How to Put Your AllStar Node on 44Net Connect

 

Recently a blog reader, Will WY7WL reached out about putting his Allstar node on to 44Net.  He was running into issues with connectivity to his node since it was behind CGNAT and wanted to see if he could adapt the 44net-cloud-wireguard-rpi script I had on Github for his application.  As I began testing it for him, I saw several things that needed to be customized to make the script work with the HamVoIP software, including making sure the software was at a current version, employing iptables for better compatibility and tweaking firewall settings to support Supermon. 

So, I have created a special script to support this Allstar HamVoIP that handles everything soup to nuts and it is located at https://github.com/n3bkv/hamvoip-wireguard/blob/main/setup_hamvoip_wireguard.sh

I also have an ASL3 version that Will help me test (since I do not run ASL on any of my own nodes).  That is available at - https://github.com/n3bkv/asl3-wireguard/blob/main/asl3-wg-setup.sh

Why Use 44Net and WireGuard for AllStar?

If you’re running an AllStarLink node — especially behind CGNAT (like Starlink or LTE/5G) getting reliable connectivity into the wider AllStar network can be tricky. Traditional port forwarding often fails because you don’t control your public IP and it can be changed randomly by your ISP. Enter 44Net Connect and WireGuard — a simple, robust way to tunnel your node into the global AllStar network with a routable IPv4 address.

AllStarLink nodes expect global reachability if you want people to be able to “dial-in” and connect directly to your node. But if you’re behind a CGNAT which is common with consumer satellite, LTE or mobile ISPs then your node won’t be reachable and registration may fail. 

A WireGuard tunnel to a provider like 44Net Connect gives you:

- A stable public IPv4 address reachable by other nodes

- Reliable UDP connectivity (critical for AllStar’s IAX/UDP protocol)

- Simplicity - no router NAT or firewall setup required

This post walks you through putting your AllStar node on 44Net Connect using the hamvoip-wireguard and asl3-wireguard scripts on my Github. My goal is to automate much of the command line setup for you.

Requirements

Before you begin, make sure you have:

- A running HamVoIP or ASL3 AllStar node (on Raspberry Pi) – it is important that you create a backup of your SD card before you begin in case you run into any issues. You can use Win32 Disk Imager, balenaEtcher or the dd command (if you feel comfortable in command line).

- Root/console access to the node

- A basic familiarity with the Linux command line, but don’t be scared since you have a backup (you didn’t skip that step did you?) and I’ll walk you through step by step.

- 44Net Connect Account – this has been updated since my previous script’s discussion on this so here is the new process to get setup and secure a tunnel.

Step 1 – Set Up Your 44Net Account

Start by creating an account on the main 44Net portal. Follow the instructions here:

https://wiki.ampr.org/wiki/GetStarted

Just complete steps 1–3 for now.

Once your account is set up, go to the 44Net Connect portal and register at https://connect.44net.cloud/

Step 2 – Create Your Tunnel

After setting up your account, log in, select Tunnels, click “Request Tunnel.” Then pick the region closest to your location. If you see multiple node options, pick the one with the least number of current tunnels for best performance.

You’ll then see a screen like the one below. We’ll fill it out shortly. Go ahead and run the script on your Rpi now.

Script Use - Step-by-Step Setup

1) Download the Setup Script

Log into your node via SSH or console and download the setup script needed for your current node type.

HamVoiP

Type:

curl -O https://raw.githubusercontent.com/n3bkv/hamvoip-wireguard/main/setup_hamvoip_wireguard.sh

chmod +x setup_hamvoip_wireguard.sh

ASL3

Type:

curl -O https://raw.githubusercontent.com/n3bkv/asl3-wireguard/main/asl3-wg-setup.sh

chmod +x asl3-wg-setup.sh

2) Run the Installer

HamVoiP

Run the script as root:

sudo ./setup_hamvoip_wireguard.sh

ASL3

sudo ./asl3-wg-setup.sh

These scripts will:

- Install WireGuard safely on your HamVoip or ASL3 system

- Handle package conflicts with wireguard-tools

- Prompt for your 44Net Connect tunnel details

- Inject your private key into the WireGuard config

- Generate matching public/private keys

- Optionally configure a firewall tailored for your AllStar environment

3) Script walkthrough

From here on out I will walk through the HamVoiP script, the ASL3 script output will look similar:

First the script will make sure any software dependencies or upgrades are taken care of for you. If anything needs to be installed it will prompt you throughout the process.

Example output:

==== 1) Check for HamVOIP/Arch updates (and kernel packages), upgrade if needed ====

==== Refreshing package databases (pacman -Sy) ====

:: Synchronizing package databases...

 hamvoip-RPi4B14 is up to date

 core is up to date

 extra is up to date

 community                  4.0 MiB  3.66M/s 00:01 [######################] 100%

 alarm is up to date

 aur is up to date

 hamvoip                   15.5 KiB  0.00B/s 00:00 [######################] 100%

Updates available:

------------------------------------------------------------

argon2 20161029-3 -> 20190702-1

hamvoip-hamlib 0.4.6.3-1 -> 0.4.6.4-1

php-ioncube 7.0.4-1 -> 7.0.4-4

------------------------------------------------------------

Install these updates now? [Y/n] y

==== Upgrading packages (pacman -Su) ====

:: Starting full system upgrade...

resolving dependencies...

looking for conflicting packages...

Packages (4) argon2-20190702-1  hamvoip-hamlib-0.4.6.4-1  libsodium-1.0.20-1

             php-ioncube-7.0.4-4

Total Download Size:   7.22 MiB

Total Installed Size:  0.11 MiB

Net Upgrade Size:      0.00 MiB

:: Proceed with installation? [Y/n] Y

:: Retrieving packages...

 argon2-20190702-1-a...    91.9 KiB  1532K/s 00:00 [######################] 100%

 libsodium-1.0.20-1-...   217.7 KiB  2.36M/s 00:00 [######################] 100%

…

(4/4) upgrading php-ioncube                        [######################] 100%

==== Post-upgrade kernel check ====

Running kernel:  5.4.75-1-ARCH

Newest modules:  extramodules-5.4-raspberrypi4

Modules present for running kernel? YES

Installed module dirs:

  - 5.4.75-1-ARCH

  - extramodules-5.4-raspberrypi4

A newer kernel/modules appear to be installed on disk than you're currently running.

  Running: 5.4.75-1-ARCH

  Newest:  extramodules-5.4-raspberrypi4

After everything is installed it will prompt you to reboot. 

Reboot now to load the latest kernel before WireGuard setup? [Y/n] Y

Rebooting...

After the reboot, reconnect and then run the script again. It will check again for upgrades and then go to the next step.

[root@sharipi var]# sudo ./setup_hamvoip_wireguard.sh 

==== 0) System and kernel sanity check ====

…

==== 1) Check for HamVOIP/Arch updates (and kernel packages), upgrade if needed ====

==== Refreshing package databases (pacman -Sy) ====

:: Synchronizing package databases...

 hamvoip-RPi4B14 is up to date

 …

No package updates available.

It will then install WireGuard for you, check the install and generate the keys you’ll need to set up your 44Net Connect tunnel and prompt you to save your keys. Make sure you keep this someplace safe on your drive. Then press Enter.

==== 2) Install WireGuard packages (conflict-safe) ====

==== HamVOIP WireGuard bundle detected (hamvoip-wireguard). Installing bundle and avoiding wireguard-tools conflict. ====

resolving dependencies...

looking for conflicting packages...

Packages (1) hamvoip-wireguard-5.4.75-3

Total Download Size:  0.14 MiB

:: Proceed with installation? [Y/n] Y

:: Retrieving packages...

 hamvoip-wireguard-5...   139.8 KiB  1398K/s 00:00 [######################] 100%

(1/1) checking keys in keyring                     [######################] 100%

…

:: Processing package changes...

(1/1) installing hamvoip-wireguard                 [######################] 100%

>>> Updating module dependencies. Please wait ...

:: Running post-transaction hooks...

(1/1) Updating linux-raspberrypi4 module dependencies...

==== 3) Verify WireGuard kernel support ====

WireGuard kernel support OK

==== 4) Generating WireGuard keypair ====

Your new WireGuard keys (save these securely):

  Private key: +xxx= (redacted)

  Public  key: vxxx= (redacted)

>> Copy the PUBLIC key and paste it into the tunnel setup prompt on your 44Net Cloud endpoint.

Press Enter to continue...

Next just press enter for the interface name and if it finds an old key file, press Y to back it up.

==== 5) Choose interface name ====

Enter interface name to create (default: wg0): 

An existing config /etc/wireguard/wg0.conf was found.

Backup and overwrite it? [Y/n] Y

We are now going to go back to our browser window and fill out the WireGuard information below.  You’ll want to name your tunnel, paste your public key that you saved previously and then click create tunnel.

Next, you will copy the information from the portal to paste back into the script.

Example 44Net WG Config

You’ll see something like this, that you’ll want to copy:

[Interface]

PrivateKey = <auto-generated>

Address = 44.xx.xx.xx/24

DNS = 1.1.1.1,1.0.0.1

MTU = 1380

[Peer]

PublicKey = <from-44Net-server>

Endpoint = x.x.x.x:xxxx

PersistentKeepalive = 20

AllowedIPs = 0.0.0.0/0

Key notes:

MTU = 1380 helps prevent fragmentation on Starlink/LTE/CGNAT links.  Will reported that he needed to modify MTU to 1280 for T-Mobile so if you are having issues, you might need to experiment here.

Now you are going to paste this into the script, type EOF and then hit return..

==== 6) Paste your WireGuard config below (IPv4 ONLY) ====

IMPORTANT: This script enforces IPv4-only by keeping only IPv4 entries in:

  - Address =

  - AllowedIPs =

Any IPv6 items (fe80::..., ::/0, etc.) will be removed automatically.

Example (IPv4-only):

[Interface]

PrivateKey = REPLACE_ME

Address = 44.xx.xx.xx/24

DNS = 1.1.1.1,1.0.0.1

MTU = 1380

[Peer]

PublicKey = ProvidedByServer

Endpoint = x.x.x.x:xxxxx

PersistentKeepalive = 20

AllowedIPs = 0.0.0.0/0

Example paste

[Interface]

PrivateKey = REPLACE_WITH_YOUR_PRIVATE_KEY

Address = 44.xxx.xxx.xxx/32

DNS = 1.1.1.1,1.0.0.1

MTU = 1380

[Peer]

PublicKey = uxxx=

Endpoint = 44.xxx.xxx.xxx:xxxxx

PersistentKeepalive = 20

AllowedIPs = 0.0.0.0/0

EOF

Now you’ll see a confirmation, and if everything looks good, press Y and enter to confirm.

==== 7) Final config preview (wg0.conf) (IPv4-only) ====

------------------------------------------------------------

[Interface]

PrivateKey = +xxx=

Address = 44.xx.xxx.xxx/32

DNS = 1.1.1.1,1.0.0.1

MTU = 1380

[Peer]

PublicKey = uxxx=

Endpoint = 44.xx.xxx.xxx:xxx

PersistentKeepalive = 20

AllowedIPs = 0.0.0.0/0

------------------------------------------------------------

Accept and install to /etc/wireguard/wg0.conf? [Y/n] Y

Next the script will bring up the WireGuard tunnel for you.

==== 8) Bringing interface up: wg-quick up wg0 ====

[#] ip link add wg0 type wireguard

[#] wg setconf wg0 /dev/fd/63

[#] ip -4 address add 44.xxx.xxx.xxx/32 dev wg0

[#] ip link set mtu 1380 up dev wg0

[#] resolvconf -a wg0 -m 0 -x

[#] wg set wg0 fwmark 51820

[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820

[#] ip -4 rule add not fwmark 51820 table 51820

[#] ip -4 rule add table main suppress_prefixlength 0

[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1

[#] iptables-restore -n

Interface wg0 is up. Current status:

interface: wg0

  public key: vxxx=

  private key: (hidden)

  listening port: xxx

  fwmark: xxx

peer: uxxx=

  endpoint: 44.xxx.xxx.xxx:xxx

  allowed ips: 0.0.0.0/0

  latest handshake: Now

  transfer: 92 B received, 356 B sent

  persistent keepalive: every 20 seconds

You now have the option to make the tunnel start on boot

Enable auto-start at boot for wg0? [Y/n] Y

Enabled: wg-quick@wg0.service

Optional Firewall Lockdown

I highly encourage you to lock down your environment by using strong passwords for your node as well as taking advantage of the optional firewall setup steps in the script. It can enable iptables rules to harden your node. It blocks everything by default except:

- Loopback

-  Established/related connections

-  ICMP ping

-  SSH/HTTP (from trusted LAN ranges)

-  Relevant UDP for AllStar (4569) and EchoLink (if used) 

Be careful: enabling the firewall while connected via a public IP SSH session can lock you out. Use your local console or LAN access if possible.

If you get locked out, you can reset via console:

iptables -P INPUT ACCEPT

iptables -F

Next you can lock the node down using best practice firewall rules. The script will prompt you through the process asking you what services you’ll be running (Allstar, Echolink, etc).  You can add any custom ports that you want open here and then will see a confirmation of your choices that you’ll need to confirm.  Then the script will give you some information and tips and will exit. 

==== 9) Optional firewall lockdown (iptables) ====

This step is OPTIONAL and will:

  - Block all inbound ports except your selected services and any extra ports you define

  - Restrict SSH to private LANs only (10/8, 172.16/12, 192.168/16)

==== Firewall lockdown options (iptables) ====

This is a DEFAULT-DENY inbound firewall.

SSH will be allowed ONLY from private LAN ranges (10/8, 172.16/12, 192.168/16).

Allow AllStar ports (recommended for AllStar nodes)? (udp/4569) [Y/n] Y

Allow EchoLink ports (recommended if you run EchoLink)? (udp/5198-5199, tcp/5200) [Y/n] Y

Suggested port sets you might want to allow (in addition to SSH-from-LAN):

  1) AllStar (IAX2):                  UDP 4569

  2) EchoLink:                        UDP 5198-5199, TCP 5200

  3) Web (HTTP/HTTPS):                TCP 80, TCP 443

  4) Node-RED Dashboard (common):     TCP 1880 (Node-RED), TCP 3000 (Grafana), TCP 8086 (InfluxDB)

  5) Asterisk/SIP (if you use it):    UDP 5060-5061, TCP 5060-5061 (optional)

Do you want to add custom extra inbound ports beyond the defaults? [y/N] N

Inbound ports that will be allowed:

  - SSH from LAN only (tcp/222)

  - AllStar:  udp/4569

  - EchoLink: udp/5198-5199, tcp/5200

Everything else inbound will be BLOCKED.

WARNING: If you are SSH'd in from a PUBLIC IP, enabling this will lock you out.

Make sure you have console access or you are on a private LAN before continuing.

Apply this firewall now? [y/N] Y

Applied iptables lockdown.

Saved rules to /etc/iptables/iptables.rules

Enabled iptables-restore.service (restores /etc/iptables/iptables.rules at boot)

Installed + enabled iptables-verify.timer (boot + every 5 minutes).

Recovery (console):

  sudo iptables -P INPUT ACCEPT; sudo iptables -F

==== All done! ====

Config file: /etc/wireguard/wg0.conf

Tips:

  - View status:      wg show wg0

  - Bring down/up:    wg-quick down wg0 && wg-quick up wg0

  - Show firewall:    iptables -S

  - Check verifier:   systemctl status iptables-verify.timer --no-pager; journalctl -t iptables-verify --no-pager -n 50

Exiting.

Final Steps

After setup completes:

Verify WireGuard status

wg show wg0

If you need to stop and restart the tunnel.

wg-quick down wg0

wg-quick up wg0

If you selected no to start at boot and want to enable it later.

systemctl enable wg-quick@wg0

Once the tunnel is up, check that your AllStar node registers properly from its new public IP and joins the wider Allstar network reliably.

Tips & Best Practices

If using Starlink or mobile ISPs, the stable IPv4 via 44Net means fewer node dropout issues. 

MTU tuning (e.g., 1280 vs 1380) may need adjustment depending on your ISP’s encapsulation. 

Make sure AllStar’s IAX/UDP and status HTTP traffic route through the WireGuard tunnel to avoid registration mismatches. 

A Possible Issue

One thing Will ran into, that I could not duplicate was when his Raspberry Pi booted up sometimes it was too slow to pick up the Wireguard tunnel address.  He found a simple solution though.  

Just type this:

crontab -e 

@reboot sleep 120 && /usr/bin/wg-quick up wg0

This crontab entry tells the system to wait 120 seconds after the machine boots, then automatically bring up the WireGuard VPN interface wg0 using wg-quick.

The delay helps ensure networking and DNS are fully initialized before WireGuard starts, reducing startup failures after reboot.

Wrapping Up

Using 44Net Connect with WireGuard is one of the most resilient ways to expose your AllStar node to the network when a conventional public IP isn’t available. The hamvoip-wireguard simplifies this process greatly — handling keys, configs, optional firewall rules, and more. 

If you found this helpful, star the GitHub project and share with other hams looking to get their nodes reliably connected!

73