13

I'd like to setup a full remote node for personal usage (meaning I want it to act as a full node to help decentralize the network, but I don't want it to be open to everyone for use with the GUI / CLI - just for me).

Is there an available bash script or detailed instructions that will let me get a full (remote-connectable) node up and running? This would include opening relevant ports so that I am able to connect remotely.

Edit: Authorization to connect to RPC is not a requirement for an answer, simply instructions on how to make the full node remote connectable will suffice.

  • 1
    If it isn't open to everyone, I wonder how you think it would decentralize the network? Isn't that then similar to a non-public node in a home network? – dpzz Jan 16 '17 at 21:30
  • 3
    @dpzz I would like the node to relay transactions and help nodes download previous blockchain data as a full node, but I would like (if possible) to have to authenticate to get access to the RPC methods – Daniel Ternyak Jan 17 '17 at 0:14
  • 1
    you can simply leave the RPC port closed to prevent RPC use. – werdwerdus Jan 21 '17 at 0:47
12
+50

you'll want to restrict the RPC, otherwise other people that get access to your node can shut it down.

./monerod --rpc-bind-ip <external.ip.of.node> --restricted-rpc --confirm-external-bind

Binding to the external IP will allow you to connect from outside of your home. You might want to also use --rpc-bind-port <portnumber> if you want to reduce the chance that others will find your open node, like this guy: https://moneroworld.com/#nodes

  • I had to add --confirm-external-bind – RDP Jul 28 '17 at 1:57
  • 1
    What does --restricted-rpc actually do? Does it prevent all RPC calls from the internet and allow only local ones? – bitofagoob Aug 7 '17 at 16:53
4

In addition to @gingeropolous's answer, you can increase your privacy by encrypting the transport.

An easy solution is to use ssh tunneling :

ssh -L18081:< monerod-local-ip >:< monerod-rpc-bind-port > < external.ip.of.node >

For example, if your ssh server is on the same machine as monerod

ssh -L18081:127.0.0.1:18081 external.ip.of.node

And then just use 127.0.0.1 in the CLI/GUI.

One major disadvantage is that it requires an ssh account. As suggested by @hyc in the comment to this answer, probably one of the best solutions is to "use stunnel with a pair of self-generated certificates, and turn on cert authentication in stunnel".

Pretty sure this is not the most easy way to generate these certificates, but here is a script based on this tutorial :

git clone https://bitbucket.org/stefanholek/pki-example-2 && cd pki-example-2

COUNTRY="ZA"
STATE="Ponies"
LOCATION="Everywhere"
ORGANIZATION="Monero"
ORGANIZATION_UNIT="Romerito"
ROOT_COMMON_NAME="Romerito ROOT CA"
TLS_CA_COMMON_NAME="Romerito TLS CA"
TLS_SERVER_COMMON_NAME="Monerod TLS Server"
USER_COMMON_NAME="Barney"
DNS="DNS:green.no,DNS:www.green.no"
BASE_URL="http:\/\/green.no"
EMAIL="donate@getmonero.org"
ROOT_CA_END_DATE="20221231235959Z"
TLS_CA_END_DATE="20191231235959Z"

find ./ -type f -exec sed -i "s/NO/$COUNTRY/g" {} \;
find ./ -type f -exec sed -i "s/Green AS/$ORGANIZATION/g" {} \;
find ./ -type f -exec sed -i "s/Green Certificate Authority/$ORGANIZATION_UNIT/g" {} \;
find ./ -type f -exec sed -i "s/Green Root CA/$ROOT_COMMON_NAME/g" {} \;
find ./ -type f -exec sed -i "s/Green TLS CA/$TLS_CA_COMMON_NAME/g" {} \;
find ./ -type f -exec sed -i "s/http:\/\/green\.no/$BASE_URL/g" {} \;
find ./ -type f -exec sed -i "s/sha1/sha256/g" {} \;
find ./ -type f -exec sed -i "s/2048/4096/g" {} \;

# Create ROOT CA
mkdir -p ca/root-ca/private ca/root-ca/db crl certs
chmod 700 ca/root-ca/private  && chmod 700 ca/root-ca/private
cp /dev/null ca/root-ca/db/root-ca.db && cp /dev/null ca/root-ca/db/root-ca.db.attr
echo 01 > ca/root-ca/db/root-ca.crt.srl && echo 01 > ca/root-ca/db/root-ca.crl.srl
openssl req -new -config etc/root-ca.conf -out ca/root-ca.csr -keyout ca/root-ca/private/root-ca.key -nodes \
  -subj "/C=$COUNTRY/ST=$STATE/L=$LOCATION/O=$ORGANIZATION/OU=$ORGANIZATION_UNIT/CN=$ROOT_COMMON_NAME/emailAddress=$EMAIL"
openssl ca -selfsign -batch -config etc/root-ca.conf -in ca/root-ca.csr \
  -out ca/root-ca.crt -extensions root_ca_ext -enddate $ROOT_CA_END_DATE
openssl ca -gencrl -config etc/root-ca.conf -out crl/root-ca.crl

#Create TLS CA
mkdir -p ca/tls-ca/private ca/tls-ca/db crl certs
chmod 700 ca/tls-ca/private
cp /dev/null ca/tls-ca/db/tls-ca.db && cp /dev/null ca/tls-ca/db/tls-ca.db.attr
echo 01 > ca/tls-ca/db/tls-ca.crt.srl && echo 01 > ca/tls-ca/db/tls-ca.crl.srl
openssl req -new -config etc/tls-ca.conf -out ca/tls-ca.csr -keyout ca/tls-ca/private/tls-ca.key -nodes \
  -subj "/C=$COUNTRY/ST=$STATE/L=$LOCATION/O=$ORGANIZATION/OU=$ORGANIZATION_UNIT/CN=$TLS_CA_COMMON_NAME/emailAddress=$EMAIL"
openssl ca -batch -config etc/root-ca.conf -in ca/tls-ca.csr -out ca/tls-ca.crt -extensions signing_ca_ext -enddate $TLS_CA_END_DATE
openssl ca -gencrl -config etc/tls-ca.conf -out crl/tls-ca.crl
cat ca/tls-ca.crt ca/root-ca.crt > ca/tls-ca-chain.pem
cat crl/tls-ca.crl crl/root-ca.crl > crl/tls-ca-chain.crl

#Create TLS server certificate
SAN=$DNS openssl req -new -config etc/server.conf -out certs/green.no.csr -keyout certs/green.no.key -nodes \
  -subj "/C=$COUNTRY/ST=$STATE/L=$LOCATION/O=$ORGANIZATION/OU=$ORGANIZATION_UNIT/CN=$TLS_SERVER_COMMON_NAME/emailAddress=$EMAIL"
openssl ca -batch -config etc/tls-ca.conf -in certs/green.no.csr -out certs/green.no.crt -extensions server_ext
cat certs/green.no.crt ca/tls-ca.crt ca/root-ca.crt> certs/green-chain.pem

# Create TLS client certificate
openssl req -new -config etc/client.conf -out certs/barney.csr -keyout certs/barney.key -nodes \
  -subj "/C=$COUNTRY/ST=$STATE/L=$LOCATION/O=$ORGANIZATION/OU=$ORGANIZATION_UNIT/CN=$USER_COMMON_NAME/emailAddress=$EMAIL"
openssl ca -batch -config etc/tls-ca.conf -in certs/barney.csr -out certs/barney.crt -policy extern_pol -extensions client_ext

Stunnel configuration file for the server :

[monerod_server]
accept = 30000
connect = < monerod-local-ip >:18081
sslVersion = TLSv1.2
verify = 2
cert = /path/to/certs/green-chain.pem
key = /path/to/certs/green.no.key
CAfile = /path/to/ca/tls-ca-chain.pem
CRLfile = /path/to/crl/tls-ca-chain.crl

Stunnel configuration file for the client :

[monerod_client]
client = yes
accept = 18081
connect = < external.ip.of.node >:30000
sslVersion = TLSv1.2
verify = 3
cert = /path/to/certs/barney.crt
key = /path/to/certs/barney.key
CAfile = /path/to/ca/green-chain.pem

This example requires port 30000 to be open on external.ip.of.node, and eventually redirected to the machine hosting stunnel.

Disclamer : my PKI skills are quite limited and the lines starting with find are not part of the original tutorial.

3

I do exactly this.

Run ./monerod --rpc-bind-ip <your local network ip of this device>.

Then on your other machine, launch ./monero-wallet-cli (or the GUI) with ./monero-wallet-cli --daemon-host <the IP of your machine running monerod>.

Binding the IP to your LOCAL network IP address will allow only devices on your local network to connect to the daemon for using RPC commands, but it will still relay transactions for the network.

For example, your local IP might be something like 192.168.1.xxx or 10.2.xxx.xxx. It might be necessary to configure your router to keep this IP statically assigned to that computer, but aside from that nothing else is required.

edit: this is if you want to connect remotely within your own local network. if you want to be able to connect from anywhere, use @gingeropolous answer.

  • 1
    If you want to be able to connect to the node from outside your network, you will also need to setup a port forward the port 18081 on your router to the internal system IP running the node. You could also change the port number the daemon listens on and forward that port to avoid common detection of your open RPC node. Also be sure to run a restricted-rpc if you open it to the Internet. – DJ Jacket Jan 21 '17 at 14:38
  • Thank you for your detailed response! I was indeed asking about connecting on a non-local network so I accepted @gingeropolous's answer. – Daniel Ternyak Jan 24 '17 at 4:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.