docker, make sure your port mappings are correct. Those can be viewed by running <code>sudo docker ps -a</code> to list all containers. Containers created using Docker compose can have their port mappings viewed in their compose file.
* If you're not using Docker, ensure your device firewall has the correct ports open. <code>firewall-cmd</code> users should also make sure their 44Net Connect WireGuard interface is in the correct zone.

=== Can't clone repository over SSH ===
Forgejo does not operate on the same SSH port as your system's <code>sshd</code> server. The default port for Forgejo SSH is 222. Unless you change this to 22 (and move your <code>sshd</code> port somewhere else), you'll have to specify the correct port when cloning the repository. For example, <code>git clone ssh://git@yoursite.org:<port here>/username/repository</code>.

Forgejo

2026-09-15T19:07:57Z

KN6DWI: Instruct users on creating a repository

Forgejo is an open source {{Term|git forge}} that aims to implement {{Term|federation}} using the [https://activitypub.rocks/ ActivityPub] protocol. It can be self-hosted to provide code collaboration services similar to GitHub, such as remote git repositories, issue tracking, and pull/merge requests.

== Step 0 (Optional): Change your SSH to a nonstandard port ==
Git forges provide the ability to interact via HTTP or SSH. If you want users to interact with your Forgejo instance using the standard SSH port, and you have an existing SSH server on the same device, you must move your regular SSH server to another port. Forgejo supports SSH over other ports, but all of your users will have to specify that port in their <code>git clone</code> commands or configure it in their <code>~/.ssh/ssh_config</code> file.

To change your SSH port, edit <code>/etc/ssh/sshd_config</code>, uncomment the line starting with <code>Port</code>, and change the number to something other than 22. Open the corresponding port in your firewall. For more information on firewall configuration, see [[Firewalling Basics]].

== Step 1: Install Forgejo ==
Go to the [https://codeberg.org/forgejo-contrib/delightful-forgejo#packaging delightful forgejo] repository and check whether Forgejo has been packaged for your operating system or distribution. If so, install using your package manager. Otherwise, go to the [https://forgejo.org/docs/latest/admin/installation/ Forgejo installation page](https://forgejo.org/releases/) , decide whether you're going to install from binary or from a docker container, and follow the corresponding instructions. Make sure you complete initial setup before moving to the next step.

== Step 2: Open Forgejo ports in your device firewall ==
If you installed using Docker or Docker Compose, and want to use nonstandard ports, change the Docker port mappings. You will not need to open the ports in your firewall, because Docker port mappings are done via an <code>iptables</code> chain that takes precedence over user-configured rules. This means ports mapped using Docker will be immediately publicly accessible once you enable your 44Net Connect tunnel, so don't enable it until you've completed initial setup.

If you installed Forgejo from a binary, the ports used for the web UI are not editable from the web UI. Instead, edit the config file at <code>/etc/forgejo/app.ini</code>, and change the <code>HTTP_PORT</code> and <code>SSH_PORT</code> lines. Then, open the corresponding ports in your firewall. The default ports are 3000 for the web UI, and 222 for SSH. For more information on firewall configuration, see [[Firewalling Basics]].

Note that you cannot put the web UI on the same port as Forgejo's SSH access.

== Step 3: Set up 44Net Connect tunnel ==
Set up a single device tunnel on the machine that will host your Forgejo instance. Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel#Tutorials list of single device tunnel tutorials] and follow the one for your operating system.

== Step 4: Validate Forgejo functionality ==
Make sure your Forgejo instance is working by testing a few operations.
=== Create a repository using the web UI ===
Log into Forgejo and go to the Forgejo home page. Click the plus button at the top right, and click "New Repository." Fill in the details (specifics don't matter, since this is a test), and if the repository is successfully created, move on to the next step.

[[File:forgejo_create_repo.png]]

=== Clone the repository over HTTP ===
Copy the HTTP URL from Forgejo, go to your terminal, and run <code>git clone <URL></code>. It should go through "Enumerating objects," "Counting objects," and "Compressing objects" before finishing.

[[File:forgejo_clone_http.png| A screenshot of the HTTP git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]

If the clone completes without error, delete the folder and move on to cloning via SSH. If you get some error such as "Repository not found" or similar, you may have a configuration issue, and should proceed to the troubleshooting section.

=== Clone the repository over SSH ===
Copy the SSH URL from Forgejo, go to your terminal, and run <code>git clone <URL></code>. Just like before, it should go through "Enumerating objects," "Counting objects," and "Compressing objects" before finishing.
[[File:forgejo_clone_ssh.png| A screenshot of the SSH git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]

If the clone completes without error, delete the folder and move on to cloning via SSH. If you get some error such as "Repository not found" or "Permission denied: pubkey," you may have a configuration issue, and should proceed to the troubleshooting section.

=== Make a commit and push it to the remote repository ===
* Make a commit on your local repository and push it to the remote repository

If these are all working, you should be good to go!

== Troubleshooting ==
=== Can't connect to Forgejo web UI ===
* Make sure you're accessing the correct port. Unless you specify the port, your browser will default to port 80 for HTTP or port 443 for HTTPS. The default port for the web UI is 3000.
* Use <code>systemctl status <name of unit></code> to make sure your 44Net Connect tunnel is up. The name of the tunnel's <code>systemd</code> unit should be <code>wg-quick@<name of config file></code>.
* If you're using Docker, make sure your port mappings are correct. Those can be viewed by running <code>sudo docker ps -a</code> to list all containers. Containers created using Docker compose can have their port mappings viewed in their compose file.
* If you're not using Docker, ensure your device firewall has the correct ports open. <code>firewall-cmd</code> users should also make sure their 44Net Connect WireGuard interface is in the correct zone.

=== Can't clone repository over SSH ===
Forgejo does not operate on the same SSH port as your system's <code>sshd</code> server. The default port for Forgejo SSH is 222. Unless you change this to 22 (and move your <code>sshd</code> port somewhere else), you'll have to specify the correct port when cloning the repository. For example, <code>git clone ssh://git@yoursite.org:<port here>/username/repository</code>.

File:Forgejo create repo.png

2026-09-15T18:41:18Z

KN6DWI: A screenshot of the Forgejo homepage. The create button and the new repository button are highlighted by red rectangles.

== Summary ==
A screenshot of the Forgejo homepage. The create button and the new repository button are highlighted by red rectangles.

Forgejo

2026-09-15T18:27:26Z

KN6DWI: Split repo cloning into two sections

Forgejo is an open source {{Term|git forge}} that aims to implement {{Term|federation}} using the [https://activitypub.rocks/ ActivityPub] protocol. It can be self-hosted to provide code collaboration services similar to GitHub, such as remote git repositories, issue tracking, and pull/merge requests.

== Step 0 (Optional): Change your SSH to a nonstandard port ==
Git forges provide the ability to interact via HTTP or SSH. If you want users to interact with your Forgejo instance using the standard SSH port, and you have an existing SSH server on the same device, you must move your regular SSH server to another port. Forgejo supports SSH over other ports, but all of your users will have to specify that port in their <code>git clone</code> commands or configure it in their <code>~/.ssh/ssh_config</code> file.

To change your SSH port, edit <code>/etc/ssh/sshd_config</code>, uncomment the line starting with <code>Port</code>, and change the number to something other than 22. Open the corresponding port in your firewall. For more information on firewall configuration, see [[Firewalling Basics]].

== Step 1: Install Forgejo ==
Go to the [https://codeberg.org/forgejo-contrib/delightful-forgejo#packaging delightful forgejo] repository and check whether Forgejo has been packaged for your operating system or distribution. If so, install using your package manager. Otherwise, go to the [https://forgejo.org/docs/latest/admin/installation/ Forgejo installation page](https://forgejo.org/releases/) , decide whether you're going to install from binary or from a docker container, and follow the corresponding instructions. Make sure you complete initial setup before moving to the next step.

== Step 2: Open Forgejo ports in your device firewall ==
If you installed using Docker or Docker Compose, and want to use nonstandard ports, change the Docker port mappings. You will not need to open the ports in your firewall, because Docker port mappings are done via an <code>iptables</code> chain that takes precedence over user-configured rules. This means ports mapped using Docker will be immediately publicly accessible once you enable your 44Net Connect tunnel, so don't enable it until you've completed initial setup.

If you installed Forgejo from a binary, the ports used for the web UI are not editable from the web UI. Instead, edit the config file at <code>/etc/forgejo/app.ini</code>, and change the <code>HTTP_PORT</code> and <code>SSH_PORT</code> lines. Then, open the corresponding ports in your firewall. The default ports are 3000 for the web UI, and 222 for SSH. For more information on firewall configuration, see [[Firewalling Basics]].

Note that you cannot put the web UI on the same port as Forgejo's SSH access.

== Step 3: Set up 44Net Connect tunnel ==
Set up a single device tunnel on the machine that will host your Forgejo instance. Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel#Tutorials list of single device tunnel tutorials] and follow the one for your operating system.

== Step 4: Validate Forgejo functionality ==
Make sure your Forgejo instance is working by testing a few operations.
=== Create a repository using the web UI ===

=== Clone the repository over HTTP ===
Copy the HTTP URL from Forgejo, go to your terminal, and run <code>git clone <URL></code>. It should go through "Enumerating objects," "Counting objects," and "Compressing objects" before finishing.

[[File:forgejo_clone_http.png| A screenshot of the HTTP git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]

If the clone completes without error, delete the folder and move on to cloning via SSH. If you get some error such as "Repository not found" or similar, you may have a configuration issue, and should proceed to the troubleshooting section.

=== Clone the repository over SSH ===
Copy the SSH URL from Forgejo, go to your terminal, and run <code>git clone <URL></code>. Just like before, it should go through "Enumerating objects," "Counting objects," and "Compressing objects" before finishing.
[[File:forgejo_clone_ssh.png| A screenshot of the SSH git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]

If the clone completes without error, delete the folder and move on to cloning via SSH. If you get some error such as "Repository not found" or "Permission denied: pubkey," you may have a configuration issue, and should proceed to the troubleshooting section.

=== Make a commit and push it to the remote repository ===
* Make a commit on your local repository and push it to the remote repository

If these are all working, you should be good to go!

== Troubleshooting ==
=== Can't connect to Forgejo web UI ===
* Make sure you're accessing the correct port. Unless you specify the port, your browser will default to port 80 for HTTP or port 443 for HTTPS. The default port for the web UI is 3000.
* Use <code>systemctl status <name of unit></code> to make sure your 44Net Connect tunnel is up. The name of the tunnel's <code>systemd</code> unit should be <code>wg-quick@<name of config file></code>.
* If you're using Docker, make sure your port mappings are correct. Those can be viewed by running <code>sudo docker ps -a</code> to list all containers. Containers created using Docker compose can have their port mappings viewed in their compose file.
* If you're not using Docker, ensure your device firewall has the correct ports open. <code>firewall-cmd</code> users should also make sure their 44Net Connect WireGuard interface is in the correct zone.

=== Can't clone repository over SSH ===
Forgejo does not operate on the same SSH port as your system's <code>sshd</code> server. The default port for Forgejo SSH is 222. Unless you change this to 22 (and move your <code>sshd</code> port somewhere else), you'll have to specify the correct port when cloning the repository. For example, <code>git clone ssh://git@yoursite.org:<port here>/username/repository</code>.

Forgejo

2026-09-15T18:26:55Z

KN6DWI: Described steps for cloning repository

Forgejo is an open source {{Term|git forge}} that aims to implement {{Term|federation}} using the [https://activitypub.rocks/ ActivityPub] protocol. It can be self-hosted to provide code collaboration services similar to GitHub, such as remote git repositories, issue tracking, and pull/merge requests.

== Step 0 (Optional): Change your SSH to a nonstandard port ==
Git forges provide the ability to interact via HTTP or SSH. If you want users to interact with your Forgejo instance using the standard SSH port, and you have an existing SSH server on the same device, you must move your regular SSH server to another port. Forgejo supports SSH over other ports, but all of your users will have to specify that port in their <code>git clone</code> commands or configure it in their <code>~/.ssh/ssh_config</code> file.

To change your SSH port, edit <code>/etc/ssh/sshd_config</code>, uncomment the line starting with <code>Port</code>, and change the number to something other than 22. Open the corresponding port in your firewall. For more information on firewall configuration, see [[Firewalling Basics]].

== Step 1: Install Forgejo ==
Go to the [https://codeberg.org/forgejo-contrib/delightful-forgejo#packaging delightful forgejo] repository and check whether Forgejo has been packaged for your operating system or distribution. If so, install using your package manager. Otherwise, go to the [https://forgejo.org/docs/latest/admin/installation/ Forgejo installation page](https://forgejo.org/releases/) , decide whether you're going to install from binary or from a docker container, and follow the corresponding instructions. Make sure you complete initial setup before moving to the next step.

== Step 2: Open Forgejo ports in your device firewall ==
If you installed using Docker or Docker Compose, and want to use nonstandard ports, change the Docker port mappings. You will not need to open the ports in your firewall, because Docker port mappings are done via an <code>iptables</code> chain that takes precedence over user-configured rules. This means ports mapped using Docker will be immediately publicly accessible once you enable your 44Net Connect tunnel, so don't enable it until you've completed initial setup.

If you installed Forgejo from a binary, the ports used for the web UI are not editable from the web UI. Instead, edit the config file at <code>/etc/forgejo/app.ini</code>, and change the <code>HTTP_PORT</code> and <code>SSH_PORT</code> lines. Then, open the corresponding ports in your firewall. The default ports are 3000 for the web UI, and 222 for SSH. For more information on firewall configuration, see [[Firewalling Basics]].

Note that you cannot put the web UI on the same port as Forgejo's SSH access.

== Step 3: Set up 44Net Connect tunnel ==
Set up a single device tunnel on the machine that will host your Forgejo instance. Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel#Tutorials list of single device tunnel tutorials] and follow the one for your operating system.

== Step 4: Validate Forgejo functionality ==
Make sure your Forgejo instance is working by testing a few operations.
=== Create a repository using the web UI ===

=== Clone the repository ===
Copy the HTTP URL from Forgejo, go to your terminal, and run <code>git clone <URL></code>. It should go through "Enumerating objects," "Counting objects," and "Compressing objects" before finishing.

[[File:forgejo_clone_http.png| A screenshot of the HTTP git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]

If the clone completes without error, delete the folder and move on to cloning via SSH. If you get some error such as "Repository not found" or similar, you may have a configuration issue, and should proceed to the troubleshooting section.

Copy the SSH URL from Forgejo, go to your terminal, and run <code>git clone <URL></code>. Just like before, it should go through "Enumerating objects," "Counting objects," and "Compressing objects" before finishing.
[[File:forgejo_clone_ssh.png| A screenshot of the SSH git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]

If the clone completes without error, delete the folder and move on to cloning via SSH. If you get some error such as "Repository not found" or "Permission denied: pubkey," you may have a configuration issue, and should proceed to the troubleshooting section.

=== Make a commit and push it to the remote repository ===
* Make a commit on your local repository and push it to the remote repository

If these are all working, you should be good to go!

== Troubleshooting ==
=== Can't connect to Forgejo web UI ===
* Make sure you're accessing the correct port. Unless you specify the port, your browser will default to port 80 for HTTP or port 443 for HTTPS. The default port for the web UI is 3000.
* Use <code>systemctl status <name of unit></code> to make sure your 44Net Connect tunnel is up. The name of the tunnel's <code>systemd</code> unit should be <code>wg-quick@<name of config file></code>.
* If you're using Docker, make sure your port mappings are correct. Those can be viewed by running <code>sudo docker ps -a</code> to list all containers. Containers created using Docker compose can have their port mappings viewed in their compose file.
* If you're not using Docker, ensure your device firewall has the correct ports open. <code>firewall-cmd</code> users should also make sure their 44Net Connect WireGuard interface is in the correct zone.

=== Can't clone repository over SSH ===
Forgejo does not operate on the same SSH port as your system's <code>sshd</code> server. The default port for Forgejo SSH is 222. Unless you change this to 22 (and move your <code>sshd</code> port somewhere else), you'll have to specify the correct port when cloning the repository. For example, <code>git clone ssh://git@yoursite.org:<port here>/username/repository</code>.

Forgejo

2026-09-14T23:24:23Z

KN6DWI: Insert repo clone URL screenshots

Forgejo is an open source {{Term|git forge}} that aims to implement {{Term|federation}} using the [https://activitypub.rocks/ ActivityPub] protocol. It can be self-hosted to provide code collaboration services similar to GitHub, such as remote git repositories, issue tracking, and pull/merge requests.

== Step 0 (Optional): Change your SSH to a nonstandard port ==
Git forges provide the ability to interact via HTTP or SSH. If you want users to interact with your Forgejo instance using the standard SSH port, and you have an existing SSH server on the same device, you must move your regular SSH server to another port. Forgejo supports SSH over other ports, but all of your users will have to specify that port in their <code>git clone</code> commands or configure it in their <code>~/.ssh/ssh_config</code> file.

To change your SSH port, edit <code>/etc/ssh/sshd_config</code>, uncomment the line starting with <code>Port</code>, and change the number to something other than 22. Open the corresponding port in your firewall. For more information on firewall configuration, see [[Firewalling Basics]].

== Step 1: Install Forgejo ==
Go to the [https://codeberg.org/forgejo-contrib/delightful-forgejo#packaging delightful forgejo] repository and check whether Forgejo has been packaged for your operating system or distribution. If so, install using your package manager. Otherwise, go to the [https://forgejo.org/docs/latest/admin/installation/ Forgejo installation page](https://forgejo.org/releases/) , decide whether you're going to install from binary or from a docker container, and follow the corresponding instructions. Make sure you complete initial setup before moving to the next step.

== Step 2: Open Forgejo ports in your device firewall ==
If you installed using Docker or Docker Compose, and want to use nonstandard ports, change the Docker port mappings. You will not need to open the ports in your firewall, because Docker port mappings are done via an <code>iptables</code> chain that takes precedence over user-configured rules. This means ports mapped using Docker will be immediately publicly accessible once you enable your 44Net Connect tunnel, so don't enable it until you've completed initial setup.

If you installed Forgejo from a binary, the ports used for the web UI are not editable from the web UI. Instead, edit the config file at <code>/etc/forgejo/app.ini</code>, and change the <code>HTTP_PORT</code> and <code>SSH_PORT</code> lines. Then, open the corresponding ports in your firewall. The default ports are 3000 for the web UI, and 222 for SSH. For more information on firewall configuration, see [[Firewalling Basics]].

Note that you cannot put the web UI on the same port as Forgejo's SSH access.

== Step 3: Set up 44Net Connect tunnel ==
Set up a single device tunnel on the machine that will host your Forgejo instance. Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel#Tutorials list of single device tunnel tutorials] and follow the one for your operating system.

== Step 4: Validate Forgejo functionality ==
Make sure your Forgejo instance is working by testing a few operations.
=== Create a repository using the web UI ===

=== Clone the repository ===
* Clone the repository using HTTP
[[File:forgejo_clone_http.png| A screenshot of the HTTP git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]
* Clone the repository using SSH
[[File:forgejo_clone_ssh.png| A screenshot of the SSH git clone URL on a forgejo repository. The repository being cloned is KN6DWI/torment-nexus.git.]]

=== Make a commit and push it to the remote repository ===
* Make a commit on your local repository and push it to the remote repository

If these are all working, you should be good to go!

== Troubleshooting ==
=== Can't connect to Forgejo web UI ===
* Make sure you're accessing the correct port. Unless you specify the port, your browser will default to port 80 for HTTP or port 443 for HTTPS. The default port for the web UI is 3000.
* Use <code>systemctl status <name of unit></code> to make sure your 44Net Connect tunnel is up. The name of the tunnel's <code>systemd</code> unit should be <code>wg-quick@<name of config file></code>.
* If you're using Docker, make sure your port mappings are correct. Those can be viewed by running <code>sudo docker ps -a</code> to list all containers. Containers created using Docker compose can have their port mappings viewed in their compose file.
* If you're not using Docker, ensure your device firewall has the correct ports open. <code>firewall-cmd</code> users should also make sure their 44Net Connect WireGuard interface is in the correct zone.

=== Can't clone repository over SSH ===
Forgejo does not operate on the same SSH port as your system's <code>sshd</code> server. The default port for Forgejo SSH is 222. Unless you change this to 22 (and move your <code>sshd</code> port somewhere else), you'll have to specify the correct port when cloning the repository. For example, <code>git clone ssh://git@yoursite.org:<port here>/username/repository</code>.

File:Forgejo clone ssh.png

2026-09-14T23:23:58Z

KN6DWI: A screenshot of the SSH git clone URL on a forgejo repository.

== Summary ==
A screenshot of the SSH git clone URL on a forgejo repository.

File:Forgejo clone http.png

2026-09-14T23:18:19Z

KN6DWI: A screenshot of the HTTP git clone URL on a forgejo repository.

== Summary ==
A screenshot of the HTTP git clone URL on a forgejo repository.

Forgejo

2026-09-14T23:13:27Z

KN6DWI: Created sections

Forgejo

2026-09-14T22:47:50Z

KN6DWI: Wrote troubleshooting instructions

Forgejo

2026-09-14T22:30:53Z

KN6DWI: Instruct user on test operations

Forgejo

2026-09-14T22:28:11Z

KN6DWI: Edited title to specify device firewall rather than network firewall

Forgejo

2026-09-14T22:22:41Z

KN6DWI: Instruct people to find the single device tunnel tutorial for their OS

Forgejo

2026-09-11T01:43:41Z

KN6DWI: Instruct users on opening Forgejo ports in their firewall

Forgejo

2026-09-10T23:50:19Z

KN6DWI: Tell users they can't put the web UI and Forgejo SSH on the same port

Forgejo

2026-09-10T23:36:38Z

KN6DWI: Describe editing Docker port mappings

Forgejo

2026-09-10T00:37:57Z

KN6DWI: Instructed users to check for package manager packages first, otherwise install binary manually or use docker.

Direwolf

2026-09-10T00:25:04Z

KN6DWI: Mentioned AGW clients in intro paragraph

Direwolf is a piece of software used to decode and encode {{Term|APRS}} packets, commonly called a terminal node controller (TNC). A computer running Direwolf can be paired with a transceiver to transmit, receive, and digipeat APRS packets on the air. It can be used on its own or with a KISS or AGW client. This is a tutorial on setting up Direwolf for remote access via a 44Net Connect tunnel.

Prerequisites:
* 44Net Portal account
* Verified callsign
* 44Net Connect tunnel configuration file (for your Direwolf device)
* Either a client with a static IP or another 44Net Connect tunnel configuration file for your client

== Security and Limitations ==
Neither Direwolf or the KISS protocol directly support any kind of authentication. Though some AGW clients such as Xastir support password protection, Direwolf does not support configuring a password for its AGW interface.<ref name="agw-groupsio">[https://groups.io/g/direwolf/topic/password_in_agw_interface/34951469 Password in agw interface - Direwolf Groups.io]</ref> Securing Direwolf against unauthorized access is done via IP whitelisting in this guide, so providing access to people without access to a static IP (through 44Net or otherwise) is out of scope.

== Step 1: Install and configure Direwolf ==
Consult the [https://github.com/wb2osz/direwolf Direwolf README] for installation instructions. The instructions state that the <code>direwolf.conf</code> file will be automatically created in your home directory, but this is not always the case. If the config file is not automatically created, a working Linux configuration can be found in [https://n3emc.com/aprs-digipeater-and-igate-with-direwolf/ N3EMC's digipeater tutorial].

=== Configure sound card ===
Next, plug in your USB sound card if you're using one. (This section applies whether you're using a USB sound card or a built-in one.) then open a terminal and run <code>arecord -l</code> to list your audio devices. The output will look like this:
<nowiki>
**** List of CAPTURE Hardware Devices ****
card 1: Device [USB Audio Device], device 0: USB Audio [USB Audio]
Subdevices: 0/1
Subdevice #0: subdevice #0</nowiki>

Record the card number (in this case card 1) and the device number (in this case card 2). Edit the line in <code>direwolf.conf</code> that starts with <code>ADEVICE</code>. By default, the line might look like this:

<code>ADEVICE plughw:0,0</code>

Replace the first number with your card number, and the second with your device number. For our example with card 1 and device 0, the line should now look like this:

<code>ADEVICE plughw:1,0</code>

=== Configure callsign ===
Go to the configuration line beginning with <code>MYCALL</code> and fill in your callsign there. It may optionally be followed by a Sub-Station Identifier (SSID), which consists of a dash and a number. These are commonly used to differentiate multiple pieces of equipment owned by the same person. N3EMC says that <code>10</code> is commonly used for digipeaters and iGates, so a person with the callsign <code>N0CALL</code> may write the config line like this:

<code>MYCALL N0CALL-10</code>

=== Configure iGate login ===
To enable iGate functionality, you must configure your iGate server and login. The server is configured using the line starting with <code>IGSERVER</code>. Select your server from the following:<ref>https://www.aprs-is.net/APRSServers.aspx</ref>

* Worldwide: <code>rotate.aprs2.net</code>
* North America: <code>noam.aprs2.net</code>
* South America: <code>soam.aprs2.net</code>
* Europe/Africa: <code>euro.aprs2.net</code>
* Asia: <code>asia.aprs2.net</code>
* Oceania: <code>aunz.aprs2.net</code>

For example, North American users should have the config line <code>IGSERVER noam.aprs2.net</code>.

== Step 2: Configure your firewall ==
For security purposes, it's important to configure your firewall ''before'' exposing your device to the internet.
Install your firewall of choice, and open port 8000 for an AGW client, and 8001 for the KISS client. Ensure other ports are closed, unless you have services that you want to be accessible. See [[Firewalling Basics]] for more information.

== Step 3: Set up 44Net Connect tunnel ==
Set up a single device tunnel on the machine that will host your Direwolf server. Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel#Tutorials list of single device tunnel tutorials] and follow the one for your operating system. Before starting the tunnel, you'll need to modify your configuration. Modify the <code>AllowedIPs</code> line so that it contains only the static IPs of your clients, each followed by <code>/32</code> to indicate that this is a single IP rather than a subnet. This is the method by which access to your Direwolf instance is controlled. Example:

<nowiki>AllowedIPs = 44.27.133.290/32</nowiki>

== Step 4: Set up client ==
Install a KISS or AGW client of your choice, such as [https://github.com/vash909/PyttiAPRS PyttiAPRS] or [https://github.com/Xastir/Xastir Xastir], and point it at the 44Net IPv4 address of the device running Direwolf. You can obtain this address from the <code>[Interface]</code> section of that device's WireGuard config, or you can run the <code>ifconfig</code> command on that device and look for the WireGuard interface. If it asks for port configuration, use port 8000 for AGW and port 8001 for KISS.

== Step 5: Verify IP whitelist configuration ==
To verify that the WireGuard configuration is correctly blocking access from unauthorized parties, try connecting to Direwolf from an IP address that's not whitelisted. If your typical connection method uses another 44Net Connect tunnel on the client device, try turning it off. If you've whitelisted a static IP tied to your current network, you could go to a cafe and use their internet. Use <code>curl connect.44net.cloud/myip</code> to verify that your IP has changed, then attempt to connect. You should ''not'' be able to connect from a non-whitelisted IP. If you are able to connect, your WireGuard {{Term|AllowedIPs}} may not be correctly configured.

== Troubleshooting ==
=== Can't connect to Direwolf ===
* Ensure that ports 8000 and 8001 are open in your firewall.
* If you are unsure whether your client is behind a firewall whose egress filtering is preventing connection, you can open listeners on ports 8000 and 8001 to see if your connection is making it there at all.
** This will require closing Direwolf for the duration of the test.
** Open a listener with <code>netcat</code> using the following command: <code>nc -l -p <port></code>
** After opening the listeners on ports 8000 and 8001, attempt to connect with your client. If the listeners don't show any activity, your connection attempt is not making it to the server.

=== Direwolf isn't receiving any packets ===
* Check your physical connections between the radio and sound card.
* Make sure your radio's audio and RF gain are adjusted so that Direwolf is receiving sound at the correct level. (Direwolf will warn you about audio that's too loud, but not too quiet.)
* Make sure receive tone squelch is disabled on your radio, and that it's tuned to the correct frequency.
* It can be helpful to use a second radio for troubleshooting, either to monitor the APRS frequency for when packets should appear, or to send test packets.

== References ==
=== Footnotes ===
<references />

=== Other References ===
* [https://github.com/wb2osz/direwolf/tree/master/doc Direwolf documentation]
* [https://themodernham.com/easy-aprs-igate-and-digipeater-setup-with-direwolf/ Easy APRS iGate and Digipeater Setup with Direwolf - themodernham]
* [https://n3emc.com/aprs-digipeater-and-igate-with-direwolf/ APRS Digitpeater and iGate with Direwolf]

[[Category:Use Cases]]
[[Category:How-To]]

Forgejo

2026-09-10T00:23:17Z

KN6DWI: Created more headers

Forgejo

2026-09-10T00:08:34Z

KN6DWI: Created sections

Forgejo

2026-09-09T23:27:22Z

KN6DWI: Described changing SSH to nonstandard port