I have a Clearnode operating on a Starlink ISP. I have initiated a 44Net Wireguard tunnel to an Ubuntu Server on my local network and routed the tunnel to that server. I added iptables to route the tunnel traffic over to the Clearnode ip address on port 4569. I have pinged through the system from the WAN via the tunnel and then to the Clearnode to verify the paths are functioning. However, when I use "asterisk -rx "rpt show registrations" the perceived IP is Starlink, not the tunnel.
44Net Connect shows the tunnel connected and passing traffic. I can see the traffic on my server.
AI thinks I should be able to get on Allstarlink.org and assign the tunnel ip to my server but the only place I can see for this is the "proxy address" box in the server settings. I tried it but it didn't work.
How do I get Allstarlink servers to route my traffic to the tunnel? I only need the "connect requests" coming in from the internet to reach port 4569 of the Clearnode so that my friends can connect to my node.
You don't assign it. It's perceived as labeled. Look at rpt show registrations and it should show your 44Net Connect IP. If it doesn't, then your tunnel routing isn't working correctly for HTTP and IAX.
Ok, that was my impression in that the Allstarlink server would see the WAN ip address. So if the Allstarlink server is perceiving my WAN address and not the Tunnel's address, then it's because the node is not being presented on the Tunnel.
The implementation of the Wireguard tunnel on a separate server (which is what I've done) does not present an actual node to the tunnel, only packets being relayed on the local network between the interposing server and the node. So now I'm questioning whether an interposing server can actually work. The iptable rules I'm using on the server are meant to identify packets to and from the node via the 4569 port and those are to be routed via the server in and out the tunnel.
Most of the guidance I am seeing deals with implementing the Wireguard tunnel on the actual machine serving ASL3 and Asterisk. In the case of the Clearnode device, Node-Ventures maintains templates that overwrite configuration files with their own data and thus I am concerned that it may be useless to try to load and implement Wireguard on the node itself. I did talk to the proprietor of Node-Ventures about it and he said to try it and see if it works. But the alternate possible solution of using a different server on the local network as a sub-router for the Clearnode basically removes any need of altering the configuration of the Clearnode. That is why I have tried it.
I have not found anyone yet who has managed to implement the 44Net Connect and Wireguard tunnel on the Clearnode. If you know of anyone or know of it yourself, please let me know. In addition to that, I only have experience forwarding ports with rules through common routers and no experience with Tunnels or Wireguard at all. This is a learning experience for me.
The Clearnode itself shows the WAN ip to be the Starlink WAN address. In the way I have configured the system, the Clearnode should actually be seeing the Ubuntu Server ip as it's WAN address. Wouldn't that make sense?
You would need the Wireguard tunnel on your next-hop device. If it's a Clearnode connected directly to a Starlink, that won't work very well. You could do a regular node on a Starlink or you'd have to put something in the middle and deal with a double-NAT situation.
No. If the Clearnode is registering directly over it's default route, and the next hop default route is a Starlink, Starlink it what will be seen.
What it sounds like you want to do is make your clearnode a private node, make your Ubuntu Server a hub, connect your Clearnode to the Ubuntu hub as a private connection and then have people connect to your hub node.
Actually, my intent was to continue to use the Clearnode and its fancy iphone app because it's so convenient. The Wireguard tunnel was an attempt to get around the Starlink mess. I had previously tried operating Starlink on bypass direct to my own router where I could simply port forward 4569. I could not get it to work even though I upgraded my Startlink subscription to provide me with a single WAN ip address. But my next action if I cannot get this to work would be to drag out one of my spare Raspberry Pi's, implement it as an ASL node, and use the nice instructions in the Allstarlink manual to implement Wireguard....the point being I would have a better chance of having a node that other hams could connect to....I don't have that right now.
So it looks like ASL3 uses the HTTPS POST sent to register.allstarlink.org to determine the node's ip address by inspecting the Layer 3 TCP/IP packet. So if Wireguard is installed on the node itself, this "perceived" address would be the Tunnel IP. Otherwise, the HTTPS POST that is sent every 3 minutes would have to be intercepted and edited...I don't think that's going to happen. If Allstartlink had a method of bypassing this 'perceived' IP address and could accept a assigned IP, methods similar to the one I am experimenting with could be made to work.
There are probably plenty of good reasons why Allstarlink does it in this way and I don't pretend to know what all those reasons are. But I think I am wasting my time trying to Tunnel from a machine that is not a node. Live and learn...