AllStarLink

From 44Net Wiki
Revision as of 17:27, 15 October 2026 by KN6DWI (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

AllStarLink is an open source[1] internet repeater linking system built on the Asterisk PBX software. It provides a web interface for management. It can be used both for connecting repeaters to the internet and for creating reflectors that internet-linked repeaters can connect to. An AllStarLink installation consists of multiple pieces of software: The Asterisk PBX, the app_rpt application made by AllStarLink, and the Allmon3 web interface.

Step 1: Sign up for AllStarLink

Follow AllStarLink's instructions for the sign up process. They'll guide you through signing up for an account, registering a server, and registering a node. This will allocate a node number to you, or a set of node numbers if you choose to immediately extend your node number as suggested.

During registration, United States amateur radio operators will need an official copy of their license, obtained by logging in to the FCC website with their FRN. The publicly available reference copy is not sufficient. After signing up, wait for your account to be verified, which should take at most 24 hours.

Take note of the IAX port you select when creating your server. This can be changed later, but the portal setting must line up with your firewall settings later. The default is 4569.

Step 2: Install AllStarLink

AllStarLink3 can be installed on Debian or Raspberry Pi OS. The asl3-appliance package is available for Debian 13 (trixie). It includes Asterisk, app_rpt, and Allmon3. The asl3-appliance-pc package includes the same, and additional functionality for mDNS broadcasts and swapfile management. The ASL3 appliance for Raspberry Pi OS can be installed with the Raspberry Pi Imager for ease of installation, which lets you preload Wi-Fi configuration. It also supports managing the Pi's serial port at /dev/serial0, as well as using the GPIO pins for PTT triggering. The Pi image keeps logs and temp files only in memory to reduce writes to the SD card.

Raspberry Pi Appliance

To install the Raspberry Pi ASL3 appliance, see the ASL3 guide to setting up the Pi appliance. This guide is primarily for flashing a fresh image on your Pi. If you want to add an ASL3 appliance to an existing Pi, follow the steps for the Debian appliance.

Debian PC or Appliance

To install ASL3 on Debian, via any of asl3-appliance, asl3-appliance-pc, or a non-appliance Debian install (asl3), follow the ASL3 Debian install guide. It covers all three methods, and notes each point where the installation methods diverge.

Step 3: Configure firewall

firewalld

Warning
When using a 44Net Connect tunnel with AllStarLink and firewalld, don't put the 44Net WireGuard interface in the allstarlink zone provided by the appliance. This will make your web management interface publicly available on the internet. Instead, create a 44Net zone, and add the requisite services to that zone.

For security, the firewall should be configured before bringing up the VPN tunnel. The AllStarLink manual has a page about 44Net Connect with recommendations for firewall configuration. If you installed one of the appliance packages, it comes with custom firewalld service definitions. Your 44Net Connect zone must have the iax2 service added for AllStar to function. If you're accepting EchoLink connections, the echolink service must also be added. That can be done with the following commands:

IAX2: sudo firewall-cmd --zone <your zone here> --add-service iax2 --permanent

Echolink: sudo firewall-cmd --zone <your zone here> --add-service echolink --permanent


Users of the non-appliance version should open UDP 4560-4580 for IAX2, and 5198-5199 for EchoLink.

IAX2: sudo firewall-cmd --zone <your zone here> --add-port 4560-4580/udp --permanent

Echolink: sudo firewall-cmd --zone <your zone here> --add-port 5189-5199/udp --permanent


Once you've added your services or ports, don't forget to reload your firewall:

sudo firewall-cmd --reload

ufw

Note
firewalld is the recommended firewall software for devices with 44Net Connect software, because its abstraction of zones makes secure configuration easier to set up and understand. ufw is not recommended, but it can still be used. It will be more involved due to lacking zones.


ufw rules allowing IAX2 and EchoLink can be entered as follows:

IAX2: sudo ufw allow in on <44net wireguard interface> to any port 4560-4580 proto udp

Echolink: sudo ufw allow in on <44net wireguard interface> to any port 5189-5199 proto udp

These rules can be entered before the 44Net Connect WireGuard interface is actually created, but they won't work until a WireGuard interface is created with exactly the same name. The WireGuard interface will be named after the config file used to create it, so wg0.conf would create the interface wg0.

Step 4: Enable 44Net Connect tunnel

Go to the Single Device Tunnel tutorials list, and follow the quick start tutorial for your distribution.

Optional: Split Tunnel

There are special considerations for operating a 44Net Connect split tunnel on a device with AllStarLink. Nodes register with the central coordination server and report statistics by contacting register.allstarlink.org and stats.allstarlink.org. For the node to be registered with your static 44Net IP, these communications must go out through your VPN tunnel, which by by default they will not. These domains don't have static IPs, so you'll need to deploy a watchdog service to create and update routing rules based on the DNS. The following systemd unit will do this. Place it in /etc/systemd/system/. 

[Unit]
Description=Maintains rules that route traffic to AllStarLink domains through the 44Net split tunnel
Requires=network-online.target
After=network.target network-online.target
Before=asterisk.service allmon3.service

# Change this to the name of your split tunnel service
Requires=wg-quick@wg0-st.service

[Service]
Type=exec

# Make sure you copy the script to this path exactly, or change the path here
ExecStart=/opt/allstarlink/st-routing-watchdog.sh

[Install]
WantedBy=multi-user.target


This systemd unit depends on the following script being placed in /opt/allstarlink/st-routing-watchdog.sh The /opt/allstarlink directory is not automatically created. Make it with sudo mkdir /opt/allstarlink before placing the file there. 

#!/usr/bin/bash

# Change this if you use a different routing table for your WireGuard interface
WG_TABLE=51820

# Initialize variables
REGISTER_IPS=""
STATS_IP=""

del_rules () {
	echo "Deleting stats rule for $1"
	ip rule del to "$1" lookup $WG_TABLE

	while IFS= read -r line || [[ -n $line ]]; do
		echo "Deleting register rule for $line"
		ip rule del to "$line" lookup $WG_TABLE
	done < <(printf '%s' "$2")
}

cleanup () {
	echo "Received $1, cleaning up rules and exiting."
	del_rules "$2" "$3"
}
while
	# Note that there are multiple IPs for register.allstarlink.org
	REGISTER_IPS_NEW=$(dig +short register.allstarlink.org)
	STATS_IP_NEW=$(dig +short stats.allstarlink.org)


	echo "$REGISTER_IPS_NEW"

	# Ensure records are not null
	if [[ $REGISTER_IPS_NEW == "" ]]; then
		echo "DNS resolution error for register.allstarlink.org"
		exit 2
	fi;

	if [[ $STATS_IP_NEW == "" ]]; then
		echo "DNS resolution error for stats.allstarlink.org"
		exit 2
	fi;

	# Fetch TTLs for DNS A records
	REGISTER_TTL=$(dig register.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
	STATS_TTL=$(dig stats.allstarlink.org | grep "ANSWER SECTION" -A1 | awk 'NR==2{print $2}')
	echo "register.allstarlink.org resolves to  $REGISTER_IPS_NEW"
	echo "stats.allstarlink.org resolves to     $STATS_IP_NEW"
	echo
	echo "TTL of register.allstarlink.org:      $REGISTER_TTL"
	echo "TTL of stats.allstarlink.org:         $STATS_TTL"

	# Use smaller of the two TTLs
	if (( REGISTER_TTL > STATS_TTL )); then
		FINAL_TTL=$STATS_TTL
	else
		FINAL_TTL=$REGISTER_TTL
	fi;


	# If new IPs don't match old IPs, replace rules.
	if [[ $REGISTER_IPS == "$REGISTER_IPS_NEW" && $STATS_IP == "$STATS_IP_NEW" ]]; then
		echo "IPs have not changed. Rules will not be updated."
	else
		echo "IPs have changed. Updating rules."

		# Create routing rules
		# Putting this before deletion of old rules to prevent race condition routing leakage.
		# This while loop to read each line from REGISTER_IPS_NEW is from
		# https://superuser.com/questions/284187/how-to-iterate-over-lines-in-a-variable-in-bash
		while IFS= read -r line || [[ -n $line ]]; do
			ip rule add to "$line" lookup $WG_TABLE
		done < <(printf '%s' "$REGISTER_IPS_NEW")

		ip rule add to "$STATS_IP_NEW" lookup $WG_TABLE

		# Don't try to delete old rules on first iteration bc they don't exist yet
		if [[ $REGISTER_IPS != "" ]]; then
			del_rules "$STATS_IP" "$REGISTER_IPS"
		fi;



		REGISTER_IPS=$REGISTER_IPS_NEW
		STATS_IP=$STATS_IP_NEW
	fi;

	# Delete routes when program is stopped
	trap 'echo "Received SIGINT, cleaning up rules and exiting."; \
		del_rules $STATS_IP $REGISTER_IPS' SIGINT

	trap 'echo "Received SIGTERM, cleaning up rules and exiting."; \
		del_rules $STATS_IP $REGISTER_IPS' SIGTERM

	# Sleep for duration of TTL
	echo "Sleeping for $FINAL_TTL seconds"
	echo
	sleep "$FINAL_TTL"

do true; done

After installing these files, make the script executable by running sudo chmod +x /opt/allstarlink/st-routing-watchdog.sh, then enable the systemd unit with sudo systemctl enable asl-st-routing-service --now. Verify that the service has started properly by running systemctl status asl-st-routing-service.

Finally, you'll need to specify the IP that asterisk binds to. Open /etc/asterisk/iax.conf and uncomment the line with the bindaddr field. Set it to your device's 44Net Connect IP, as specified in the WireGuard configuration file. Save the configuration changes, and restart asterisk with sudo systemctl restart asterisk.

Step 5: Verify functionality

asl-node-auth-check

Note
If you're using a split tunnel, asl-node-auth-check may report your non-tunneled IP address in the connectivity check. This is acceptable and not indicative of a configuration issue.

AllStarLink comes with the asl-node-auth-check utility that automatically evaluates your connection and registration status. It must be run as superuser. SSH into your ASL3 node and run sudo asl-node-auth-check. If there are no errors, your node is correctly registered. Warnings should be addressed if possible.

If you're using a split tunnel, and receive a warning that your node is not perceived as registered despite it showing up as registered in your AllStarLink portal, you may have forgotten to modify the asterisk bind address.

Allmon3

Commands can be issued to your AllStarLink node from the AllMon3 web interface available on port 443 of your node. (This is the default HTTPS port, so you can access it in a web browser without specifying the port.) It uses a self-signed certificate, so your browser may inform you the site is insecure, and you'll need to add a security exception for the site. Log in with your administrator account, and click the chain button to open the linking commands dialogue.

A cropped screenshot of the Allmon3 web dashboard, with the linking commands button for a node highlighted using a red box.

Look up a node to connect to for testing purposes, using AllStarLink node search or a third party site like RepeaterBook. In the linking command dialogue, select the connect command, type in the node number, and select "No" for whether the connection is permanent.

A screenshot of the linking commands dialogue in Allmon3. The selected command is "Connect," the node is "12345," and the connection is not permanent.

After you issue the connect command, if the connection succeeds, the state will change to "ESTABLISHED" in your connection table. If it stays on connecting for a while and then disconnects, try another node. If the command shows an error in the dialogue instead of proceeding to connecting, see the troubleshooting section at the bottom.

A screenshot of the Allmon3 dashboard, showing that the user's node is connected to node 47178. The direction is "OUT," and the connect state is "ESTABLISHED."

Once the connection is established, you can disconnect using the button all the way to the left. (It's very low contrast, but turns red when moused-over.

A screenshot of the Allmon3 dashboard, showing that the user's node is connected to node 47178. The direction is "OUT," and the connect state is "ESTABLISHED." The disconnect button is highlighted with a red square.

VoIP: Droidstar

Connectivity can be verified by connecting to your AllStarLink node with a VoIP app. People with android phones can use Droidstar with the following steps:

  1. Install DroidStar from the Google Play store
  2. Obtain your node's password from the AllStarLink portal
  3. Go to DroidStar settings, and configure your callsign and ASL password.
  4. Go to the Hosts tab and add a line that says IAX <node number> wt.
  5. Go to the Main tab, select IAX using the drop-down menu at the top, and select your node number using the drop-down menu under the mode menu. Press connect, and it should connect in a few seconds.

If connection is successful, the button will change to "Connected" and through your client you'll hear the node announce your connection. If DroidStar remains "Connecting" for more than 30 seconds, you probably have a configuration issue.

VoIP: RepeaterPhone

RepeaterPhone is a paid iOS VoIP app that lets you connect directly to AllStar nodes. It can be used to test the functionality of your node after setup.

  1. Download RepeaterPhone
  2. Go to Settings > Accounts and click "New Account."
  3. Click on the AllStarLink logo, and fill in the callsign and password you use to access the AllStarLink portal. Click "Add Account" at the bottom.
  4. Go to the Directory tab, and look up your node by number or callsign.
  5. Click on it, then click the big "Connect" button.

On a successful connection, the node should read out the node number to you. If it fails to connect, or gets stuck on calling for more than 30s, you may have a configuration error. In that case, consult the troubleshooting section at the bottom.

Troubleshooting

AllStarLink has a troubleshooting guide. This section includes additional troubleshooting tools, and does not duplicate any of the official recommendations.

Command Error, undefined when executing linking commands in Allmon3

According to this ASL forum thread, this error happens when your host IP is set incorrectly in /etc/allmon3/allmon3.ini. It should be set to 127.0.0.1.

Split Tunnel: VoIP app gets stuck on connecting

The first step to debugging this issue is determining whether the root cause is firewall configuration or asterisk/routing configuration. Connect to the asterisk remote console using sudo asterisk -r, then enable IAX2 debugging by running iax2 set debug on in the asterisk console. Then, connect to the node with your VoIP app. If exactly one Tx frame and one Rx frame make it through, the issue is likely with the routing of the server response. If no packets make it through at all, the issue is likely with firewall configuration.

If you suspect a firewall issue, verify that your firewall configuration allows inbound UDP traffic on your IAX port. ASL3 appliance users can add the included iax2 service to the firewalld zone for their 44Net Connect tunnel by running sudo firewall-cmd --zone <zone> --add-service iax2 && sudo firewall-cmd --reload.

If the firewall configuration is correct, and the app still can't connect, the issue may be with the routing of the server response. This usually happens if you forget to set the bindaddr to your 44Net IP in /etc/asterisk/iax.conf. This issue can be affirmatively detected by running Wireshark or dumpcap on your non-44Net interface, attempting a connection from your app, and looking for IAX packets originating from your non-44Net IP address.

References

  1. ↑ The ASL3 source is available on GitHub, though installing from source is not recommended.
Retrieved from "https://wiki.ampr.org/w/index.php?title=AllStarLink&oldid=3146"