AllStarLink

AllStarLink is an open source internet repeater linking system that uses the Asterisk PBX software internally, and provides a web interface for management. It can be used both for connecting repeaters to the internet and for creating reflectors that internet-linked repeaters can connect to. An AllStarLink installation consists of multiple pieces of software: The Asterisk PBX, the app_rpt application made by AllStarLink, and the Allmon3 web interface.

Step 1: Sign up for AllStarLink

Follow AllStarLink's instructions for the sign up process. They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.

During registration, United States amateur radio operators will need an official copy of their license, obtained by logging in to the FCC website with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.

Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is 4569.

Step 2: Install AllStarLink

AllStarLink3 can be installed on Debian or Raspberry Pi OS. The asl3-appliance package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The asl3-appliance-pc package includes the same, and additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation, which lets you preload Wi-Fi configuration. It also supports managing the Pi's serial port at /dev/serial0, as well as using the GPIO pins for PTT triggering. The Pi image keeps logs and temp files only in memory to reduce writes to the SD card.

Raspberry Pi Appliance

To install the Raspberry Pi ASL3 appliance, see the ASL3 guide to setting up the Pi appliance. This guide is primarily for flashing a fresh image on your Pi. If you want to add an ASL3 appliance to an existing Pi, follow the steps for the Debian appliance.

Debian PC or Appliance

To install ASL3 on Debian, via any of asl3-appliance, asl3-appliance-pc, or a non-appliance Debian install (asl3), follow the ASL3 Debian install guide. It covers all three methods, and notes each point where the installation methods diverge.

Step 3: Configure firewall

firewalld

Warning

When using a 44Net Connect tunnel with AllStarLink and firewalld, don't put the 44Net WireGuard interface in the allstarlink zone provided by the appliance. This will make your web management interface publicly available on the internet. Instead, create a 44Net zone, and add the requisite services to that zone.

For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has a page about 44Net Connect with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom firewalld service definitions. Your 44Net Connect zone must have the iax2 service added for AllStar to function. If you're accepting EchoLink connections, the echolink service must also be added. That can be done with the following commands:

IAX2:sudo firewall-cmd --zone <your zone here> --add-service iax2 --permanent

Echolink: sudo firewall-cmd --zone <your zone here> --add-service echolink --permanent

Users of the non-appliance version should open UDP 4560-4580 for IAX2, and 5198-5199 for EchoLink.

IAX2: sudo firewall-cmd --zone <your zone here> --add-port 4560-4580/udp --permanent

Echolink: sudo firewall-cmd --zone <your zone here> --add-port 5189-5199/udp --permanent

Once you've added your services or ports, don't forget to reload your firewall:

sudo firewall-cmd --reload

ufw

Note

firewalld is the recommended firewall software for devices with 44Net Connect software, because its abstraction of zones makes secure configuration easier to set up and understand. ufw is not recommended, but it can still be used. It will be more involved due to lacking zones.

ufw rules allowing IAX2 and EchoLink can be entered as follows:

IAX2: sudo ufw allow in on <44net wireguard interface> to any port 4560-4580 proto udp

Echolink: sudo ufw allow in on <44net wireguard interface> to any port 5189-5199 proto udp

These rules can be entered before the 44Net Connect WireGuard interface is actually created, but they won't work until a WireGuard interface is created with exactly the same name. The WireGuard interface will be named after the config file used to create it, so wg0.conf would create the interface wg0.

Step 4: Enable 44Net Connect tunnel

Go to the Single Device Tunnel tutorials list, and follow the quick start tutorial for your distribution.

Optional: Split Tunnel

There are special considerations for operating a 44Net Connect split tunnel on a device with AllStarLink. Nodes register with the central coordination server and report statistics by contacting register.allstarlink.org and stats.allstarlink.org. For the node to be registered with your static 44Net IP, these communications must go out through your VPN tunnel, which by by default they will not. These domains don't have static IPs, so you'll need to deploy a watchdog service to create and update routing rules based on the DNS. The following systemd unit will do this. Place it in /etc/systemd/system/.

[Unit]
Description=Maintains rules that route traffic to AllStarLink domains through the 44Net split tunnel
Requires=network-online.target
After=network.target network-online.target
Before=asterisk.service allmon3.service

# Change this to the name of your split tunnel service
Requires=wg-quick@wg0-st.service

[Service]
Type=exec

# Make sure you copy the script to this path exactly, or change the path here
ExecStart=/opt/allstarlink/st-routing-watchdog.sh

[Install]
WantedBy=multi-user.target

This systemd unit depends on the following script being placed in /opt/allstarlink/st-routing-watchdog.sh The /opt/allstarlink directory is not automatically created. Make it with sudo mkdir /opt/allstarlink before placing the file there.

#!/usr/bin/bash

# Change this if you use a different routing table for your WireGuard interface
WG_TABLE=51820

# Initialize variables
REGISTER_IPS=""
STATS_IP=""

del_rules () {
ip rule del to $1 lookup $WG_TABLE

while IFS= read -r line || [[ -n $line ]]; do
ip rule del to $line lookup $WG_TABLE
done < <(printf '%s' "$1")
}

cleanup () {
echo 'Received $1, cleaning up rules and exiting.'
del_rules "$2" "$3"
}
while
# Note that there are multiple IPs for register.allstarlink.org
REGISTER_IPS_NEW=$(dig +short register.allstarlink.org)
STATS_IP_NEW=$(dig +short stats.allstarlink.org)


echo "$REGISTER_IPS_NEW"

# Ensure records are not null
if [[ $REGISTER_IPS_NEW == "" ]]; then
echo "DNS resolution error for register.allstarlink.org"
exit 2
fi;

if [[ $STATS_IP_NEW == "" ]]; then
echo "DNS resolution error for stats.allstarlink.org"
exit 2
fi;

# Fetch TTLs for DNS A records
REGISTER_TTL=$(dig register.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
STATS_TTL=$(dig stats.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
echo "register.allstarlink.org resolves to  $REGISTER_IP_NEW"
echo "stats.allstarlink.org resolves to     $STATS_IP_NEW"
echo
echo "TTL of register.allstarlink.org:      $REGISTER_TTL"
echo "TTL of stats.allstarlink.org:         $STATS_TTL"

# Use smaller of the two TTLs
if (( REGISTER_TTL > STATS_TTL )); then
FINAL_TTL=$STATS_TTL
else
FINAL_TTL=$REGISTER_TTL
fi;


# If new IPs don't match old IPs, replace rules.
if [[ $REGISTER_IPS == $REGISTER_IPS_NEW && $STATS_IP == $STATS_IP_NEW ]]; then
echo "IPs have not changed. Rules will not be updated."
else
echo "IPs have changed. Updating rules."

# Create routing rules
# Putting this before deletion of old rules to prevent race condition routing leakage.
# This while loop to read each line from REGISTER_IPS_NEW is from
# https://superuser.com/questions/284187/how-to-iterate-over-lines-in-a-variable-in-bash
while IFS= read -r line || [[ -n $line ]]; do
ip rule add to $line lookup $WG_TABLE
done < <(printf '%s' "$REGISTER_IPS_NEW")

ip rule add to $STATS_IP_NEW lookup $WG_TABLE

# Don't try to delete old rules on first iteration bc they don't exist yet
if [[ $REGISTER_IP != "" ]]; then
del_rules $STATS_IP $REGISTER_IPS
fi;

REGISTER_IPS=$REGISTER_IPS_NEW
STATS_IP=$STATS_IP_NEW
fi;

# Delete routes when program is stopped
# TODO: Invoke cleanup function here to clean up all register rules
trap 'echo "Received SIGINT, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGINT

trap 'echo "Received SIGTERM, cleaning up rules and exiting."; \
del_rules $STATS_IP $REGISTER_IPS' SIGTERM

# Sleep for duration of TTL
echo "Sleeping for $FINAL_TTL seconds"
echo
sleep $FINAL_TTL

do true; done

After installing these files, make the script executable by running sudo chmod +x /opt/allstarlink/st-routing-watchdog.sh, then enable the systemd unit with sudo systemctl enable asl-st-routing-service --now.

Step 5: Verify functionality

asl-node-auth-check

AllStarLink comes with the asl-node-auth-check utility that automatically evaluates your connection and registration status. It must be run as superuser. SSH into your ASL3 node and run sudo asl-node-auth-check. If there are no errors, your node is correctly registered. Warnings should be addressed if possible.

Split tunnel users may see a warning that their node is not perceived as registered, but this is acceptable as long as the node functionality is not impaired. Node functionality will be assessed in the next section by connecting with a VoIP app. If the split tunnel or firewall are incorrectly configured, there may be HTTP connection errors.

VoIP: Droidstar

Connectivity can be verified by connecting to your AllStarLink node with a VoIP app. People with android phones can use Droidstar with the following steps:

1. Install DroidStar from the Google Play store
2. Obtain your node's password from the AllStarLink portal
3. Go to DroidStar settings, and configure your callsign and ASL password.
4. Go to the Hosts tab and add a line that says IAX <node number> wt.
5. Go to the Main tab, select IAX using the drop-down menu at the top, and select your node number using the drop-down menu under the mode menu. Press connect, and it should connect in a few seconds.

If connection is successful, the button will change to "Connected" and through your client you'll hear the node announce your connection. If DroidStar remains "Connecting" for more than 30 seconds, you probably have a configuration issue.

Troubleshooting

AllStarLink has a troubleshooting guide. This section includes additional troubleshooting tools, and does not reiterate any of the officially recommended methods.