6

I have set up my baker with:

  • a public non-baking node with public IP, let's call it "A.A.A.A"
  • a private baking node without public IP

To lock down the private node (and also because it does not need a public IP), I have set up a reverse SSH tunnel for port 9732 from the private to the public node on 19732. Thus, the public node can connect to the private node via its own 127.0.0.1:19732, which forwards to the private nodes port 9732.

I'm running the private node with: ./tezos-node run --rpc-addr 127.0.0.1:8732 --private-mode --no-bootstrap-peers --bootstrap-threshold=1 --connections 1 --peer A.A.A.A

And I'm running the public node with: ./tezos-node run --rpc-addr 127.0.0.1:8732 --peer 127.0.0.1:19732

Additionally, I have tried adding different trust entries like:

  • ./tezos-admin-client trust address 127.0.0.1:19732 on public node
  • ./tezos-admin-client trust address A.A.A.A:9732 on private node
  • ./tezos-admin-client trust peer idxxxxxx on both private and public node

All I keep getting in the private nodes log is: p2p.connection-pool: [private node] incoming connection from untrused peer rejected! and the public node tries, but can never successfully connect to the private node or the other way around.

What can I do or check to get closer to connecting my nodes?

6

I had same exact situation. It seems that (and I did not see this documented anywhere) when using private mode, the private node must initiate the connection. In my case it was a firewall rule preventing the private node from establishing the connection, and after I permitted that everything worked great.

| improve this answer | |
  • 1
    Holy smokes, you where right! Doing a sudo ufw allow out from any and connecting from the private node solved it. – Svante Apr 11 '19 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.