I have a simple question.

Should I let my server always open inbound connections when using Geth?

I want to keep my server secure by restricting inbound connections. Is there a way to use Geth only with outbound connection like Bittorrent? If there is, could you let me know what ports I have to open for it?

  • In case you allow your geth to establish outgoing connections to the nodes you don't trust, you still can be hacked by that nodes exploiting some vulnerability in geth through these connections. Mar 23 '19 at 10:55

Direct inboud connections for a geth client (please not server, such a bad word ^^) is very rare and usually you must allow this behaviour with a proper configuration of your firewall, your home router, and so on, and in some cases you cannot achieve that without talking with your network administrator or even your ISP. Even with a classic cloud installation you will not have open inbound connections by default.

That said, as Mikhail Vladimirov already stated in the comments, hacking of a node can be done by just chatting with other nodes, regardless of who established the connection in the first place.

The reality is that you can't trust your client: you shouldn't trust it, you don't need to trust it and you cannot assume it's not compromised. Stick with these assumptions and build from there: don't store any secrets or private informations on clients, create more then one client to query and double check informations (i.e. one geth, one parity, installed in different infrastructures), and so on.

And if or when you think the client is compromised, just shut it down and create a brand new one somewhere else.


Is there a way to use Geth only with outbound connection like Bittorrent?

Yes. Simply block in the firewall incoming tcp/udp to your node's port (default 30303) and let your server initiate connection to others.

  • The only reason I can think this might be useful is to hide your node from port scanners. Any other reasons?
    – ivicaa
    Oct 8 '18 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.