Tezos baker port to open for mainnet for good security

Question

Hello Tezos community,

I read about Tezos public port to open for mainnet, and try to achieve a good security. I understand the default port to open is 9732.

1. Is it a good practice to open this port to the world if you are baking, or maybe change to another port?
2. Or should I simply block all ports?
3. What about the private mode, is it something recommended for production, if so, I will need two Tezos node VPS, one public (node), one private (private node + baker).

Thank you for your answers. Good day! Greg

Answer 1

1. Yes, open this port to the world. It allows others tezos nodes to discover and connect to you.
2. Block all ports except 9732
3. Private mode simply tells other nodes that you do not accept incoming connections. This will lower the number of nodes that you stay connected to.

There are no security concerns regarding the node itself. The node has nothing to do with signing blocks, nothing to do with private keys, etc. The node just sends messages around to other nodes.

One public node + (private node & baker) doesn't gain much additional security unless your private node has absolutely zero exposure to the public internet (ie: must use VPN to connect to private node)

Provided that your baking key is encrypted and you are using something like tezos-signer or other cloud-based HSM, you can run everything securely on a single public node.