7

I have geth running on a Hetzner machine and I got an abuse warning from the provider flagging that my machine is sending UDP/TCP packets to private network IP addresses like for instance 192.168.., 10...* and 172.16..

Is this a part of the node discovery protocol? It would only make sense, if geth would be assuming that there are other nodes in the local network.

  • I can tell you why, because people have nodes in their local area network. I have the same RFC 1918 problem with Hetzner and the more interesting question would be how to correctly stop geth (or parity in my case) from connecting to private network IPs. – Waqar Lim Nov 9 '16 at 20:59
  • 1
    Hetzner support suggested to block the outgoing traffic to these IPs via iptables. I added iptables -A OUTPUT -p tcp -s 0/0 -d 10.0.0.0/8 -j DROP, iptables -A OUTPUT -p udp -s 0/0 -d 10.0.0.0/8 -j DROP, ... Same for 172.16.0.0/12 and 192.168.0.0/16 – ivicaa Nov 9 '16 at 21:19
  • Could you post that as additional question and answer? We might not be the only ones with that issue and I still need to update my iptables. – Waqar Lim Nov 10 '16 at 10:06
  • I've put this as answer to your question -> ethereum.stackexchange.com/questions/6386/… – ivicaa Nov 10 '16 at 20:50
5

I have the same issue but with parity on a Hetzner server.

Is this a part of the node discovery protocol? It would only make sense, if geth would be assuming that there are other nodes in the local network.

Yes, somehow. I also tried to wrap my head around this.

The clients share recent peers with other clients and this also includes private address spaces as per RFC 1918. This is because you can also run multiple nodes in your local network and the nodes have to communicate with each other how to discover them.

A client can not really tell if the recieved list of peers in a private network are actually in the same private network or in another network. All it can do is just checking if the node responds.


Update 2017: I was just blocked again. Now, I'm using full list of unrouted addresses:

iptables -A OUTPUT -p tcp -s 0/0 -d 0.0.0.0/8 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 100.64.0.0/10 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 169.254.0.0/16 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 192.0.0.0/24 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 192.0.2.0/24 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 192.88.99.0/24 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 198.18.0.0/15 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 198.51.100.0/24 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 203.0.113.0/24 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 224.0.0.0/4 -j DROP
iptables -A OUTPUT -p tcp -s 0/0 -d 240.0.0.0/4 -j DROP

iptables -A OUTPUT -p udp -s 0/0 -d 0.0.0.0/8 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 100.64.0.0/10 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 169.254.0.0/16 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 192.0.0.0/24 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 192.0.2.0/24 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 192.88.99.0/24 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 198.18.0.0/15 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 198.51.100.0/24 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 203.0.113.0/24 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 224.0.0.0/4 -j DROP
iptables -A OUTPUT -p udp -s 0/0 -d 240.0.0.0/4 -j DROP
-1

Run parity with these flags (as suggested by Gavin Wood):

--auto-update=all --max-peers 10 --min-peers 5 --allow-ips public

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.