Add a gateway (new country/server)

• A small PC to act as the server (any mini-PC / old desktop, 8 GB RAM is plenty), kept on 24/7.
• A USB stick (8 GB+) to install the operating system from — its contents get erased.
• A monitor + keyboard, just for the first install (after that it's remote).
• A powered USB hub, your ZTE MF833N modems, and one local prepaid data SIM per modem (a Serbia (Loznica) SIM here).
• Wired internet (Ethernet) to the server is most reliable.

On your normal computer, download Ubuntu Server 24.04 LTS and write it to the USB stick.

• Download the ISO: ubuntu.com/download/server
• Download the flashing tool balenaEtcher (Windows + Mac).
• Open Etcher → Flash from file (the Ubuntu ISO) → Select target (your USB stick) → Flash. Takes a few minutes.

Plug the USB stick into the server PC, plus the monitor, keyboard and Ethernet. Power it on and open the boot menu (usually F12, F11, Esc or Del right after powering on) and pick the USB stick.

Follow the Ubuntu installer with the defaults, and watch for these:

• Set a username and a strong password — you'll remember these.
• When it offers "Install OpenSSH server", tick it (this is what lets you log in remotely).
• Let it finish, remove the USB stick, and reboot.

On the server (at the monitor), log in and run this to see its local IP address (looks like 192.168.x.x):

ip -4 addr | grep inet

Write that IP down — you only use it once, on the same network, in the next step.

You do not need a static or public IP, and you don't touch the router. This is just the local address. Tailscale (step 4) gives the server a permanent name that works from anywhere — even with a changing ISP address or behind NAT/CGNAT.

So you can manage this server from your laptop (even when you're not in Serbia (Loznica) and even if it's behind a router), install Tailscale on both machines — it creates a private, secure link between them. Run this on the server (at the monitor, or over local SSH using the IP from step 3):

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh

It prints a link — open it and sign in (use the same account you'll use on your laptop). Then install the Tailscale app on your laptop, sign in with the same account, and from your laptop's terminal you can reach the server from anywhere:

ssh <your-username>@rs-gateway

Tip: in the Tailscale admin you can rename the machine to something memorable like rs-gateway. From here on you can do every remaining step from your laptop over SSH — the monitor and keyboard can be unplugged.

Clone the project to /opt/obscale-gateway (the agent expects it there).

sudo git clone https://github.com/esefc/obscaleproxy.git /opt/obscale-gateway
cd /opt/obscale-gateway

One command installs everything the gateway needs (Node.js, cloudflared, 3proxy, iproute2, iptables).

sudo bash gateway/deploy/bootstrap.sh

Connect the powered hub and modems, wait ~15 seconds, then list them. It prints each modem's USB port (usbKernels) for the next step.

sudo bash gateway/deploy/discover-modems.sh

Copy a starter file to inventory.json and edit it: set each modem's usbKernels (from step 7), a strong proxyPass per modem, the modem's admin password (ztePassword), and lanCidr (the server's LAN). Add/remove modem entries to match how many you have.

cp gateway/deploy/inventory/serbia.json gateway/inventory.json
sudo nano gateway/inventory.json

(In nano: edit, then Ctrl-O Enter to save, Ctrl-X to exit.)

Create the agent's settings file and set a long random AGENT_TOKEN — you'll paste the same value into the dashboard in step 12.

sudo mkdir -p /etc/obscale
sudo cp gateway/deploy/agent.env.example /etc/obscale/agent.env
sudo nano /etc/obscale/agent.env   # set AGENT_TOKEN=<long random string>

This generates the config, installs everything, and starts the modems + the agent. You can re-run it any time.

sudo bash gateway/deploy/deploy.sh

Quick check: sudo /opt/obscale/bin/obm-status.sh 0 and curl -s localhost:8088/health

This lets the dashboard reach the agent securely — no public IP, no open ports.

cloudflared tunnel login
cloudflared tunnel create obscale-rs
cloudflared tunnel route dns obscale-rs rs-agent.obscaleproxy.com
# put gateway/deploy/cloudflared.example.yml at /etc/cloudflared/config.yml,
# fill in the tunnel ID + the hostname rs-agent.obscaleproxy.com, then:
sudo nano /etc/cloudflared/config.yml
sudo cloudflared service install

Open Locations → Add and enter:

• Name: Serbia (Loznica)
• Country code: RS
• Agent URL: https://rs-agent.obscaleproxy.com
• Token env: AGENT_TOKEN_RS

Then add the matching secret to the app: in Cloudflare → your Worker → Settings → Variables and secrets, add AGENT_TOKEN_RS (as a Secret) with the same value as AGENT_TOKEN from step 9, and redeploy.

The new location now shows on the Overview and Modems pages. Confirm a modem is online and that rotating actually changes its public IP.

sudo /opt/obscale/bin/obm-status.sh 0
sudo /opt/obscale/bin/obm-rotate.sh 0

If rotating doesn't change the IP, set ZTE_AUTH_MODE=ld in that modem's /opt/obscale/env/obm0.env and retry (a modem-firmware difference).