44Net Wiki - Recent changes [en]

MediaWiki:Common.css

KI5QKX — Tue, 06 Oct 2026 03:12:03 GMT

Allow Vector header to fit mobile screen widths

← Older revision		Revision as of 03:12, 6 October 2026
Line 1:		Line 1:
	/* CSS placed here will be applied to all skins */		/* CSS placed here will be applied to all skins */

			/* Let the Vector header fit mobile screens below its 500px minimum. */
			@media screen and (max-width: 999px) {
			.skin-vector-2022.skin--responsive .vector-header-container .mw-header {
			min-width: 0;
			}
			}

	/* Keep images from escaping their enclosures */		/* Keep images from escaping their enclosures */

AllStarLink

KN6DWI — Fri, 02 Oct 2026 23:13:46 GMT

Described necessary systemd unit (but not included yet bc the unit is WIP)

@@ Line 2: / Line 2: @@
 == Step 1: Sign up for AllStarLink ==
-Follow AllStarLink's [instructions for the sign up process](https://allstarlink.github.io/basics/portal/). They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.
+Follow AllStarLink's [https://allstarlink.github.io/basics/portal/ instructions for the sign up process]. They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.
 During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.
@@ Line 12: / Line 12: @@
 === Raspberry Pi Appliance ===
-To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.]
+To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.] This guide is primarily for flashing a fresh image on your Pi. If you want to add an ASL3 appliance to an existing Pi, follow the steps for the Debian appliance.
 === Debian PC or Appliance ===
@@ Line 18: / Line 18: @@
 == Step 3: Configure firewall ==
 == Step 4: Enable 44Net Connect tunnel ==
 [[Category:Use Cases]]
 [[Category:How-To]]

Talk:AllStarLink

KN6DWI — Wed, 30 Sep 2026 23:07:01 GMT

Created page

New page

This page serves primarily to index AllStarLink's guides. They're very good, but indexed rather weirdly. There's no central index page, but they can be accessed from the sidebar on https://allstarlink.github.io/.

AllStarLink

KN6DWI — Wed, 30 Sep 2026 22:58:38 GMT

Added links to Pi and Debian guides

← Older revision		Revision as of 22:58, 30 September 2026
Line 9:		Line 9:

	== Step 2: Install AllStarLink ==		== Step 2: Install AllStarLink ==
	AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation.		AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes the same, and additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation, which lets you preload Wi-Fi configuration. It also supports managing the Pi's serial port at <code>/dev/serial0</code>, as well as using the GPIO pins for PTT triggering. The Pi image keeps logs and temp files only in memory to reduce writes to the SD card.

			=== Raspberry Pi Appliance ===
			To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.]

			=== Debian PC or Appliance ===
			To install ASL3 on Debian, via any of <code>asl3-appliance</code>, <code>asl3-appliance-pc</code>, or a non-appliance Debian install (<code>asl3</code>), follow [https://allstarlink.github.io/install/debian/install/ the ASL3 Debian install guide.] It covers all three methods, and notes each point where the installation methods diverge.

	== Step 3: Configure firewall ==		== Step 3: Configure firewall ==

MediaWiki:Common.css

KI5QKX — Wed, 30 Sep 2026 22:43:27 GMT

mw push

← Older revision		Revision as of 22:43, 30 September 2026
Line 129:		Line 129:

	.mw-page-deck {		.mw-page-deck {
	font-size: ~~2em~~;		font-size: 1.8em;
	font-weight: 100;		font-weight: 100;
	line-height: 1.55;		line-height: 1.55;

Template:Deck

KI5QKX — Wed, 30 Sep 2026 22:42:05 GMT

mw push

New page

Main Page

KI5QKX — Wed, 30 Sep 2026 22:41:40 GMT

mw push

← Older revision		Revision as of 22:41, 30 September 2026
Line 4:		Line 4:
	{{Lead\|44Net is a community of licensed radio amateurs using Public IP addresses to build networks.}}		{{Lead\|44Net is a community of licensed radio amateurs using Public IP addresses to build networks.}}

	Connect a Raspberry Pi, run services for your club, or build a network. 44Net provides free IP address resources for licensed radio amateurs, with several ways to put them to use.		{{Deck\|Connect a Raspberry Pi, run services for your club, or build a network. 44Net provides free IP address resources for licensed radio amateurs, with several ways to put them to use.

	You can connect through an existing network or project, or obtain addresses and arrange your own routing.		You can connect through an existing network or project, or obtain addresses and arrange your own routing.}}

	'''[[#Find a way to connect\|Explore ways to connect]]''' · '''[[#Build with 44Net resources\|Get address resources]]'''		'''[[#Find a way to connect\|Explore ways to connect]]''' · '''[[#Build with 44Net resources\|Get address resources]]'''

MediaWiki:Common.css

KI5QKX — Wed, 30 Sep 2026 22:41:39 GMT

mw push

← Older revision		Revision as of 22:41, 30 September 2026
Line 121:		Line 121:

	.mw-page-lead {		.mw-page-lead {
	font-size: 1.~~9em~~;		font-size: 3em;
			font-weight: 100;
			line-height: 1.55;
			color: #444;
			margin: 0 0 0.8em 0;
			}

			.mw-page-deck {
			font-size: 2em;
	font-weight: 100;		font-weight: 100;
	line-height: 1.55;		line-height: 1.55;

Main Page

KI5QKX — Wed, 30 Sep 2026 22:38:41 GMT

mw push

← Older revision		Revision as of 22:38, 30 September 2026
(2 intermediate revisions by the same user not shown)
Line 2:		Line 2:
	__NOTOC__		__NOTOC__

	{{Lead\|Public IP addresses ~~for amateur radio projects~~}}		{{Lead\|44Net is a community of licensed radio amateurs using Public IP addresses to build networks.}}

	Connect a Raspberry Pi, run services for your club, or build a network. 44Net provides free IP address resources for licensed radio amateurs, with several ways to put them to use.		Connect a Raspberry Pi, run services for your club, or build a network. 44Net provides free IP address resources for licensed radio amateurs, with several ways to put them to use.
Line 11:		Line 11:

	{{Section\|variant=secondary\|		{{Section\|variant=secondary\|
	== Find a way to connect ==		=== Find a way to connect ===

	{{SectionLayout\|min=16rem\|gap=0.75rem\|		{{SectionLayout\|min=16rem\|gap=0.75rem\|
	{{SectionCard\|		{{SectionCard\|
	=== 44Net Connect ===		==== 44Net Connect ====
	'''Public IP addresses for your devices and networks'''		'''Public IP addresses for your devices and networks'''

	Use a WireGuard tunnel over your existing internet connection to ~~give your Raspberry Pi, computer, or network~~ a public 44Net address.		Use a WireGuard tunnel over your existing internet connection to get a public 44Net address for your project.

	[[44Net Connect\|Get started with Connect →]]		[[44Net Connect\|Get started with Connect →]]
Line 24:		Line 24:

	{{SectionCard\|		{{SectionCard\|
	=== IPIP Mesh ===		==== IPIP Mesh ====
	'''Connect with other participating amateur networks'''		'''Connect with other participating amateur networks'''

Line 33:		Line 33:

	{{SectionCard\|		{{SectionCard\|
	=== ~~Networks and community~~ projects ===		==== Community projects ====
	'''Find something interesting to join, use, or help build'''		'''Find something interesting to join, use, or help build'''

Line 57:		Line 57:
	{{SectionCard\|		{{SectionCard\|
	=== Routing and BGP ===		=== Routing and BGP ===
	Arrange ~~for your upstream provider or your own network~~ to announce your assigned addresses.		Arrange to announce your assigned addresses directly to the Internet.

	[[BGP\|Using 44Net with your provider →]]		[[BGP\|Using 44Net with your provider →]]
Line 79:		Line 79:

	{{Section\|variant=secondary\|		{{Section\|variant=secondary\|
	== Already participating? ==		=== Already participating? ===
	[https://portal.ampr.org/ Open the Portal] to manage your account, assignments, and records.		[https://portal.ampr.org/ Open the Portal] to manage your account, assignments, and records.

Internet Requirements

KI5QKX — Wed, 30 Sep 2026 22:33:04 GMT

mw push

← Older revision		Revision as of 22:33, 30 September 2026
Line 5:		Line 5:
	== 44Net Connect ==		== 44Net Connect ==

	44Net Connect is the most flexible way to get 44Net onto your device. It works over pretty much any Internet connection that allows outbound UDP traffic, and it can handle changes in your IP address or network seamlessly, which is helpful for devices that roam or change networks.		44Net Connect is the most flexible way to get 44Net onto your device. It works over pretty much any Internet connection that allows outbound UDP traffic, and it can handle changes in your IP address or network seamlessly, which is helpful for devices that roam or change networks.

	It can work over home broadband, cellular, satellite, and public Wi-Fi. It can also work behind NAT and CGNAT, and even on some connections that block VPN traffic.		It can work over home broadband, cellular, satellite, and public Wi-Fi. It can also work behind NAT and CGNAT, and even on some connections that block VPN traffic.
Line 19:		Line 19:
	==== Inbound access ====		==== Inbound access ====

	For IPIP Mesh to work, your Internet connection and all intermediate devices, including ISP-provided equipment, must allow:		For IPIP Mesh to work, your Internet connection and all intermediate devices, including ISP-provided equipment, must allow IP-in-IP traffic (IP protocol 4).
	* IP-in-IP traffic (~~ipencap~~ protocol 4)
	* RIPv2 packets ~~arriving~~ on UDP port 520		If you use RIP route updates, your gateway must accept the RIPv2 packets on UDP port 520 inside the IPIP tunnel. This does not require opening UDP port 520 on your public Internet connection. See [[IPIP Mesh/Firewalls\|Mesh firewall guidance]].

	==== Public IP address ====		==== Public IP address ====
Line 39:		Line 39:
	Announcing via BGP is the most advanced way to get 44Net onto your network.		Announcing via BGP is the most advanced way to get 44Net onto your network.

	For running a router on your premises, you will need a connection to a provider willing to handle your subnet.		For running a router on your premises, you will need a connection to a provider willing to handle your subnet.

	To announce your subnet from a cloud provider, you will need a provider that supports BYOIP (Bring Your Own IP) and accepts 44Net subnets. In particular, the provider must allow you to announce your subnet [[RPKI and ROAs on 44Net\|without RPKI ROAs.]]		To announce your subnet from a cloud provider, you will need a provider that supports BYOIP (Bring Your Own IP) and accepts 44Net subnets. In particular, the provider must allow you to announce your subnet [[RPKI and ROAs on 44Net\|without RPKI ROAs.]]
Line 47:		Line 47:
	== Speed and quality ==		== Speed and quality ==

	The speed and quality of service required depends on the intended use of your connection. The WireGuard protocol used by 44Net Connect is designed to be efficient and resilient, and the link itself usually tolerates variable connection quality. The application running over the link may be ~~more~~ more sensitive, however, including things like streaming, voice, remote desktop, or video.		The speed and quality of service required depends on the intended use of your connection. The WireGuard protocol used by 44Net Connect is designed to be efficient and resilient, and the link itself usually tolerates variable connection quality. The application running over the link may be more sensitive, however, including things like streaming, voice, remote desktop, or video.

	For example, a typical VOIP call generally needs only about 64kbps of bandwidth, so high speeds are not usually necessary for voice applications like IRLP, Allstar, or DMR. LTE or Starlink standby mode may be more than sufficient. Voice applications are sometimes sensitive to packet loss, jitter, and latency, however, so an unstable or marginal connection may work fine or it might not.		For example, a typical VOIP call generally needs only about 64kbps of bandwidth, so high speeds are not usually necessary for voice applications like IRLP, Allstar, or DMR. LTE or Starlink standby mode may be more than sufficient. Voice applications are sometimes sensitive to packet loss, jitter, and latency, however, so an unstable or marginal connection may work fine or it might not.
Line 62:		Line 62:

	=== Am I on CGNAT? ===		=== Am I on CGNAT? ===
	You can check whether you might be behind CGNAT using an online tool like [https://portwarp.com/tools/cgnat-detector PortWarp CGNAT Detector]. If you are behind CGNAT, you will not be able to participate in the IPIP Mesh or announce your own subnet via BGP, so ~~it'll~~ be 44Net Connect or nothing for you.		You can check whether you might be behind CGNAT using an online tool like [https://portwarp.com/tools/cgnat-detector PortWarp CGNAT Detector]. If you are behind CGNAT, you will not be able to participate in the IPIP Mesh or announce your own subnet via BGP, so it’ll be 44Net Connect or nothing for you.

IPIP Mesh

KI5QKX — Wed, 30 Sep 2026 22:33:03 GMT

mw push

@@ Line 1: / Line 1: @@
-{{DISPLAYTITLE:IPIP Mesh (Stub)}}
+{{DISPLAYTITLE:IPIP Mesh}}
-== What this page is ==
+The IPIP Mesh connects participating amateur radio networks through tunnels over the Internet. You operate a gateway that exchanges traffic between your 44Net network and other participants’ gateways serving their 44Net networks. These may be single systems, home or club LANs, or larger networks.
-== Start here ==
+You can use the Mesh to reach other participants’ services, share your own, and generally experiment with networking.
-== Existing documentation ==
+ARDC supports the project and operates a gateway that provides connectivity between the Mesh and the Internet. Each participant is responsible for their own gateway and its operation.
 These pages cover mesh gateways, setup, and routing. Some guides describe older systems and have not been revalidated.
@@ Line 45: / Line 81: @@
 * [[IPIP Mesh/OH7LZB VPN|OH7LZB VPN]] (reported unavailable since May 2024)
 [[Category:Explanation]]
 [[Category:Participation Methods]]
 [[Category:IPIP Mesh]]

IPIP Mesh/Quick Start

KI5QKX — Wed, 30 Sep 2026 22:33:03 GMT

mw push

← Older revision		Revision as of 22:33, 30 September 2026
Line 31:		Line 31:

	== Older docs and notes ==		== Older docs and notes ==
	See [[IPIP Mesh#~~Existing documentation~~\|the IPIP Mesh documentation directory]] for platform guides and routing tools. Earlier pages that may still be useful:		See [[IPIP Mesh#Guides and reference\|the IPIP Mesh documentation directory]] for platform guides and routing tools. Earlier pages that may still be useful:
	* [[IPIP Mesh/Gateways\|Gateway]]		* [[IPIP Mesh/Gateways\|Gateway]]
	* [[IPIP Mesh/Registering Your Gateway\|Registering Your Gateway]]		* [[IPIP Mesh/Registering Your Gateway\|Registering Your Gateway]]

44Net Connect

KI5QKX — Wed, 30 Sep 2026 22:33:03 GMT

mw push

Show changes

Main Page

KI5QKX — Wed, 30 Sep 2026 22:33:02 GMT

mw push

Show changes

AllStarLink

KN6DWI — Wed, 30 Sep 2026 19:07:52 GMT

Started ASL installation instructions

← Older revision		Revision as of 19:07, 30 September 2026
(3 intermediate revisions by the same user not shown)
Line 1:		Line 1:
	AllStarLink is an open source<ref>The ASL3 source is [https://github.com/AllStarLink/ASL3 available on GitHub], though installing from source is not recommended.</ref> internet repeater linking system that uses the Asterisk PBX software internally, and provides a web interface for management. It can be used both for connecting repeaters to the internet and for creating reflectors that internet-linked repeaters can connect to. An AllStarLink installation consists of multiple pieces of software: The Asterisk PBX, the app_rpt application made by AllStarLink, and the Allmon3 web interface.		AllStarLink is an open source<ref>The ASL3 source is [https://github.com/AllStarLink/ASL3 available on GitHub], though installing from source is not recommended.</ref> internet repeater linking system that uses the Asterisk PBX software internally, and provides a web interface for management. It can be used both for connecting repeaters to the internet and for creating reflectors that internet-linked repeaters can connect to. An AllStarLink installation consists of multiple pieces of software: The Asterisk PBX, the app_rpt application made by AllStarLink, and the Allmon3 web interface.

	== Step 1: Sign up for ~~an AllStar Account~~ ==		== Step 1: Sign up for AllStarLink ==
	~~== Step 2~~: ~~Create~~ a server ==		Follow AllStarLink's [instructions for the sign up process](https://allstarlink.github.io/basics/portal/). They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.
	~~== Step 3~~: ~~Create a node ==~~
	== Step 4: Install AllStarLink ==		During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.
	== Step 5: Configure firewall ==
	== Step 6: Enable 44Net Connect tunnel ==		Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is <code>4569</code>.

			== Step 2: Install AllStarLink ==
			AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation.

			== Step 3: Configure firewall ==
			== Step 4: Enable 44Net Connect tunnel ==

	[[Category:Use Cases]]		[[Category:Use Cases]]
	[[Category:How-To]]		[[Category:How-To]]

Talk:AMPRNet VPN

KI5QKX — Tue, 29 Sep 2026 19:28:03 GMT

Organize remaining IPIP Mesh articles and navigation

← Older revision		Revision as of 19:28, 29 September 2026
Line 1:		Line 1:
	#REDIRECT [[Talk:OH7LZB VPN]]		#REDIRECT [[Talk:IPIP Mesh/OH7LZB VPN]]

Archive/Home

KI5QKX — Tue, 29 Sep 2026 19:28:02 GMT

Organize remaining IPIP Mesh articles and navigation

← Older revision		Revision as of 19:28, 29 September 2026
Line 32:		Line 32:
	* Instructions for [[IPIP Mesh/Ubiquiti EdgeRouter with ampr-ripd\|Installing ampr-ripd on a Ubiquiti EdgeRouter or EdgeRouter X]].		* Instructions for [[IPIP Mesh/Ubiquiti EdgeRouter with ampr-ripd\|Installing ampr-ripd on a Ubiquiti EdgeRouter or EdgeRouter X]].
	* Instructions for [[Announcing_your_allocation_directly\|directly announcing your assignment via your Internet Service Provider (ISP)]].		* Instructions for [[Announcing_your_allocation_directly\|directly announcing your assignment via your Internet Service Provider (ISP)]].
	* Instructions for [[~~OH7LZB_VPN~~\|Accessing 44Net via VPN]] (experimental).		* Instructions for [[IPIP Mesh/OH7LZB VPN\|Accessing 44Net via VPN]] (experimental).
	* <b>[[FAQ]]</b>		* <b>[[FAQ]]</b>
	* If you already operate a [[IPIP Mesh/Gateways\|gateway]] please ensure you have registered on the [[Portal]] and "claimed" your [[IPIP Mesh/Gateways\|gateway]].		* If you already operate a [[IPIP Mesh/Gateways\|gateway]] please ensure you have registered on the [[Portal]] and "claimed" your [[IPIP Mesh/Gateways\|gateway]].

IPIP Mesh

KI5QKX — Tue, 29 Sep 2026 19:28:02 GMT

Organize remaining IPIP Mesh articles and navigation

← Older revision		Revision as of 19:28, 29 September 2026
Line 20:		Line 20:
	* [[IPIP Mesh/Amprgw\|The shared Internet gateway (Amprgw)]]		* [[IPIP Mesh/Amprgw\|The shared Internet gateway (Amprgw)]]
	* [[IPIP Mesh/Firewalls\|Firewall configuration]]		* [[IPIP Mesh/Firewalls\|Firewall configuration]]
			* [[IPIP Mesh/Filtering RFC1918 Addresses\|Filtering RFC1918 addresses]]

	=== Platform guides ===		=== Platform guides ===
	* [[IPIP Mesh/Linux\|Linux]] and [[IPIP Mesh/Ubuntu Linux Gateway Example\|Ubuntu example]]		* [[IPIP Mesh/Linux\|Linux]] and [[IPIP Mesh/Ubuntu Linux Gateway Example\|Ubuntu example]]
			* [[IPIP Mesh/K7ILO'S Two Interface Debian 11 AmprNet Gateway Build in layman's terms\|K7ILO’s Debian 11 gateway build]] (unfinished)
	* [[IPIP Mesh/macOS\|macOS]] (unfinished)		* [[IPIP Mesh/macOS\|macOS]] (unfinished)
	* [[IPIP Mesh/Cisco\|Cisco]]		* [[IPIP Mesh/Cisco\|Cisco]]
Line 39:		Line 41:
	* [[IPIP Mesh/Ampr-ripd\|ampr-ripd]], [[IPIP Mesh/Rip44d\|rip44d]], and [[IPIP Mesh/RIP44.lua\|RIP44.lua]]		* [[IPIP Mesh/Ampr-ripd\|ampr-ripd]], [[IPIP Mesh/Rip44d\|rip44d]], and [[IPIP Mesh/RIP44.lua\|RIP44.lua]]
	* [[IPIP Mesh/Munge script\|Munge scripts]] and [[IPIP Mesh/Startampr\|startampr]]		* [[IPIP Mesh/Munge script\|Munge scripts]] and [[IPIP Mesh/Startampr\|startampr]]

			=== Historical services ===
			* [[IPIP Mesh/OH7LZB VPN\|OH7LZB VPN]] (reported unavailable since May 2024)

	== What this page will cover ==		== What this page will cover ==

AMPRNet VPN

KI5QKX — Tue, 29 Sep 2026 19:28:01 GMT

Organize remaining IPIP Mesh articles and navigation

← Older revision		Revision as of 19:28, 29 September 2026
Line 1:		Line 1:
	#REDIRECT [[OH7LZB VPN]]		#REDIRECT [[IPIP Mesh/OH7LZB VPN]]
	[[Category:Explanation]]		[[Category:Explanation]]
	[[Category:VPN]]		[[Category:VPN]]

IPIP Mesh/K7ILO'S Two Interface Debian 11 AmprNet Gateway Build in layman's terms

KI5QKX — Tue, 29 Sep 2026 19:28:00 GMT

Organize remaining IPIP Mesh articles and navigation

← Older revision		Revision as of 19:28, 29 September 2026
Line 1:		Line 1:
			{{Section nav\|hub=IPIP Mesh\|title=IPIP Mesh\|category=IPIP Mesh}}

	Initial Server/Gateway Machine Setup		Initial Server/Gateway Machine Setup

K7ILO'S Two Interface Debian 11 AmprNet Gateway Build in layman's terms

KI5QKX — Tue, 29 Sep 2026 19:28:00 GMT

KI5QKX moved page K7ILO'S Two Interface Debian 11 AmprNet Gateway Build in layman's terms to IPIP Mesh/K7ILO'S Two Interface Debian 11 AmprNet Gateway Build in layman's terms Group remaining mesh documentation under IPIP Mesh

New page

Initial Server/Gateway Machine Setup

The computer I had laying around to build my basic server/gateway was an old Dell OptiPlex GX280 (Intel 3.2Ghz CPU) with 3GB’s of RAM, 160GB HD (Yeah, I know overkill but that's the HD that was in the machine) and two 1Gb Ethernet adapters, 1 built-in and 1 Intel PCI Ethernet adapter I installed, where..
1. the built-in Ethernet adapter is to my router for my Internet connection.
2. the PCI Ethernet adapter serves my AmprNet Network.

Because of the architecture of the computer, I had to use the 32bit version of Debian 11.5.0 netinstall image for this setup. I like Debian mainly because, well because I like it, LOL. BTW, it is not in the scope of these instructions to show you how to install Debian 11 so please search Google for information on the topic if needed. Keep in mind though the SSH server and the standard system utilities were the only software options I selected for my bare Debian 11 installation.

After the installation is completed, log in as root and make sure Debian has the latest fixes and patches by typing:
apt update && apt full-upgrade -y

During these procedures I used root directly since to me, it was quicker to setup the server/gateway. But if you want to use sudo, it is not installed by default on Debian 11 so again search Google on how to install it. There are a lot of resources on the subject. I installed sudo after getting the server/gateway up and running for future administration and security. If the server/gateway does any updates from the command's above, reboot to make sure updates take affect (old Windows habit). Type:
reboot

Install other software for this setup.

Descriptions..
1. screen (optional): This software allows you to connect back to a particular session if you are remote and loose connection to your server/gateway.
2. compile tools: Needed to compile software.
3. iptables-persistent: This installs the most used Linux firewall iptables and it's tools, well to my knowledge. When asked, it's not necessary to save the current v.4 and v.6 iptables rules.
4. psmisc: Installed for the killall command. Used for the update-server script found in the Optional Software and Task's section.
5. curl (optional): Used to install optional software found in the Optional Software and Task's section.
6. cron: Used to schedule task. This is more than likely already installed.
7. tcpdump: Useful networking tool.
8. traceroute: Useful networking tool. This is more than likely already installed.

To install these, Type:
apt install -y screen build-essential iptables-persistent psmisc curl tcpdump

Reboot. (Again, old Windows habit) Type:
reboot

Now let's turn this server machine into an AmprNet Gateway (Updates Coming so please check back soon)

[[Category:How-To]]
[[Category:How-To Guides]]
[[Category:Infrastructure]]
[[Category:Gateways]]
[[Category:Device and platform guides]]

IPIP Mesh/Filtering RFC1918 Addresses

KI5QKX — Tue, 29 Sep 2026 19:27:57 GMT

Organize remaining IPIP Mesh articles and navigation

← Older revision		Revision as of 19:27, 29 September 2026
Line 1:		Line 1:
			{{Section nav\|hub=IPIP Mesh\|title=IPIP Mesh\|category=IPIP Mesh}}

	== Mikrotik RouterOS ==		== Mikrotik RouterOS ==

Filtering RFC1918 Addresses

KI5QKX — Tue, 29 Sep 2026 19:27:56 GMT

KI5QKX moved page Filtering RFC1918 Addresses to IPIP Mesh/Filtering RFC1918 Addresses Group remaining mesh documentation under IPIP Mesh

New page

== Mikrotik RouterOS ==

<ol>
<li>Define an RFC1918 address list
<pre>/ip firewall address-list
add address=10.0.0.0/8 list=RFC1918
add address=172.16.0.0/12 list=RFC1918
add address=192.168.0.0/16 list=RFC1918</pre>
</li>
<li>Perform NAT on traffic coming into AMPR from RFC1918 space
<pre>/ip firewall nat
add action=masquerade chain=srcnat src-address-list=RFC1918</pre>
</li>
</ol>

[[Category:How-To]]
[[Category:How-To Guides]]
[[Category:Infrastructure]]

IPIP Mesh/OH7LZB VPN

KI5QKX — Tue, 29 Sep 2026 19:27:54 GMT

Organize remaining IPIP Mesh articles and navigation

← Older revision		Revision as of 19:27, 29 September 2026
Line 1:		Line 1:
			{{Section nav\|hub=IPIP Mesh\|title=IPIP Mesh\|category=IPIP Mesh}}

	The OH7LZB VPN was an experimental method to access the IPIP Mesh using a VPN from anywhere on the Internet. The VPN was openly available to any amateur radio operators who had successfully applied for an X.509 certificate from one of the following Certificate Authorities:		The OH7LZB VPN was an experimental method to access the IPIP Mesh using a VPN from anywhere on the Internet. The VPN was openly available to any amateur radio operators who had successfully applied for an X.509 certificate from one of the following Certificate Authorities:

Talk:OH7LZB VPN

KI5QKX — Tue, 29 Sep 2026 19:27:53 GMT

KI5QKX moved page Talk:OH7LZB VPN to Talk:IPIP Mesh/OH7LZB VPN Group remaining mesh documentation under IPIP Mesh

New page

Hi,
LOTW private key certificate is a PKCS12 format (p12 file)
To use it with AMPR VPN, you need to first convert it using openssl.

Example:
openssl pkcs12 -in <callsign>.p12 -out <callsign>.cer

from this text file, copy the private key section

OH7LZB VPN

KI5QKX — Tue, 29 Sep 2026 19:27:52 GMT

KI5QKX moved page OH7LZB VPN to IPIP Mesh/OH7LZB VPN Group remaining mesh documentation under IPIP Mesh

New page

The OH7LZB VPN was an experimental method to access the IPIP Mesh using a VPN from anywhere on the Internet. The VPN was openly available to any amateur radio operators who had successfully applied for an X.509 certificate from one of the following Certificate Authorities:

* [http://www.arrl.org/logbook-of-the-world ARRL Logbook of the World (LoTW)]

<b>As of May, 2024, the OH7LZB VPN appears to no longer be operational.</b>

The Certificate Authority (CA) validates using a relatively strong method that the operator is actually licensed, and gives the operator a cryptographic certificate to prove that. Other services, such as this VPN can then check that the operator possesses a valid amateur radio operator certificate (and the accompanying private key), without any manual work being performed by the operators of those services. The operator can use his private key to sign LoTW log files, or any other information he wishes to communicate, and other parties trusting the CA can use the certificate to check that they have been transmitted by someone who has a private key and a certificate for a callsign from the CA.

If and when other organisations start to give out X.509 certificates, after sufficient amateur radio license validation, the VPN will be configured to accept those in addition to the LoTW. If you're not willing to obtain a LoTW certificate, please set up a CA for your local club or association, document the method of license validation you're using, and I'll be happy to trust your certificates.

The VPN operator (Hessu, OH7LZB) does not have time to run a CA and validate licenses manually, so please don't ask for a certificate from anywhere else than the CAs listed above. Thanks!

The VPN is only used to access the IPIP Mesh. While you're connected to the VPN, the VPN client will only transmit packets from you to the IPIP Mesh via the VPN. Packets from you to the rest of the Internet will not go via the VPN - they'll flow out from your local network connection as before. This is called a [http://en.wikipedia.org/wiki/Split_tunneling split tunnel VPN configuration].

The setup is still a bit complicated - it can be made easier and more automatic with a little additional software in a later phase.

The VPN is an experimental service. It might be shut down for technical or political reasons - we'll see if it's a feasible idea or not.

= Getting a certificate from LoTW =

Go through [https://lotw.arrl.org/lotw-help/getting-started/ these simple steps]. After step 4 you're ready to continue with the VPN.

It's going to take some time to validate, and you'll have to do some manual work (especially if you're outside the USA), but that is intentional. It significantly reduces abuse of the system, and increases its security.

= Extracting the certificate from LoTW =

LoTW uses a custom file format (.TQ*) to exchange certificates, but after the LoTW certificate process is done and the TrustedQSL software has your certificates, they can be easily copied from TrustedQSL's directories. You'll need three files: your '''user certificate''', an '''intermediate certificate''' that was used to sign it, and your '''private key'''. The only secret piece of information is the private key - you should not reveal it to anyone at any point, as they could then use services on your behalf, using your callsign.

== Windows ==

* C:\Documents and Settings\your-username\Application Data\TrustedQSL contains two directories, '''certs''' and '''keys'''.
* certs\user contains the '''user certificate'''
* certs\authorities contains an '''intermediate certificate'''
* keys\YOURCALL contains, within some XML, your '''private key'''

Make copies of those files in another directory, and work on those copies in order to avoid breaking the originals.

The user and intermediate certificates need to be concatenated to a single file named '''client.crt'''. The user certificate must be first, followed by the intermediate certificate. That can be done by an ascii editor such as Notepad (Wordpad or Word is likely to mess it up in a big way).

The private key needs to be extracted from the YOURCALL file. The file is a regular ASCII text file, and contains a block which looks something like this (just longer):

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,0C7B5495F6A91F31

0xmWfliK/v9U88MFyYtUbteRoAkfVMK6BllcdID3pZzmdykHaPLZUjXOCUh3vFUX
1bjnYwXpLX/CxgZ6NIxQIk7jMjL3iaP5SkWzCswqi9mCO+zHxuS6PWq7YwbWNFgo
7smNcko1yTp7f/VbS4CZ5kgIF9kCgNaiqdxq+v0IcphQHRR4xjfLpBQ4ckYOi4nC
jqFR1BitwBL4K2JeE9PGUkkUBwvU4oOi9PGChuoxMXs8PwKi/dZTmSWM7kOfMiBw
-----END RSA PRIVATE KEY-----

Copy-paste that block to a separate file named '''client.key'''.

== Linux and Mac ==

* ~/.tqsl/certs/user contains the '''user certificate'''
* ~/.tqsl/certs/authorities contains an '''intermediate certificate'''
* ~/.tqsl/keys/YOURCALL contains, within some XML, your '''private key'''

The user and intermediate certificates need to be concatenated to a single file named '''client.crt'''. The user certificate must be first, followed by the intermediate certificate. That can be done by a single command:

cat ~/.tqsl/certs/user ~/.tqsl/certs/authorities > client.crt

The private key needs to be extracted from the YOURCALL file. The file is a regular ASCII text file, and contains a block which looks something like this (just longer):

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,0C7B5495F6A91F31

0xmWfliK/v9U88MFyYtUbteRoAkfVMK6BllcdID3pZzmdykHaPLZUjXOCUh3vFUX
1bjnYwXpLX/CxgZ6NIxQIk7jMjL3iaP5SkWzCswqi9mCO+zHxuS6PWq7YwbWNFgo
7smNcko1yTp7f/VbS4CZ5kgIF9kCgNaiqdxq+v0IcphQHRR4xjfLpBQ4ckYOi4nC
jqFR1BitwBL4K2JeE9PGUkkUBwvU4oOi9PGChuoxMXs8PwKi/dZTmSWM7kOfMiBw
-----END RSA PRIVATE KEY-----

Copy-paste that block to a separate file named '''client.key'''. If you're going to open up the original private key file in a text editor, it's a good idea to make a backup copy of that file first in case of an accidental corruption of its contents.

= Configuring the VPN =

== Windows: OpenVPN ==

# [http://openvpn.net/index.php/download/community-downloads.html Download the Windows Installer], it's free and open source.
# Run the installer to install it.
# [http://he.fi/amprnet-vpn/amprnet-vpn-win.zip Download the AMPRNet VPN configuration files for Windows]
# Open up the zip file, it contains two files: amprnet-vpn.ovpn and amprnet-vpn-ca.crt.
# In Start menu, under OpenVPN => Shortcuts you'll find an entry named '''OpenVPN configuration file directory'''. Open it, and move the two files from the zip to the configuration file directory.
# Place client.crt and client.key, which were created previously, in the configuration file directory.
# Run the '''OpenVPN GUI''' from the desktop icon or start menu. A new icon will appear in the lower right corner (two computers with red screens + a globe on the side).
# Right-click the OpenVPN toolbar icon and select '''Connect'''.

If you chose to encrypt your private key with a password (or passphrase) when initially applying for a LoTW certificate and generating the Certificate Request, OpenVPN will ask you for that password when connecting.

To rephrase: When OpenVPN says "Enter Password", the password being asked is the one you picked when you first applied for a LoTW certificate. It's not something the VPN operator knows (or should know). It's not the one you got on a postcard. Only you have ever been aware of that password (hopefully).

== Linux: OpenVPN ==

=== Ubuntu 15.10 ===

Here is steps to install the VPN to Ubuntu 15.10 destop. Install OpenVPN plugin to network manager.
Open terminal and type

sudo apt-get install network-manager-open vpn-gnome

Then add VPN-connection information to NetworkManager

# Click network manager icon on taskbar
# Edit connections
# Add
# OpenVPN
# Create
#* Connection name: AMPRNet
#* Gateway: amprnet-vpn1.aprs.fi
#* Select proper files to User Certificate, CA certificate and Private key
#* Optionally enter private key password if you are set one
# Click Advanced
#* [x] Use custom gateway port: 1773
#* [x] Use LZO data compression
# Click OK
# Click Save
# Click Close

Now you can connect to VPN

# Click network manager icon on taskbar
# VPN connections -> AMPRNet
# Connection should be established

== Linux (Raspberry Pi): OpenVPN ==

Log in to Raspberry Pi console. Install openvpn software.

sudo apt-get install openvpn

Create openvpn client configuration file with your favourite editor to /etc/openvpn/client.conf

<pre>
client
dev tun
proto udp
remote amprnet-vpn1.aprs.fi 1773
resolv-retry infinite
persist-key
persist-tun
ca amprnet-vpn-ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
</pre>

Extract your client certificate and key as explained above section Extracting the certificate from LoTW. Copy your certificate files client.crt and client.key to /etc/openvpn/ . You also need amprnet-vpn-ca.crt which can be found inside this archive
http://he.fi/amprnet-vpn/amprnet-vpn-win.zip . Extract it and copy to /etc/openvpn/

Restart openvpn

service openvpn restart

All done.

== Mac OS X: Tunnelblick ==

# [https://tunnelblick.net/ Download Tunnelblick], it's free and open source, and works like a charm. It's based on OpenVPN.
# [http://he.fi/amprnet-vpn/amprnet-vpn-tblk.zip Download the VPN configuration for Tunnelblick], it's a zip file containing a directory with a couple files
# Double-click the downloaded zip file to extract it, you'll get a directory named '''amprnet-vpn.tblk'''
# Move the '''private key''' (in a file which was named '''client.key''' in the previous step) to that directory
# Move the certificates (in a file which was named '''client.crt''' in the previous step) to that directory
# Double-click the '''amprnet-vpn.tblk''' directory - this will launch Tunnelblick and install the VPN configuration

You should now see a "tunnel" icon in the top right corner of the screen. Click it to see a few menu items allowing you to connect and disconnect the VPN.

If you chose to encrypt your private key with a password (or passphrase) when initially applying for a LoTW certificate and generating the Certificate Request, Tunnelblick will ask you for that passphrase when connecting.

To rephrase: When Tunnelblick says "A passphrase is required to connect to amprnet-vpn", the passphrase being asked is the one you picked when you first applied for a LoTW certificate. It's not something the VPN operator knows (or should know). Only you have ever been aware of that passphrase (hopefully).

[[Category:How-To]]
[[Category:Reference]][[Category:How-To Guides]]
[[Category:Participation Methods]]
[[Category:VPN]]

Setting up a gateway in a ROS7 Mikrotik router container on arm32, arm64 and x86-64

KI5QKX — Tue, 29 Sep 2026 19:09:31 GMT