I have a geth node running on a linux machine, and have set up a firewall (UFW) to allow all outgoing connections, but inbound connections to 30303/udp and 30303/tcp only.

I'm noticing in my system logs that the firewall is blocking a lot of attempts to connect to other ports on my machine. For example:

Jul  8 17:48:23 ethnode-e703e05c4 kernel: [20420.869862] [UFW BLOCK] IN=eth0 OUT= MAC=dc:a6:32:8f:2e:85:2c:79:d7:05:f9:98:08:00 SRC= DST= LEN=40 TOS=0x00 PREC=0x00 TTL=47 ID=0 DF PROTO=TCP SPT=30303 DPT=47962 WINDOW=0 RES=0x00 RST URGP=0 

If I'm understanding correctly, this connection attempt originates from port 30303 on the peer (a port used by geth), but is targeting port 47962 on my machine, a port which to my knowledge is not used by geth.

What's happening here? Is this a malicious actor looking for open ports? Or maybe a sign that there are other ports that I need to open on my firewall?

Any insight much appreciated.

Edit: This may be an answer to my own question: The fact that I am allowing outbound connections on any port means that geth will use any port it likes to attempt to establish a connection with other nodes. Then when the other nodes attempt to reply on that port, the firewall blocks it due to my inbound rule. Perhaps someone with a better understanding can confirm or refute that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.