Proposal to enhance SmartLink

m5kvk

I'd like to propose that SmartLink and SmartSDR be enhanced to improve the chances of being able to establish a direct connection to a remote Flex radio.

Currently, Smartlink relies on the ham being able to open ports in the firewall that protects the remote network. This requires either: 
- direct control of the firewall; or,
- having UPNP enabled on the firewall.

Unfortunately, UPNP is known to create a security risk and is frowned upon by security professionals (see here for an example explanation). Plus, not everybody has control over the firewall. This leaves a group of hams (myself included) for whom SmartLink cannot be made to work without introducing additional complexity.

In my case, the 6400 sits on a remote LAN behind a firewall/router over which I have control, but which is itself connected to somebody else's LAN rather than direct to the ISP. This is because a non-ham offered to host my remote shack at their farm. I have control over my firewall, but I have no way to influence the settings on their firewall. In addition, they are connected to an ISP that uses CGNAT. 

I could adopt the approach advocated in Tim Ellison's article , but this adds complexity and has its own challenges. Being a network techie, I have been able to implement a Zerotier overlay network to allow me to access my remote LAN from my Mac, iPhone, iPad etc. BUT this solution excludes being able to use the Windows version of SmartSDR to drive the radio because the Windows version of SmartSDR can only either discover a local Flex - i.e. one on the same LAN subnetwork - or use SmartLink. Luckily, being primarliy a Mac user, I use SmartSDR for Mac - which can connect to a radio using a specific IP address - but not everybody is so lucky.

All of this could be avoided if Flex adopted one of the established mechanisms that improve the chances of direct communication. Prominent amongst these are the protocols used by (e.g.) WebRTC; including ICE (Internet Connectivity Establishment).

ICE is a set of protocols and services to allow two end-points (e.g. Flex and SmartSDR) to negotiate the best way to connect - hopefully directly - without requiring any modifications to a firewall. Implementing this approach would have no effect on the simplicity of using SmartLink; in fact it would KI even more SS :-) It would also remove the potential for security lapses that might result from using UPNP or somebody mis-configuring their firewall.

Perhaps Flexradio could explore enhancing SmartSDR and the Flex range to support something like ICE. It's a mature approach that is widely adopted by other applications requiring real-time message transport - e.g. VOIP. WebRTC - and shouldn’t be too difficult to add. (I appreciate that "difficult" is a relative term)

Mike VE3CKO

Interesting, perhaps you can share with us details on how to make this happen. I am one of those who cannot use SmartLink due to CGNAT but I do have an iPad. So if I can establish an overlay network that would enable the iPad to connect via SmartLink, I'm very interested in doing so.

Mike-VA3MW

Gareth, please move this to the New Ideas area so we can track the interest. It will be lost in this group.

Neil D Friedman N3DF

if it will interfere with my ability to connect using stock Spectrum equipment without any adjustments, heck no.

m5kvk

@Mike-VA3MW Sorry, but I can't see how to move it to another category?

[Edit}

I've recreated it there.

https://community.flexradio.com/discussion/8030652/proposal-to-enhance-smartlink

m5kvk

@"mike ve3cko" I was lucky that "my" remote router supports ZeroTier. I installed a Virtual Private Server (VPS) on one of the cloud hosting companies (I chose IONOS because they were the cheapest and this application doesn't call for much resource). I then installed Zerotier on the VPS, connected the remote router and the VPSto the same Zerotier network and configured the VPN as the default route from the remote network. This way, the VPS's WAN interface becomes the SmartLink ingress point.

I'm in the process of documenting all this for my blog. I'll post the link in this forum once it's ready.

(as an aside, if the remote router supported policy based routing I could have avoided sending all traffic to the VPS).

m5kvk

@Neil D Friedman N3DF The proposal is an enhancement to the existing Smartlink protocol, there should be no effect on existing users.

m5kvk

@Mike VE3CKO Here you go https://garethhowell.com/wp/using-smartlink-to-access-my-remote-shack/