I'm setting up a private network with 10 geth nodes for my organization's own use, however I don't want outside nodes to accidentally (or intentionally) connect to our geth nodes. The nodes are hosted on public servers so we can access them anywhere, is there some way so the geth nodes in our private net will only allow peer connections from each other and block connections from other nodes. Currently we use the static-nodes.json to make the 10 geth nodes to connect to each other, disabled discovery, however I'm not sure if that's enough to block unwanted outside nodes connection attempts? Thanks.
1
-
putting your nodes in a closed network would do the trick. afaik geth is not meant to be used for the private networks.– Kaki Master Of TimeCommented May 4, 2018 at 16:08
Add a comment
|
3 Answers
I'm not sure how deep into geth you want to go, but p2p/Server contains a property called "NetRestrict" that allows you to restrict connections to particular IP networks.
cmd/bootnode/main.go is a working example that accepts the "netrestrict" flag. It looks like Geth hasn't quite implemented this yet, but it should be fairly easy to implement yourself.
Two solutions:
Bootnodes: bootnodes from github wiki of go ethereum
statis-nodes: static nodes from github wiki of ethereum
Mix this solutions with the nodiscover argument.
answered May 4, 2018 at 8:51
-
I know the bootnode and static-nodes.json, actually currently I'm using the static-nodes.json to make the nodes connect to each other (there's a typo where I typed it as static-peers.json in the original question) My question is whether there's a way to block unwanted connections, ie. if there's an outside node other than those specified in static-nodes.json try to use addPeer to connect to our node, how to block it? Commented May 4, 2018 at 10:01
-
Yes, as I said, use "nodiscover". Combined with static nodes, its not possible to connect to your private nodes. You can also close the network of the node putting them in a VPC. Commented May 5, 2018 at 7:05
-
well like I said in the original post, I have used static-nodes.json AND disabled discovery already, but not sure if that's enough. So you think that's enough to block unwanted connections? I have to make the nodes available on the public network for clients to connect to. So are you saying that after I use the static-nodes.json and disabled discovery, when outside nodes (with the same genesis config and such) try to use admin.addPeer to manually add one of my nodes as a peer, they will fail? Commented May 5, 2018 at 9:14
Not sure if you have the answer already yourself. https://ethereum.stackexchange.com/a/36979/45935 may give you some hints - to restrict the access at the network level.
