Maestro CGNAT ZeroTier - it works!

Unbalanced

I had the goal of connecting a Maestro to a remote rig, which is behind a CGNAT network (no forward facing IP address). So no SmartLink.

After some slogging around with my networks, I now have the Maestro accessing my remote radio, which is behind Starlink CGNAT. Here’s the rundown of how I did it…

First off, create a ZeroTier network. Free! Then build and deploy a ZeroTier Bridge at the remote location. I run this on a Raspberry Pi. Danny K5CG and Roland HB9VQQ have great tutorials on setting up this portion - thanks guys! Note that I had trouble following ZeroTier’s tutorials- FWIW.

https://cloud.hamoperator.org/s/r8aPidbpzdocrwW
https://drive.google.com/file/d/1yaIndMRmZDkrtQFa7ZSwfrtp_J3VW8qf/view

With this set up and functional, the ZeroTier client software can be loaded on PC’s, phones, tablets, etc. which gets these devices on the network local to the radio. Forwarding discovery packets, the radio shows up in the SmartSDR chooser menu, no SmartLink required. I have this running on Windows and MAC/IOS devices. Cool.

Ah, but what about the Maestro? Since there’s no loading the ZeroTier client, you’ve gotta take another step. Enter the GL.iNet GL-MT3000 Beryl AX Travel Router, which natively supports ZeroTier. It takes a little tweaking, but works great.

Now, I am a fledgling network ****, so take this all with a grain of salt. There are probably many ways to pull this off. This is how I did it.

First, I installed ZeroTier on the GL.iNet router. This is found under the Applications menu. Next, add/authorize this device to the ZeroTier network created previously. As with the Pi Bridge, tag the ‘Authorize Bridging’ and ‘Do not auto-assign IPs’ check boxes under the ZeroTier network’s Advanced Settings.

Now go into GL.iNet’s Advanced Settings - this is called ‘Luci’. Under Luci / Advanced Settings / Devices, select Configure ‘br-lan’. Here, link the ‘eth0’ Interface (lan) with the ‘zerotier’ Interface. Put a checkmark in the box for each of these Interfaces, and Apply. Note that the ZeroTier Interface name will be that of the specific ZeroTier network. Do not bridge the ‘wan’ Interface.

Now comes the fun part. You’ll need to have your device obtain an IP address on your remote network subnet. This can be done by manually configuring the IP address of the device. I went a different route. I disabled the GL.iNet DHCP server, which then has any device connected to ‘eth0’ - the LAN port (which is now bridged through ZeroTier) obtain its IP address from the DHCP server at the remote site. Best network practice has only one DHCP server on a network - multiples will get confused and fight one another.

So with all that, I now have a dedicated ethernet network connection to the remote site that passes/receives discovery packets to any device on the network. I can fire up the Maestro, select the radio, and operate the rig remotely. SSB. CW. Whatever. That said, my primary goal was to operate CW. This works fantastic. CW. Sidetone. Remote. Awesome!

What about latency? What about packet loss? Since nothing is perfect, here is my experience. Over the course of a million or so packets, dropped packets are less than 0.4%. Latency averages 80-100ms. All definitely workable. While I don’t know how to test it, I have a feeling that a big piece of the packet loss measurement is Starlink’s handing off the connection from satellite to satellite.

Yes, I know Starlink now offers a fixed IP plan, but that comes at an additional cost, and includes a data cap. So I want’t interested in changing plans.

Note that not all GL.iNet routers support ZeroTier - so if you go this route, shop carefully. I chose this model as I only wanted/needed one ethernet port to bridge. And it was cheap. Like $85 cheap.

So this should work for anyone that wants to remote into a radio that is behind a CGNAT network. Whether it be Starlink, a local WISP, Double NAT, or whatever - ZeroTier pulls the end-around, allowing you to hit your remote rig like you’re on-site.

As always, YMMV, but this is working in the Whiskey Bravo shack. Any questions? Fire away, and I’ll do my best.

73

Mike - ADØWB

Maestro.jpeg
MT3000 Devices
Bridge

K5CG

Great job Mike. I hope others benefit from the collective knowledge.

VK1HF

hey Mike very interesting. I tried to get lan bridging working with zeroteir and I had no luck so I’m now trying using tail scale and by the smart link system using an azure virtual machine as an exit mode is doing my head in big time I think I’m gonna go back to trying using zeroteir with two raspberry pies one at the radio side and one at the right at the maestro side if you feel like taking a video of your in action be very keen to see how it works and why did you use that router at the maestro end instead of just using a raspberry pie on both ends wondering what the thought was there?

K5CG

I realized that the link to my Nextcloud document has changed and is also not available globally (FW rules) so I shared it here https://drive.google.com/file/d/1mCaTD6-0qNfRf0PBOB84BeXPFRtOawLq/view?usp=drive_link

I also updated it and added some shell commands to display the OS version, zerotier-one version, interfaces file, etc., to aid in troubleshooting.

Mike-VA3MW

Mike, I can't get access to your document.

K5CG

I'm not a big user of google drive so unfamiliar. I changd the share to view only for anybody with the link. It should work now.

I created an image of the MicroSD card and have that if anybody wants it. The zerotier-one version was 1.12.2 at that time.

I updated the OS to the latest versions and zerotier-one is now 1.14.2 and still appears to work.

VK1HF

Great document Mike, will give it a try today! MUCH appreciated

WX7Y

Hi Dan, I would be interested in the SDCard Image if you wouldn't mind sharing some how?

Thanks in advance

Bret

wx7y@arrl.net

K5CG

Bret, I sent you a link.

K5CG

The latest version (small corrections and the update date) is here

https://drive.google.com/file/d/1mCaTD6-0qNfRf0PBOB84BeXPFRtOawLq/view?usp=drive_link

The Pi img file (zipped) of a working solution is here

https://drive.google.com/file/d/15i1n0V24bToAOhrZFDDLVZ8HbP7_Q7jq/view?usp=drive_link

The image was from the OS as it was in 2023. I have since updated the OS and all appears to still be well.

Unbalanced

Wow, Danny - Great updates! Thank you.

Neat to see people going after this solution. I've had it up and running for several months and it has been bulletproof.

Ian - as for using the GL.iNet mini router - I actually did put together a pi for the Maestro end, but poor linux skills prevented me from getting a functional solution. Even trying multiple eth interfaces. The ready made mini router was the fit for my needs. Both wired and wireless connections to the mini router are linked directly to the remote network - devices operate as if they are physically on-site..

I had tried several different plans, each leading to failure in one way or another. This is pretty easy, and just 'works'.

Good luck, all. :-)

73,

Mike - ADØWB

VK1HF

great comments Mike..being a Pi and Linux fan I feel compelled to do it that way but I think maybe it might be to my demise! 😩😭

VK1HF

ok, question on this.. I have done a fair bit of playing with zerotier on Linux but not with a bridging setup. If I want to connect to the pi itself, remotely..say SSH from my laptop, joined to the same zerotier network..can I do that.? What IP would I connect to.?

Unbalanced

Absolutely! When setting up the bridge pi, you will set the static IP address. Once the bridge is connected and authorized to your ZeroTier network, any device on the ZT network can SSH directly into the pi at the address you configured.

psundquist

Thank you for posting and the detailed description, this was a huge help! I installed the GL.iNet GL-MT3000 at the remote Flex-8400 site which has a cellular hotspot with CGNAT instead of deploying and configuring a pi. I prefer going with appliances. It works great on SmartSDR for Windows & MacOS. Having problems with intermittent waterfall issues on iPhone & iPad. Will try setting up a second GL.iNet GL-MT3000 Beryl AX Travel Router @ local site for the iOS devices to connect without the ZeroTier client to see if that clears it up. The biggest hurdle for me was learning how ZeroTier works - which isn't complicated. I also used Chrome Remote Desktop at the remote site to solve configuration problems.

Stefan AF6SA

It works and can be installed on routers running OpenWrt like GL.iNet and others.

Info here: [OpenWrt Wiki] Zerotier

73's de Stefan / AF6SA www.af6sa.com