3

I'm setting up a private network with 10 geth nodes for my organization's own use, however I don't want outside nodes to accidentally (or intentionally) connect to our geth nodes. The nodes are hosted on public servers so we can access them anywhere, is there some way so the geth nodes in our private net will only allow peer connections from each other and block connections from other nodes. Currently we use the static-nodes.json to make the 10 geth nodes to connect to each other, disabled discovery, however I'm not sure if that's enough to block unwanted outside nodes connection attempts? Thanks.

  • putting your nodes in a closed network would do the trick. afaik geth is not meant to be used for the private networks. – Kaki Master Of Time May 4 '18 at 16:08
1

I'm not sure how deep into geth you want to go, but p2p/Server contains a property called "NetRestrict" that allows you to restrict connections to particular IP networks.

cmd/bootnode/main.go is a working example that accepts the "netrestrict" flag. It looks like Geth hasn't quite implemented this yet, but it should be fairly easy to implement yourself.

0

Two solutions:

Bootnodes: bootnodes from github wiki of go ethereum

statis-nodes: static nodes from github wiki of ethereum

Mix this solutions with the nodiscover argument.

  • I know the bootnode and static-nodes.json, actually currently I'm using the static-nodes.json to make the nodes connect to each other (there's a typo where I typed it as static-peers.json in the original question) My question is whether there's a way to block unwanted connections, ie. if there's an outside node other than those specified in static-nodes.json try to use addPeer to connect to our node, how to block it? – hellopeach May 4 '18 at 10:01
  • Yes, as I said, use "nodiscover". Combined with static nodes, its not possible to connect to your private nodes. You can also close the network of the node putting them in a VPC. – Florian Castelain May 5 '18 at 7:05
  • well like I said in the original post, I have used static-nodes.json AND disabled discovery already, but not sure if that's enough. So you think that's enough to block unwanted connections? I have to make the nodes available on the public network for clients to connect to. So are you saying that after I use the static-nodes.json and disabled discovery, when outside nodes (with the same genesis config and such) try to use admin.addPeer to manually add one of my nodes as a peer, they will fail? – hellopeach May 5 '18 at 9:14
0

Not sure if you have the answer already yourself. https://ethereum.stackexchange.com/a/36979/45935 may give you some hints - to restrict the access at the network level.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.