Ethereum Stack Exchange is a question and answer site for users of Ethereum, the decentralized application platform and smart contract enabled blockchain. It only takes a minute to sign up.
Sign up to join this community
I want to set up a private network of applications which can connect to a single Geth node. What options do I have for exposing the RPC server?
I'm running this: geth --rpc --testnet (sometimes I use --dev)
Would this just require running a reverse proxy with a server like Nginx?
You can easily and securely create an SSH tunnel to your ETH Node from the application server. This way, the ETH node is fooled into believing that the connection is from localhost and you can ensure that only the holder of a private key can access.
This is a link to instructions on how to setup certificate based authentication
It is important to setup certificate authentication because else you can not automate the process.
Once you have set that up you can create a tunnel by running a command like:
ssh -f -N -L 9545:localhost:8545 [email protected]
The port numbers are different in my example, in order for the reader to be able to tell them apart. There is absolutely no other reason to make them different.
Once this command has been issued all traffic to port 9545 on localhost will be forwarded to remotehost.remotedomain.tld:8545 which will consider it to have originated from localhost and be targeted at localhost:8545
This way, you can keep your ETH node behind a firewall and not open it up to the world but still centralize the functionality.
In order to use this in production, you will have to solve the issue of disconnecting SSH sessions.
warning: I do not recommend this
By default the node will only accept connections from localhost. You can change this to accept connections from anyone with: --rpcaddr "0.0.0.0".
Please note that anytime a private key is unlocked, anyone on the Internet can use this key by querying your rpc server and send transactions.
--rpcaddr "0.0.0.0"? @Jeffrey W.
Geth has once again changed it's entire command line syntax... so this is an example of a current configuration for allowing your node to be externally accessed (additional security measures needed depending on your application)
geth --http --http.addr "0.0.0.0" --http.corsdomain "*" --http.port "8545"
More info here https://geth.ethereum.org/docs/rpc/server
enode address or standard IP address is enough?
Nov 28, 2022 at 10:25
--rpc --rpcport "8545" --rpcaddr "127.0.0.1" --rpccorsdomain "*"
--rpccorsdomain "*" allows anyone to connect to the node on given --rpcport
--rpccorsdomain value Comma separated list of domains from which to accept cross origin requests (browser enforced) - Browser enforced means that if a user makes a request without a browser, geth will server the request ignoring the domain. `
Oct 8, 2017 at 0:07
--rpccorsdomain "*" allows anyone to connect to your geth node via rpc. In production/public use --rpccorsdomain "[email protected]" to bind connection specifically to your remote user. In practice geth should be listening to local connections only.
--rpccorsdomainmay be what I'm looking for. I think you can specify--rpccorsdomain "*"which will allow anyone to access the RPC server. I'm sure you can also use a reverse proxy to achieve this as well. I based my information off of this repo: github.com/Kunstmaan/docker-ethereumrpccorsdomainis what you want, consider answering your own question.CORSis enforced by browsers. It's a security measure to prevent cross site scripting and DDOS attacks by essentially preventing the masses who use plain browsers to accidentally do something stupid. However an attacker may freely disregard any CORS requests the server sends back. It should not be used as a security precaution.