I have set up my baker with:

  • a public non-baking node with public IP, let's call it "A.A.A.A"
  • a private baking node without public IP

To lock down the private node (and also because it does not need a public IP), I have set up a reverse SSH tunnel for port 9732 from the private to the public node on 19732. Thus, the public node can connect to the private node via its own, which forwards to the private nodes port 9732.

I'm running the private node with: ./tezos-node run --rpc-addr --private-mode --no-bootstrap-peers --bootstrap-threshold=1 --connections 1 --peer A.A.A.A

And I'm running the public node with: ./tezos-node run --rpc-addr --peer

Additionally, I have tried adding different trust entries like:

  • ./tezos-admin-client trust address on public node
  • ./tezos-admin-client trust address A.A.A.A:9732 on private node
  • ./tezos-admin-client trust peer idxxxxxx on both private and public node

All I keep getting in the private nodes log is: p2p.connection-pool: [private node] incoming connection from untrused peer rejected! and the public node tries, but can never successfully connect to the private node or the other way around.

What can I do or check to get closer to connecting my nodes?

1 Answer 1


I had same exact situation. It seems that (and I did not see this documented anywhere) when using private mode, the private node must initiate the connection. In my case it was a firewall rule preventing the private node from establishing the connection, and after I permitted that everything worked great.

  • 1
    Holy smokes, you where right! Doing a sudo ufw allow out from any and connecting from the private node solved it.
    – Svante
    Apr 11, 2019 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.