I have three nodes at my residence and need to get away from my current ISP each currently has a static ip. I'm thinking of going to Starlink but need to know if it's even doable because of their configuration and the fact you can't get static ip's from them.
Jeff
W6JSO
Starlink uses Carrier-Grade NAT. You can do ASL behind it but you have to use a VPN.
I highly recommend the "44 Net Connect" solution. This gives each node a public IP Address. HOWEVER, BE CAREFULL!!! You will not have the protection of a router. Read the instructions about closing ports and only open the ones you need before starting the 44 Net Connect. e.g. do not leave port 22 open on the public IP address.
Roger
WA1NVC
Would Tailscale do this job for you? It is a tunneling (?) service. I am trying to get my ASL3 set up myself and not having much luck. I loaded Tailscale to the RPi and the computers I want to use for ASL. I did not have to open ports on my router. Ultimately I would like to be able to do the same thing as the OP, with a bit of a twist.
Starlink doesn’t allow residential port forwarding as it uses commercial CGNAT you woukd need a VPN or get the business plan to get a private IP
Technically Tailscale is not a tunneling service. There are two things that go by the name tailscale:
When they say VPN-as-a-service; this is different than a commercial VPN service like Nord or something. Tailscale themselves do not provide exit nodes to the internet. What they provide is the software and infrastructure that allow your VPN devices to talk. In fact the actual core VPN technology is just Wireguard; Tailscale provides "cloud connectivity", as well as things to punch through firewalls.
I've never actually played with it because my OpnSense router has Wireguard built-in; so with just a dynamic DNS host Tailscale is completely redundant for me. I have a way to find my IP and I have the ports open for things to make direct wireguard connections.
In order for Tailscale to work as a tunnel; you need to have some kind of exit server you control that has it's own IP...or something you might share with friends and agree on who uses what port. The point is...tailscale on it's own only gives you the ability to make a tunnel; you need to provide the other end. They just make it so your devices can connect through firewalls with zero-configuration. They do also provide relay servers that will bounce the encrypted packets when direct connections can't work....at the expense of speed and latency. And...for a fee apparently...they've started offering NordVPN hosted exit nodes. But....those won't help since you'll basically be suffering the same problem; it's a NAT IP you won't control; so it's not suitable for ASL.
The cheapest solution is probably a 44 Net Connect tunnel...as AFAIK it doesn't cost anything. It gets you a public routable IP over a Wireguard tunnel. Is it easy? Maybe? I've looked at their Wiki...and I'm likely a horrible judge given what I've done with networking.
The second cheapest would be to get a cheap VPS from a provider. I have one that cost me $11USD a year that is part of my VPN network. It's low-CPU, low-ram, low-storage, and the network port is shared; but it's unmetered and the latency has held steady. This lets you build a tunnel you 100% control...at the "expense" of having to build it yourself. This is the point Tailscale actually comes in handy because it would avoid having to setup a Wireguard server; but there's still things like NAT rules you have to make on the VPS. So it's understandable if that's not attractive to most people.
I use ZeroTier for my private VPN needs. It basically behaves like a virtual ethernet switch; so there's no IP routing rules for peers or any of that nonsense. It behaves on the devices as a literal network. You join them to your network, authorize them on your controller, give them an IP out of your /16, and that's it. It can now talk to every other device on the VPN in a peer-to-peer/mesh fashion. But since it's just a layer2 network...we can just use normal routing rules to work with it. All of my ZT devices can talk to my lan network by just adding a route to it through my home router's ZT ip. I can jump on hotel wifi, physically bridge ZT to my ethernet port, and while I have to manually configure the IPs (because I haven't built that side of stuff yet)....it just talks to the PBX like it was on the LAN. (Excluding direct_media from the trunk because I'm not THAT good to cross-network that). Sure...my ZT VPN does have it's own /16; technically it's just a layer2 virtual switch so you can toss whatever other non-conflicting ranges you want. Much like tailscale...it too provides the same "get it through" levels of connectivity; using UDP to punch through firewalls and....well I mean it worked on hotel wifi. It will also use IPv6 if it can...which is handy on a lot of CGNAT networks because you'll get real IPv6.
Getting this to work with ASL3 however is probably far beyond the scope of what most people will want to do. It involved flagging all traffic generated by Asterisk and applying a custom routing table to the flagged packets that has one of my ZT nodes as the default gateway. It was a lot of rules and scripts to make sure the rules are applied after reboot...as well as exempt DNS from the custom table. The VPS on the other end is just configured to allow traffic out to the internet from ZT and a port forward over the ZT for the IAX port.
The side effect is that if I take my ASL3 node (or one of my mmdvm hotspots since they're on it too) to some random network; I don't have to play "find the IP"....they'll just be on the ZeroTier; and they'll still be directly connectable.
44net would be easier and probably work better for most people, but I have several nodes forwarding via Tailscale through an exit node, which is a VPS with a properly configured iptables that does all the routing and forwarding for nodes mapped to specific ports. Definitely not as straight-forward, and there are some technical drawbacks to doing it like that, but it works for me.
You can't just use Tailscale by itself. Having a properly configured exit node with unfiltered internet access is the key that makes it all work.
A few posts in this thread are overcomplicating the matter.
44Net Connect and Tailscale are almost opposites in this context:
So, OP, just use 44Net Connect. It is free and easy, and designed for exactly this use case.
The ASL manual already has "official" documentation on how to set it up.