1

Input:

  • geth on port 30303
  • port 30303 forwarding is enabled on router
  • uPnP is disabled on router
  • UFW firewall is enabled with the following rules:
$ sudo ufw status verbose                                                                                                                                                                                                                                        
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
        
30303                      ALLOW IN    Anywhere                
30303 (v6)                 ALLOW IN    Anywhere (v6)    

As the result, geth node is in sync, there are a lot of inbound/outbound peers, but also there is a constant flow of UFW logs regarding blocked geth interactions, examples:

Nov 30 19:51:57 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=45.66.166.67 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x60 TTL=43 ID=58648 DF PROTO=TCP SPT=30303 DPT=37398 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:52:30 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=161.97.136.22 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x20 TTL=50 ID=0 DF PROTO=TCP SPT=30303 DPT=47466 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:52:36 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=149.28.45.212 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x80 TTL=44 ID=61716 DF PROTO=TCP SPT=30308 DPT=44788 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:52:57 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=164.68.113.90 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x40 TTL=49 ID=0 DF PROTO=TCP SPT=30303 DPT=58880 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:53:25 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=144.91.82.212 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x80 TTL=47 ID=0 DF PROTO=TCP SPT=30303 DPT=52492 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:53:40 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=173.255.204.125 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x20 TTL=44 ID=58462 DF PROTO=TCP SPT=30303 DPT=50082 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:55:12 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=54.218.70.184 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x80 TTL=26 ID=0 DF PROTO=TCP SPT=30303 DPT=60596 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:55:12 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=54.218.70.184 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x80 TTL=26 ID=0 DF PROTO=TCP SPT=30303 DPT=60596 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:55:12 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=54.218.70.184 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x80 TTL=26 ID=0 DF PROTO=TCP SPT=30303 DPT=60596 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:55:12 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=54.218.70.184 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x80 TTL=26 ID=0 DF PROTO=TCP SPT=30303 DPT=60596 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:55:23 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=3.231.210.103 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x20 TTL=41 ID=0 DF PROTO=TCP SPT=30303 DPT=36526 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:55:38 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=95.111.13.56 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x80 TTL=48 ID=0 DF PROTO=TCP SPT=30303 DPT=38972 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:55:56 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=123.58.210.46 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x80 TTL=31 ID=0 DF PROTO=TCP SPT=30301 DPT=38512 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:56:19 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=95.216.96.25 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x80 TTL=45 ID=0 DF PROTO=TCP SPT=38336 DPT=41130 WINDOW=0 RES=0x00 RST URGP=0 
Nov 30 19:56:43 ~myhost~ kernel: [UFW BLOCK] IN=enp5s0 OUT= MAC=~mymac~ SRC=167.86.98.20 DST=~my_lan_ip~ LEN=40 TOS=0x08 PREC=0x40 TTL=47 ID=0 DF PROTO=TCP SPT=30303 DPT=41374 WINDOW=0 RES=0x00 RST URGP=0

There are also a some records like "SPT=47924 DPT=30303" while 30303 is allowed in UFW;

From now, there are only my assumptions.

I can't explain records like "SPT=47924 DPT=30303", possibly unrelated to the issue, just caused by invalid connections: https://serverfault.com/questions/957652/ufw-logging-a-block-on-a-permitted-port

But for records like "SPT=30303 DPT=38972", as far as I understand, UDP discovery "invites" foreign nodes to connect to a random port which is blocked by UFW and there is no way to define these random ports range in geth to enable this range in UFW and setup it's forwarding. This situation looks harmful for a network. I there any way to fix it? Or possibly there is some other explanation?

Possibly, this is the description of the same issue: https://www.onooks.com/peers-attempting-to-connect-to-ports-on-my-machine-other-than-those-used-by-geth/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.