How could "ethereum block explorer" connect into geth that is already running on the main server securely?

Question

I am working on private Ethereum Network. I run Ethereum boot-node and Ethereum Block Explorer app ( https://github.com/etherparty/explorer (A lightweight ethereum block explorer.) ) on the main server.

Inside the main server where I run Ethereum node, at the browser I could connect into the Ethereum Block Explorer from localhost:8000:

But from an external node on the browser, when I try to connect from main server's ip address < ip-address >:8000 I have faced with the following error message. The main reason of this error message was "web3 is not connected"

var eth_node_url = 'http://localhost:8545'; // TODO: remote URL
web3.setProvider(new web3.providers.HttpProvider(eth_node_url));

if(!web3.isConnected()) {
    $('#connectwarning').modal({keyboard:false,backdrop:'static'}) //enters here
    $('#connectwarning').modal('show') //enters here
}

On the external node, if I run geth app on the background that is already connected to the private Ethereum network, it solves the problem.

[Q] On the external node without running the geth app on the background, is it possible for Ethereum Block Explorer to connect into the geth app that is already running on the main server? If yes, is there a secure approach as running geth with --rpcaddr="localhost" --rpccorsdomain="*" on the main server?

Thank you for your valuable time and help.

Note:

=> The way I run the Ethereum Node:

geth --port 3000 --networkid 23422 --nodiscover --datadir="/home/MyEthereumEbloc" 
--rpc --rpcaddr="localhost" --rpccorsdomain="*" --maxpeers=6 --ipcapi 
"admin,eth,web3" --autodag

=> In order to install Ethereum Block Explorer, I have followed the installation guide on https://github.com/etherparty/explorer.

[~$] git clone https://github.com/etherparty/explorer 
[~$] cd explorer
[~/explorer$] npm start

> EthereumExplorer@0.1.0 prestart /home/netlab/explorer
> npm install


> EthereumExplorer@0.1.0 postinstall /home/netlab/explorer
> bower install


> EthereumExplorer@0.1.0 start /home/netlab/explorer
> http-server ./app -a 79.123.177.145 -p 8000 -c-1

Starting up http-server, serving ./app on port: 8000

=> Inside package.json file that is located under explorer folder: app started as follows:

"start": "http-server ./app -a localhost -p 8000 -c-1"

Please know that when I have changed localhost to node'a ip-address it didn't help:

"start": "http-server ./app -a <ip-address> -p 8000 -c-1"

Answer 1

!!Please note that this solution only works if external node and the main server is in the same Network Domain!!

Insecure approach:

The problem was: how I start my RPC.

Run geth on the main server as follows:

> admin.startRPC("0.0.0.0", 8545, "*")
true

or

--rpc --rpcport 8545 --rpcaddr 0.0.0.0 --rpccorsdomain "*" --rpcapi "eth,web3"

Update explorer/app/app.js as follows:

    //var eth_node_url = 'http://localhost:8545'; //commented out. 
    var eth_node_url = 'http://<ip-address of the main server>:8545';         
    web3.setProvider(new web3.providers.HttpProvider(eth_node_url));

Answer 2

I have used Docker to overcome this issue. Docker installation. From this answer to this question How can I expose Geth's RPC server to external connections?, I have used Docker as the application server, which actually runs inside my Ethereum Node.

I have followed installation for the Ethereum Block Explorer app .

To overcome following problem(curl: (56) Recv failure: Connection reset by peer) inside Docker, I have replaced "localhost" keyword that exist under explorer folder with "0.0.0.0": https://stackoverflow.com/a/27818259/2402577

Assume geth runs at remotehost.remotedomain.tld

[~] git clone https://github.com/etherparty/explorer
[~] cd explorer
[~] dir="$PWD";
[~] find $dir -type f -exec sed -i 's/localhost/0.0.0.0/g' {} +
[~] emacs -nw  Dockerfile

Paste followings lines into Dockerfile.

FROM node:boron

# Create app directory
RUN mkdir -p /usr/src/app
WORKDIR /usr/src/app

# Install app dependencies
COPY package.json /usr/src/app/
RUN npm install

# Bundle app source
COPY . /usr/src/app

EXPOSE 8000
CMD [ "npm", "start" ]

-

[~] sudo docker build -t <your username>/node-web-app 
[~] sudo docker run -p 3002:8000 -d <your username>/node-web-app

This part is is not required:

[~] sudo docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS                    NAMES
26c46398b20d        yo/node-web-app     "npm start"         7 seconds ago       Up 5 seconds        0.0.0.0:3002->8000/tcp   pedantic_knuth
[~] sudo docker exec -it 26c46398b20d /bin/bash
root@26c46398b20d:/usr/src/app# ssh -f -N -L 8545:localhost:8545 remoteUser@remotehost.remotedomain.tld

Now you can open Ethereum Block Explorer app from an external node using host's_IP:port.

remotehost.remotedomain.tld:3002

Helpful Link for compile nodejs and docker: https://nodejs.org/en/docs/guides/nodejs-docker-webapp/

Answer 3

If the external node is your trusted node you can try to use SSH tunneling. Execute ssh -L 8545:localhost:8545 username@main-server-ip-address on the remote node and you will get opened port 8545 on remote node that will be securely (encrypted) forwarded to main_server-ip-address:8545. All connections to remote-node:8545 will be interpreted as connections to main-server-ip-address:8545 from localhost.

To simplify connection process you can add public key of remote node to ~/.ssh/authorized_keys file of main server as described here https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-keys--2

THIS APROACH IS INSECURE!!! If you just want to have opened rpc port on your main server you can use ssh for it too. Execute ssh -L main-server-external-ip-address:port-to-forward-rpc:localhost:8545 username@localhost on your main server, and you will get opened port port-to-forward-rpc on main-server-external-ip-address that can be accessed from anywhere. All connections to this port will be interpreted by geth as connections from localhost. After it you can use

var eth_node_url = 'http://main-server-external-ip-address:port-to-forward-rpc '; web3.setProvider(new web3.providers.HttpProvider(eth_node_url));

without any domain\network access limitations