9

I would like to know how I can secure the Stellar node from unauthorized access. I run a Stellar node (still learning) as a Full validator with the following services on the default port.

  • Stellar core (PEER_PORT default 11625 & HTTP_PORT default 11626)
  • Horizon (port 8000)

Ideally, who would need access to each of those port? I read the Network Access section at https://www.stellar.org/developers/stellar-core/software/admin.html#network-access. I don't understand that fully.

  1. My host is behind the firewall with port 11625 closed but still, I see my node running good (ledger hash keeps changing).
  2. In fact, most of the nodes at https://stellarbeat.io/nodes returns the empty response to the browser on 11625, 11626 & 8000 (I essentially took IBM's nodes as reference)
  3. If only peers can connect on 11626, how would I know the peer IPs?
Improve this question

1 Answer 1

Reset to default
8
+50

TL;DR: only expose port 11625 on stellar-core.

Stellar Core Port 11625

Port 11625 of stellar-core must be exposed outside your network to allow it to communicate with peers.

The stellar-core configuration file has a KNOWN_PEERS field which specifies the IPs and domains that your stellar-core node will try to connect to. This is how your node will register with a peer.

Stellar Core Port 11626

Your Horizon instance will read from port 11626 of your stellar-core instance. Port 11626 should not be exposed outside your network. If your Horizon instance is running on a different IP within your network then you should set the PUBLIC_HTTP_PORT field to true in your Stellar-Core configuration. Here's an excerpt from the sample config file:

# PUBLIC_HTTP_PORT (true or false) default false
# If false you only accept stellar commands from localhost.
# Do not set to true and expose the port to the open internet. This will allow
# random people to run stellar commands on your server. (such as `stop`)
PUBLIC_HTTP_PORT=false

Note: this is dangerous and if you don't firewall this port from the outside network then anyone can run commands on your Stellar-Core instance via http.

Horizon Port 8000

Your Horizon service running on port 8000 should not be exposed outside your network assuming this is your own private Horizon server where all calls will come from within your network.

If you want to run a publicly accessible Horizon server then you would need to expose port 8000.

Improve this answer
6
  • stackcats, thanks for your answer. When I access mystellarnode:11626/info, I see ledger hash keeps changing after every few seconds. Can I consider that my node is doing good although 11625 is closed?
    – Sivaji
    Jun 19, 2018 at 13:23
  • 1
    If your ledger hash is changing as you described then you can consider your stellar-core node to be set up correctly. Are you able to telnet mystellarnode 11625 from outside your stellar-core node? (what is the output?)
    – nikhils
    Jun 19, 2018 at 20:38
  • Waits indefinitely with the message "Trying aa.bb.cc.dd..."
    – Sivaji
    Jun 20, 2018 at 15:15
  • It should ideally connect and then disconnect immediately (as opposed to "refusing" to connect). However, in your case since it doesn't "refuse" the connection I think it's working fine.
    – nikhils
    Jun 21, 2018 at 22:03
  • @nikhils >If you want to run a publicly accessible Horizon server then you would need to expose port 8000. How is this done? Is there a config setting to expose horizon? (similar to how there is PUBLIC_HTTP_PORT for stellar-core port 11626) Thanks for any help.
    – John Murphy
    Jan 24, 2019 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.