AllStarLink - Revision history

KN6DWI: Discuss special considerations for split tunnel

2026-10-02T00:02:24Z

Discuss special considerations for split tunnel

← Older revision		Revision as of 00:02, 2 October 2026
Line 52:		Line 52:

	== Step 4: Enable 44Net Connect tunnel ==		== Step 4: Enable 44Net Connect tunnel ==
			Go to the [https://wiki.ampr.org/wiki/44Net_Connect/Single_Device_Tunnel Single Device Tunnel tutorials list], and follow the quick start tutorial for your distribution.

			=== Optional: Split Tunnel ===
			There are special considerations for operating a split tunnel on a device with AllStarLink. Nodes register with the central coordination server and report statistics by contacting <code>register.allstarlink.org</code> and <code>stats.allstarlink.org</code>. For the node to be registered with your static 44Net IP, these communications must go out through your VPN tunnel, which by by default they will not. These domains don't have static IPs, so you'll need to deploy a watchdog service to create and update routing rules based on the DNS records.

	[[Category:Use Cases]]		[[Category:Use Cases]]
	[[Category:How-To]]		[[Category:How-To]]

KN6DWI: Added permanent flags and reminder to reload firewall to firewalld section

2026-10-01T22:58:23Z

Added permanent flags and reminder to reload firewall to firewalld section

← Older revision		Revision as of 22:58, 1 October 2026
Line 23:		Line 23:
	For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has [https://allstarlink.github.io/adv-topics/44net-connect/ a page about 44Net Connect] with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom <code>firewalld</code> service definitions. Your 44Net Connect zone must have the <code>iax2</code> service added for AllStar to function. If you're accepting EchoLink connections, the <code>echolink</code> service must also be added. That can be done with the following commands:		For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has [https://allstarlink.github.io/adv-topics/44net-connect/ a page about 44Net Connect] with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom <code>firewalld</code> service definitions. Your 44Net Connect zone must have the <code>iax2</code> service added for AllStar to function. If you're accepting EchoLink connections, the <code>echolink</code> service must also be added. That can be done with the following commands:

	'''IAX2:'''<code>sudo firewall-cmd --zone <your zone here> --add-service iax2</code>		'''IAX2:'''<code>sudo firewall-cmd --zone <your zone here> --add-service iax2 --permanent</code>

	'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-service echolink</code>		'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-service echolink --permanent</code>


	Users of the non-appliance version should open <code>UDP 4560-4580</code> for IAX2, and <code>5198-5199</code> for EchoLink.		Users of the non-appliance version should open <code>UDP 4560-4580</code> for IAX2, and <code>5198-5199</code> for EchoLink.

	'''IAX2:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 4560-4580/udp</code>		'''IAX2:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 4560-4580/udp --permanent </code>

	'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 5189-5199/udp</code>		'''Echolink:''' <code>sudo firewall-cmd --zone <your zone here> --add-port 5189-5199/udp --permanent</code>


			Once you've added your services or ports, don't forget to reload your firewall:

			<code>sudo firewall-cmd --reload</code>

	=== ufw ===		=== ufw ===

KN6DWI: Fix link formatting

2026-10-01T22:37:11Z

Fix link formatting

← Older revision		Revision as of 22:37, 1 October 2026
Line 2:		Line 2:

	== Step 1: Sign up for AllStarLink ==		== Step 1: Sign up for AllStarLink ==
	Follow AllStarLink's [~~instructions for the sign up process](~~https://allstarlink.github.io/basics/portal/). They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.		Follow AllStarLink's [https://allstarlink.github.io/basics/portal/ instructions for the sign up process]. They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.

	During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.		During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.

KN6DWI: Tell user that rules can be created before the WG interface

2026-10-01T22:09:45Z

Tell user that rules can be created before the WG interface

← Older revision		Revision as of 22:09, 1 October 2026
Line 43:		Line 43:

	'''Echolink:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 5189-5199 proto udp</code>		'''Echolink:''' <code>sudo ufw allow in on <44net wireguard interface> to any port 5189-5199 proto udp</code>

			These rules can be entered before the 44Net Connect WireGuard interface is actually created, but they won't work until a WireGuard interface is created with exactly the same name. The WireGuard interface will be named after the config file used to create it, so <code>wg0.conf</code> would create the interface <code>wg0</code>.

	== Step 4: Enable 44Net Connect tunnel ==		== Step 4: Enable 44Net Connect tunnel ==

KN6DWI: Wrote instructions for firewall rule configuration

2026-10-01T18:59:47Z

Wrote instructions for firewall rule configuration

@@ Line 18: / Line 18: @@
 == Step 3: Configure firewall ==
 {{Info|Warn|When using a 44Net Connect tunnel with AllStarLink and <code>firewalld</code>, don't put the 44Net WireGuard interface in the <code>allstarlink</code> zone provided by the appliance. This will make your web management interface publicly available on the internet. Instead, create a 44Net zone, and add the requisite services to that zone.}}
-For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has [https://allstarlink.github.io/adv-topics/44net-connect/ a page about 44Net Connect] with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom <code>firewalld</code> service definitions.
+For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has [https://allstarlink.github.io/adv-topics/44net-connect/ a page about 44Net Connect] with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom <code>firewalld</code> service definitions. Your 44Net Connect zone must have the <code>iax2</code> service added for AllStar to function. If you're accepting EchoLink connections, the <code>echolink</code> service must also be added. That can be done with the following commands:
 == Step 4: Enable 44Net Connect tunnel ==

KN6DWI: Started section on configuring firewall

2026-09-30T23:35:39Z

Started section on configuring firewall

← Older revision		Revision as of 23:35, 30 September 2026
Line 18:		Line 18:

	== Step 3: Configure firewall ==		== Step 3: Configure firewall ==
			{{Info\|Warn\|When using a 44Net Connect tunnel with AllStarLink and <code>firewalld</code>, don't put the 44Net WireGuard interface in the <code>allstarlink</code> zone provided by the appliance. This will make your web management interface publicly available on the internet. Instead, create a 44Net zone, and add the requisite services to that zone.}}

			For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has [https://allstarlink.github.io/adv-topics/44net-connect/ a page about 44Net Connect] with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom <code>firewalld</code> service definitions.

	== Step 4: Enable 44Net Connect tunnel ==		== Step 4: Enable 44Net Connect tunnel ==

	[[Category:Use Cases]]		[[Category:Use Cases]]
	[[Category:How-To]]		[[Category:How-To]]

KN6DWI: Mentioned how to add ASL3 appliance to existing Pi

2026-09-30T23:08:19Z

Mentioned how to add ASL3 appliance to existing Pi

← Older revision		Revision as of 23:08, 30 September 2026
Line 12:		Line 12:

	=== Raspberry Pi Appliance ===		=== Raspberry Pi Appliance ===
	To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.]		To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.] This guide is primarily for flashing a fresh image on your Pi. If you want to add an ASL3 appliance to an existing Pi, follow the steps for the Debian appliance.

	=== Debian PC or Appliance ===		=== Debian PC or Appliance ===

KN6DWI: Added links to Pi and Debian guides

2026-09-30T22:58:38Z

Added links to Pi and Debian guides

← Older revision		Revision as of 22:58, 30 September 2026
Line 9:		Line 9:

	== Step 2: Install AllStarLink ==		== Step 2: Install AllStarLink ==
	AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation.		AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes the same, and additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation, which lets you preload Wi-Fi configuration. It also supports managing the Pi's serial port at <code>/dev/serial0</code>, as well as using the GPIO pins for PTT triggering. The Pi image keeps logs and temp files only in memory to reduce writes to the SD card.

			=== Raspberry Pi Appliance ===
			To install the Raspberry Pi ASL3 appliance, see the [https://allstarlink.github.io/install/pi-appliance/pi-detailed/ ASL3 guide to setting up the Pi appliance.]

			=== Debian PC or Appliance ===
			To install ASL3 on Debian, via any of <code>asl3-appliance</code>, <code>asl3-appliance-pc</code>, or a non-appliance Debian install (<code>asl3</code>), follow [https://allstarlink.github.io/install/debian/install/ the ASL3 Debian install guide.] It covers all three methods, and notes each point where the installation methods diverge.

	== Step 3: Configure firewall ==		== Step 3: Configure firewall ==

KN6DWI: Started ASL installation instructions

2026-09-30T19:07:52Z

Started ASL installation instructions

← Older revision		Revision as of 19:07, 30 September 2026
Line 8:		Line 8:
	Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is <code>4569</code>.		Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is <code>4569</code>.

	== Step 2: ~~Create a server~~ ==		== Step 2: Install AllStarLink ==
	~~== Step 3: Create a node ==~~		AllStarLink3 can be installed on Debian or Raspberry Pi OS. The <code>asl3-appliance</code> package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The <code>asl3-appliance-pc</code> package includes additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation.
	~~== Step 4: Install AllStarLink ==~~
	== Step 5: Configure firewall ==		== Step 3: Configure firewall ==
	== Step 6: Enable 44Net Connect tunnel ==		== Step 4: Enable 44Net Connect tunnel ==

	[[Category:Use Cases]]		[[Category:Use Cases]]
	[[Category:How-To]]		[[Category:How-To]]

KN6DWI: Added default IAX port

2026-09-30T18:23:44Z

Added default IAX port

← Older revision		Revision as of 18:23, 30 September 2026
Line 6:		Line 6:
	During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.		During registration, United States amateur radio operators will need an '''official copy''' of their license, obtained by [https://wireless2.fcc.gov/UlsEntry/licManager/login.jsp logging in to the FCC website] with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.

	Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later.		Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is <code>4569</code>.

	== Step 2: Create a server ==		== Step 2: Create a server ==