Direwolf

Direwolf is a piece of software used to decode and encode APRSAutomated Packet Reporting System. packets, commonly called a terminal node controller (TNC). A computer running Direwolf can be paired with a transceiver to transmit, receive, and digipeat APRS packets on the air. It can be used on its own or with a KISS client. This is a tutorial on setting up Direwolf for remote access via a 44Net Connect tunnel.

Prerequisites:

• 44Net Portal account
• Verified callsign
• 44Net Connect tunnel configuration file (for your Direwolf device)
• Either a client with a static IP or another 44Net Connect tunnel configuration file for your client

Security and Limitations

Neither Direwolf or the KISS protocol directly support any kind of authentication. Though some AGW clients such as Xastir support password protection, Direwolf does not support configuring a password for its AGW interface. Securing Direwolf against unauthorized access is done via IP whitelisting in this guide, so providing access to people without access to a static IP (through 44Net or otherwise) is out of scope.

Step 1: Install and configure Direwolf

Consult the Direwolf README for installation instructions. The instructions state that the direwolf.conf file will be automatically created in your home directory, but this is not always the case. If the config file is not automatically created, a working Linux configuration can be found in N3EMC's digipeater tutorial.

Configure sound card

Next, plug in your USB sound card if you're using one. (This section applies whether you're using a USB sound card or a built-in one.) then open a terminal and run `arecord -l` to list your audio devices. The output will look like this:

**** List of CAPTURE Hardware Devices ****
card 1: Device [USB Audio Device], device 0: USB Audio [USB Audio]
Subdevices: 0/1
Subdevice #0: subdevice #0

Record the card number (in this case card 1) and the device number (in this case card 2). Edit the line in direwolf.conf that starts with ADEVICE. By default, the line might look like this:

ADEVICE plughw:0,0

Replace the first number with your card number, and the second with your device number. For our example with card 1 and device 0, the line should now look like this:

ADEVICE plughw:1,0

Configure callsign

Go to the configuration line beginning with MYCALL and fill in your callsign there. It may optionally be followed by a Sub-Station Identifier (SSID), which consists of a dash and a number. These are commonly used to differentiate multiple pieces of equipment owned by the same person. N3EMC says that 10 is commonly used for digipeaters and iGates, so a person with the callsign N0CALL may write the config line like this:

MYCALL N0CALL-10

Configure iGate login

To enable iGate functionality, you must configure your iGate server and login. The server is configured using the line starting with IGSERVER. Select your server from the following:

• Worldwide: rotate.aprs2.net
• North America: noam.aprs2.net
• South America: soam.aprs2.net
• Europe/Africa: euro.aprs2.net
• Asia: asia.aprs2.net
• Oceania: aunz.aprs2.net

For example, North American users should have the config line IGSERVER noam.aprs2.net.

Step 2: Configure your firewall

For security purposes, it's important to configure your firewall before exposing your device to the internet. Install your firewall of choice, and open port 8000 for an AGW client, and 8001 for the KISS client. Ensure other ports are closed, unless you have services that you want to be accessible. See Firewalling Basics for more information.

Step 3: Set up 44Net Connect tunnel

Set up a single device tunnel on the machine that will host your Direwolf server. Go to the list of single device tunnel tutorials and follow the one for your operating system. Before starting the tunnel, you'll need to modify your configuration. Modify the AllowedIPs line so that it contains only the static IPs of your clients, each followed by /32 to indicate that this is a single IP rather than a subnet. This is the method by which access to your Direwolf instance is controlled. Example:

AllowedIPs = 44.27.133.290/32

Step 4: Set up client

Install a KISS or AGW client of your choice, such as PyttiAPRS or Xastir, and point it at the 44Net IPv4 address of the device running Direwolf. You can obtain this address from the [Interface] section of that device's WireGuard config, or you can run the ifconfig command on that device and look for the WireGuard interface. If it asks for port configuration, use port 8000 for AGW and port 8001 for KISS.

Step 5: Verify IP whitelist configuration

To verify that the WireGuard configuration is correctly blocking access from unauthorized parties, try connecting to Direwolf from an IP address that's not whitelisted. If your typical connection method uses another 44Net Connect tunnel on the client device, try turning it off. If you've whitelisted a static IP tied to your current network, you could go to a cafe and use their internet. Use curl connect.44net.cloud/myip to verify that your IP has changed, then attempt to connect. You should not be able to connect from a non-whitelisted IP. If you are able to connect, your WireGuard AllowedIPs

Short definition: The outbound routing table and inbound access control list for a WireGuard interface.

Long definition: The AllowedIPs field in a WireGuard configuration file determines what outbound connections are routed through the interface, and what inbound connections are allowed through the interface. Outbound connections from IPs not on the list will be routed via other interfaces, and inbound connections from IPs not on the list will be dropped.

may not be correctly configured.

Troubleshooting

Can't connect to Direwolf

• Ensure that ports 8000 and 8001 are open in your firewall.
• If you are unsure whether your client is behind a firewall whose egress filtering is preventing connection, you can open listeners on ports 8000 and 8001 to see if your connection is making it there at all.
  • This will require closing Direwolf for the duration of the test.
  • Open a listener with netcat using the following command: nc -l -p <port>
  • After opening the listeners on ports 8000 and 8001, attempt to connect with your client. If the listeners don't show any activity, your connection attempt is not making it to the server.

Direwolf isn't receiving any packets

• Check your physical connections between the radio and sound card.
• Make sure your radio's audio and RF gain are adjusted so that Direwolf is receiving sound at the correct level. (Direwolf will warn you about audio that's too loud, but not too quiet.)
• Make sure receive tone squelch is disabled on your radio, and that it's tuned to the correct frequency.
• It can be helpful to use a second radio for troubleshooting, either to monitor the APRS frequency for when packets should appear, or to send test packets.

References

Other References

• Direwolf documentation
• Easy APRS iGate and Digipeater Setup with Direwolf - themodernham
• APRS Digitpeater and iGate with Direwolf