8

I would like to know how I can secure the Stellar node from unauthorized access. I run a Stellar node (still learning) as a Full validator with the following services on the default port.

  • Stellar core (PEER_PORT default 11625 & HTTP_PORT default 11626)
  • Horizon (port 8000)

Ideally, who would need access to each of those port? I read the Network Access section at https://www.stellar.org/developers/stellar-core/software/admin.html#network-access. I don't understand that fully.

  1. My host is behind the firewall with port 11625 closed but still, I see my node running good (ledger hash keeps changing).
  2. In fact, most of the nodes at https://stellarbeat.io/nodes returns the empty response to the browser on 11625, 11626 & 8000 (I essentially took IBM's nodes as reference)
  3. If only peers can connect on 11626, how would I know the peer IPs?
5
+50

TL;DR: only expose port 11625 on stellar-core.


Stellar Core Port 11625

Port 11625 of stellar-core must be exposed outside your network to allow it to communicate with peers.

The stellar-core configuration file has a KNOWN_PEERS field which specifies the IPs and domains that your stellar-core node will try to connect to. This is how your node will register with a peer.


Stellar Core Port 11626

Your Horizon instance will read from port 11626 of your stellar-core instance. Port 11626 should not be exposed outside your network. If your Horizon instance is running on a different IP within your network then you should set the PUBLIC_HTTP_PORT field to true in your Stellar-Core configuration. Here's an excerpt from the sample config file:

# PUBLIC_HTTP_PORT (true or false) default false
# If false you only accept stellar commands from localhost.
# Do not set to true and expose the port to the open internet. This will allow
# random people to run stellar commands on your server. (such as `stop`)
PUBLIC_HTTP_PORT=false

Note: this is dangerous and if you don't firewall this port from the outside network then anyone can run commands on your Stellar-Core instance via http.


Horizon Port 8000

Your Horizon service running on port 8000 should not be exposed outside your network assuming this is your own private Horizon server where all calls will come from within your network.

If you want to run a publicly accessible Horizon server then you would need to expose port 8000.

  • stackcats, thanks for your answer. When I access mystellarnode:11626/info, I see ledger hash keeps changing after every few seconds. Can I consider that my node is doing good although 11625 is closed? – Sivaji Jun 19 '18 at 13:23
  • 1
    If your ledger hash is changing as you described then you can consider your stellar-core node to be set up correctly. Are you able to telnet mystellarnode 11625 from outside your stellar-core node? (what is the output?) – nikhils Jun 19 '18 at 20:38
  • Waits indefinitely with the message "Trying aa.bb.cc.dd..." – Sivaji Jun 20 '18 at 15:15
  • It should ideally connect and then disconnect immediately (as opposed to "refusing" to connect). However, in your case since it doesn't "refuse" the connection I think it's working fine. – nikhils Jun 21 '18 at 22:03
  • @nikhils >If you want to run a publicly accessible Horizon server then you would need to expose port 8000. How is this done? Is there a config setting to expose horizon? (similar to how there is PUBLIC_HTTP_PORT for stellar-core port 11626) Thanks for any help. – John Murphy Jan 24 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.