BACKGROUND:
Raspberry Pi ASL Node 601030 was previously running as an ASL HUB NODE at location #1, behind a NAT router using port-forwarding for TCP:80, UDP:4570 (IAX), TCP:22, TCP:9090, TCP:5800, TCP:8000. Raspberry Pi ASL Node 601031, which is the actually controller for the UHF repeater, was also previously running on location #1’s same local LAN subnet, connected by a point-to-point (bridged) 5GHz Ubiquiti Wi-Fi dish to location #2. The reason for this was because 601031 had an Internet connection using CG-NAT where port-forwarding through its NAT router was impossible.
The CG-NAT problem has now been resolved by using 44NetConnect for node 601031 (public-static IP and a Wireguard tunnel) and it is now connecting just fine, independently, to the ASL portal. The PTP Wi-Fi bridged LAN connection has been dismantled.
PROBLEM:
Now that 601030 and 601031 are on separate LANs, I remove the “radio” statements from each’s respective RPT.CONF configurations so they don’t look to the LAN IP addresses for each other. And they see each other in their respective /var/lib/asterisk/rpt_extnodes files for WAN IPs, so that’s fine. Since 601031 is now out on the public Internet, I configured on its Raspberry Pi both key-based authentication for SSH, and UFW (Uncomplicated Firewall). UFW is currently setup to allow TCP:22, but key-based authentication only, insteada of username+password. UFW is also configured to allow UDP:4572 for the port it's using for IAX. At this time, I do not allow TCP:80 through the firewall, but did open it up temporarily only to test Supermon.
The problem seems to be the 601030 node, now that it is no longer operating as a HUB Node. When 601030 is connected to 601031 via Supermon, if an admin goes to IAX on 601030, the repeater at 601031 comes up fine. However, if 601030 is disconnected via Supermon with 601031, going to IAX on 601030, the admin is *not* able to key-up on the 601031 repeater. IOW, having 601030 and 601031 connected via Supermon is the only way that IAX will let the admin transmit on 601030. When both nodes were on the same LAN subnet, this worked fine.
As a control test, there is a third ASL Node 601033. This is a private node also at location #1 behind the same NAT router. When the admin goes to it over IAX, he can key-up the repeater at 601031 no problem.
Therefore, the real issue seems to be with the 601030 node specifically. If I had to guess, I think that there is still something in 601030's RPT.CONF config that alludes to it being a hub on the same LAN subnet as 601031, even though that is no longer the case.
I can attach the two, relevant RPT.CONF files here for evaluation. What I would like to know is:
1: Is there a way of correcting 601030 to where it can connect to 601031 via IAX withOUT having to have TCP:80 open on the 44.x.x.x firewall for Supermon? If not, is there an easy way of renumbering node 601031 to be the (published) node number of 601030, and we'll just decommission the current 601030 that was previously acting as a Hub node? The node number 601030 is published all over the place, and is the public-facing node number of our club's repeater.
2: For either the public-static 44.x.x.x nodes, or even those behind a NAT, all I really want to have open are SSH and IAX. I do not think it's a good idea to have open via firewall for a public-static, nor via port-forwarding on a NAT router, for TCP:80 for Supermon, nor TCP:9090 for Cockpit, nor TCP:5038 for Asterisk Manager. Best Practice would indicate these ports are only for administration when nodes are on the same local (and protected) LAN subnet. Can you confirm or deny this perception?
Thank you very much for your consideration and assistance!