13

I built and synced a node with default peer nodes and then switched it to private mode. Now I see many messages like the following days after making the switch to private mode.

Is there something I can do to prevent these connection attempts from untrusted peers?

And, do these messages matter (other than cluttering the output log)?

Was it fundamentally wrong to build a node this way, rather than making it private-mode from the beginning?

p2p.connection-pool: [private node] incoming connection from untrused peer rejected!
Improve this question
6

I saw an answer to this on Riot for the same question:

You could change the IP address of the node. If other peers know your IP address you cannot do anything against connection attempts.

I would recommend that you create a node in private mode, then create a public node, connect the private to the public one and then sync the private through the public node.

Credit goes to Adrian Brink

Improve this answer
2
  • This has happened to me too. Be careful here when you're setting things and testing everything out. If you start your node in non-private mode even once, your node's IP address will be known to the tezos network and it will be too late. – lostdorje Jan 30 '19 at 2:33
  • Changing IP address of the node might stop most inbound connection attempts, but you should still block access to port 9732 inbound on your firewall or iptables. There is no reason to enable inbound traffic that isn't required. – Luke Youngblood Jan 30 '19 at 15:45
1

If you are running in --private-mode, you don't need to allow any inbound TCP connections on port 9732 from peers. Block those connections on your firewall, or with iptables. Then you will no longer receive those messages in the Tezos node software, and your node will be protected from attempted inbound connections.

In general, the connection attempts are harmless; they are just indicating that some peers that learned about your node while it was still public, and before you put it in private mode, are still attempting to reconnect to it. But, it is better for your firewall or iptables to block the connections than for the Tezos node software to have to close them.

Improve this answer
0

The IP address needs to be changed because if other peers know it then you cannot do anything about connections.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.