OpenBTS: A Complete Guide to Building and Running Your Own Network

Building and running your own network can seem like a daunting task, but with the right tools and knowledge, it's entirely possible. OpenBTS is a free and open-source software that allows you to build and run your own network.

It's a Linux-based system that uses a combination of open-source software and hardware to create a complete mobile network. This includes a base station, a mobile switching center, and a home location register.

With OpenBTS, you can create a network that's compatible with a wide range of mobile devices, including those that use GSM, CDMA, and LTE protocols. This means you can connect with users who have phones from various manufacturers.

A unique perspective: Call Tracking Software Twilio

OpenBTS is a Unix application that uses a software radio to present a GSM air interface to standard 2G GSM handsets.

It connects calls using a SIP softswitch or PBX, making it a simplified form of IMS that works with 2G feature-phone handsets.

This combination of a global-standard GSM air interface with low-cost VoIP backhaul forms the basis of a new type of cellular network that can be deployed and operated at substantially lower cost than existing technologies.

OpenBTS is particularly useful for rural cellular deployments and private cellular networks in remote areas.

To get started with OpenBTS, you'll first need to clone the repository. Clone the repository and use the pre-installation script preinstall.sh to clone all other projects, submodules and install dependencies.

The pre-installation script will take care of setting up the necessary projects and dependencies, which is a big time-saver. Once it's finished, you can proceed with the installation of OpenBTS.

You'll need to move the databases to /etc and /var as part of the installation process. This will ensure that OpenBTS has the necessary data to function properly.

OpenBTS has been used by the security research community to mount attacks on cellular phone baseband processors.

GSM calls can be intercepted because in GSM the handset does not authenticate the base station prior to accessing the network.

This was demonstrated at the 2010 DEF CON conference using OpenBTS.

Investigating and conducting such attacks was previously considered impractical due to the high cost of traditional cellular base station equipment.

The Testcall feature has been reintroduced in OpenBTS.

A new feature, SMS Fuzzing, has also been added thanks to the work of @Djimmer.

You can already test this feature with the fuzzing-dev branch.

Curious to learn more? Check out: Base Station Subsystem

Building Community Cellular Networks is a fascinating topic, and it's great that we have OpenBTS to make it possible. OpenBTS is an open-source GSM/SIP gateway that converts 2G GSM into standard VoIP protocols.

Community Cellular Networks are essentially small-scale, community-operated telecommunication networks that provide voice, SMS, or data connectivity to areas without network coverage. They're like "telcos in a box"!

To build a Community Cellular Network, you'll need OpenBTS, along with other related components like FreeSWITCH, smqueue, and sipauthserve. These four open-source software artifacts can be used to create an entire telco worth of infrastructure.

Readers also liked: Telekom Networks Malawi

Here are the technologies you'll need:

The good news is that these technologies can be configured to meet the specific needs of your community. For example, the webinar mentions that a network in Papua, Indonesia has been running for 8 months and has handled over 200 thousand SMS. That's a lot of connectivity!

To configure OpenBTS, you'll need to create two key files. These files are crucial for OpenBTS to run correctly.

If you see a lot of configuration variables, it means the database has been installed correctly. This is a good sign, but it's not the only thing you need to check.

At this point, you should be able to perform a basic sanity check of OpenBTS. If everything is set up correctly, it should work as expected.

To run everything smoothly, it's essential to load the firmware and FPGA into the USRP first. You can use the probe UHD tool to achieve this.

Preferably, run the probe UHD tool in the background to avoid interrupting your workflow. You can use screen, tmux, or just launch everything except OpenBTS in the background.

OpenBTS can run on low overhead platforms, such as CDMA handsets, which can make a GSM gateway to a CDMA network.

Experimental installations have shown that OpenBTS can run on a variety of platforms.

A handheld device, like an Android phone, can act as a gateway base station to which handsets can connect.

The Android device then connects calls using an on-board Asterisk server and routes them to the PSTN via SIP over an existing 3G network.

Readers also liked: USSD Gateway

A Docker container is available for the backup, allowing you to use it with all installed tools.

The Docker image is hosted on the Docker Hub at https://hub.docker.com/r/penthertz/openbts.

This container has been generated for the backup and is ready to use.

The Docker container is a useful tool for managing and configuring your system.

Navigating the repository files can be a bit overwhelming, especially with the OpenBTS source code supporting new UHD drivers.

The OpenBTS source code has been reloaded for 2024-2025, which means it's been updated to work with the latest drivers and operating systems. This includes Ubuntu 22.04 & 24.04 LTS, which are both long-term support versions.

You might enjoy: Mobile Country Code

Compiling the code against C++11 and C++17 is now possible, making it easier to work with the source code. This is a significant improvement, as it allows developers to take advantage of the latest language features and standards.

The OpenBTS source code is designed to be compiled against C++11 and C++17, which means you can use the latest language features to write your code. This is a great opportunity to learn and experiment with the latest C++ features.

Explore further: Radio Code

To configure OpenBTS, you need to create two key files that must be installed at specific locations.

One of these files is OpenBTS.db, which must be installed at /etc/OpenBTS.

To create this file, you need to enter the OpenBTS directory by running the command "cd /path/to/OpenBTS".

Then, you need to run the command "sqlite3 OpenBTS.db" to configure the database correctly.

The openbts executable is in the apps folder, so you need to enter that directory by running the command "cd /path/to/OpenBTS/apps".

To make the openbts executable, you need to run the command "chmod +x openbts".

You can check if the file is executable by running the command "ls -l openbts".

The GSM.RACH.MaxRetrans variable should be set to 1 (one), and the GSM.RACH.TxInteger variable should be set to 8.

You can change the values of these variables by editing the OpenBTS.db file.

OpenBTS has undergone significant development and release milestones, with the first release being version 1.0. This initial release was completed in an unknown revision (??) on a SVN repository hosted on SF.net, marking the beginning of a journey that would see the project grow and evolve over time.

The release history of OpenBTS reveals a pattern of steady improvement, with each new version addressing specific issues and adding new features. For instance, version 1.5 introduced several key fixes, including the removal of an incomplete SMS directory and the moving of "abort" calls into L3 subclasses.

Related reading: Communications in Papua New Guinea

Here's a breakdown of some notable release milestones:

Each of these releases demonstrates the dedication and hard work of the OpenBTS community, which has driven the project's growth and success.

To get the latest OpenBTS code, you can pull it directly from the source code repository as an anonymous read-only user.

You'll need to enter the following command into a new terminal window:

git clone https://github.com/OpenBTS/OpenBTS.git

This will download the code, and you can then rename the folder to "OpenBTS" for easier recognition by running the command:

mv dev OpenBTS

Next, navigate into the OpenBTS directory with the command:

cd OpenBTS

After that, you can download all the components by running the clone.sh script with the command:

./clone.sh

This will clone all the necessary components, including asterisk, asterisk-config, liba53, and many others. Here's a list of the components that will be cloned:

After cloning the components, you'll need to build OpenBTS to ensure it's working correctly.

Building a project from scratch can be a daunting task, but it's made much easier with the right tools and guidance. The build.sh script is a great example of this, as it automatically installs any necessary build dependencies when required.

To get started, you'll need to compile each component into an installable package. This is done by entering a specific command, which will then prompt you to press Enter. After that, the building process is complete!

The next step is to configure all the things, which involves making the file you just created executable. This is a crucial step in the development process, and it's essential to get it right.

Here's a brief overview of the technologies involved in building a Community Cellular Network with OpenBTS:

The release history of this project is a long and winding road, with many twists and turns. It started with the release of 1.0, which marked the completion of L1 and L2.

The first notable release was 1.3, Carencro, which was the first post-injunction release. It was a major milestone in the project's history.

In 2008, the project saw a surge in activity, with the release of 2.1, Grand Coteau. This release brought DTMF support, fixed Linux-related build errors, and expanded the stack to prevent overflows in Linux.

The 2.2, Houma, release was a significant one, adding a LEGAL notice, removing Assert classes, and fixing several bugs. It also reduced the stack footprints in Transceiver and fixed SMS timestamps.

One of the most interesting releases was 2.4, Kinder, which fixed the BCCH neighbor list bug, supported neighbor lists, and had cleaner configuration management. It also had more real-time control of BCCH parameters.

The 2.5, Lacassine, release was a major update, importing Joshua Lackey patches, fixing SIP issues, and adding support for SMS servers. It also had GNU Radio 3.2 compatibility and configurable max range and LU-reject cause.

The 2.6, Mamou, release was a significant update, fixing the infamous fusb bug, smoothing uplink power control, and adding new "config" features. It also had IMEI interrogation and configurable short code features.

The most recent release mentioned is 2.7, Natchitoches, which converted TMSITable to sqlite3, added support for rest octets, and had external databases for transaction reporting and channel status reporting.

See what others are reading: One Hungary