Topic: Bitcoin node with 24/7 inbound connections without static IP (Read 358 times)

I didn't know you couldn't choose specific port. Although you could just configure to listen on that random inbound port.


I see. FYI using OpenVPN is possible with OpenVZ/LXC and older kernel, although you may experience more problem.

I've tried Mullvad some time ago and they both support port forwarding[1] (to accept incoming connection) and static IP address[2]. Although you need to configure it manually once.


FYI, this information usually available on FAQ page or page which list their VPS. You could use application such as virt-what as well.

[1] https://mullvad.net/en/help/port-forwarding-and-mullvad/
[2] https://mullvad.net/en/help/why-wireguard/

Hey, wanted to give a quick update about this since this may help other people who read this in the future.

I managed to get my node running at home using the static IP from my VPS by forwarding all inbound traffic to 10.101.111.3:8333 where my bitcoin node is listening.

I don't know why it didn't work at the beginning but the inbound connections are stable now. I think it's been running for 2+ months now without any issues.

This is my iptables setup (excluded rules not relevant to this topic):

I checked Mullvad out, I can only pick a random inbound port. But I want 8333 so that won't work. It used to be that bitcoin has a bias towards default ports, however, that doesn't seem to be the case anymore since https://github.com/bitcoin/bitcoin/pull/23542.

Nevertheless, I don't want to depend / don't need Mullvad here. I should be able to configure using my own VPN. I see this as a learning experience.

I used `virt-what`. It returned openvz and lxc. Since the VPS is still running on kernel 4.15.0, and Wireguard is only supported since kernel 5.6, I switched to a diffe[Suspicious link removed] provider (linode) with full virtualization. This one is running kernel 6.1.1-arch1-1 now.


I already finished IBD. I don't want to run the node on the shared server. I want to keep running it without pruning on my machine at home but just expose it using Wireguard and a VPS with a static public IP.

Mhh, I think I set everything up now.

Wireguard config on VPS (139.144.78.247, 10.101.111.1):


Wireguard config on host running `bitcoind`:


Firewall config on VPS:


Firewall config on 10.101.111.3:


(Removed docker rules and peers irrelevant to this problem)

Used `externalip=134.144.78.247` in bitcoin config to advertise my static, public IP.

However, I get no IPv4 inbound connections:


bitnodes.io did show my node as up when I finished configuring the firewall but now, it says "Your IP network is currently pending review." whatever that means.

I tested my setup using `nc` by sending a `version` message to the public IP. I got a response from my node, so I don't know what's wrong with this setup.


I didn't redact the public IP of my node here on purpose since I think it would be very helpful if someone can try to connect to my node and see if the connection is stable.

Any ideas?

Try it You may need port forwarding to get incoming connections.

If you're not using it to receive customer payments, I wouldn't worry about a short downtime.

That would fit a pruned node, but chances are your host won't appreciate doing an IBD (or any other sustained high load) on a shared server.

Having VPS you should be able to use VPN like Strongswan which has thousands of users and support is quite good. The only problem you may have is configuration of VPS on your provider side, as it may block forwarding. Usually it is not a big problem and if you work with 'people' with whom you may talk, not just machines which produce 'tickets' for customers' requests, the problem should be solvable.

https://www.tecmint.com/setup-ipsec-vpn-with-strongswan-on-debian-ubuntu/

Hey, I think I will indeed just use a static IP. Costs 5€ more per month (need to switch to "business" contract as you mentioned). Should be worth it. I was just a bit nervous because most likely the minimal duration of the contract will be set back to 2 years.

But I read that when I move to a new shared apartment, I don't have to pay for the contract anymore if there is already a internet service provider there. So I guess I am fine regarding this.




Ahh thanks for looking through. Very good to know that they aren't a full-service VPN.

Now that I think of it ... I already use Mullvad VPN. Can I maybe just use that to have a static IP for my bitcoin node? Not entirely sure how this works but seems like VPNs are the solution if I don't have a static IP. Will look into it, thanks! Totally forgot about my existing VPN, lol




Yes, it gets no inbound connections anymore. I already finished my IBD. So not sure how it would behave during IBD. But I thought IBD has nothing to do with inbound connections? My outbound connections are still here so downloading blocks should be fine.


Yes, that's what I have been doing when this occurs. Haven't though of automatic restarting after each IP change... I want to have consistent inbound connections tbh. When I start to run a lightning node, I think this restart solution may become a problem, no? Or isn't it that much of a problem if my node goes down regularly for a minute? I think it should be back up after a minute. But since the node needs to be online to route payments, the IP change could happen during a unfortunate time and thus maybe a channel gets closed?? Don't know enough about LN however.


I already have a VPS so that's no problem. As mentioned above, I also realized (lol) that I already use Mullvad VPN. Totally forgot about it. So I already have what I need to make this work, only needs some configuration? Will look into it.




I wouldn't call my ISP cheap (it's DTAG) but maybe because every ISP in Germany is quite expensive. I am paying 39,95€ per month. Static IP with business contract would cost 44,95€.


I am paying 4,39€ for my VPS. 2 virtual cores, 2GB RAM and 100 GB SSD. And 5€ per Month for Mullvad VPN. Never heard of KVM or OpenVZ before. Interesting. I'll ask my hosting provider what they use out of interest.

For what it's worth: the former is OpenVZ, the latter KVM (and quite popular, and even still available at that price). And indeed, I don't expect support.

That makes sense, they're looking at your old IP. I'm surprised though, I didn't expect any ISP to change an IP address while you're using it. Can't you complain to them?

I've tested OpenVPN on a $4/year VPS, and that worked. It's ipv6 only for that price, and shares the ipv4 IP. Around Black Friday, I paid $10.28/year for a 768 MB VPS with it's own ipv4 IP.

---

---

Come to think of it: according to myips.php, my ipv6 IP changes all the time! My ipv4 IP doesn't change. I have no idea why it even switches back and forth between ipv4 and ipv6, nor do I know why the ipv6 IP changes.

Side thought: I don't know where you are located but most ISPs do offer a static IP option for a fee. Might have to get the 'business class' service or something similar but it does tend to exist if you look for it. It might cost more, but if you are going to be putting in a lot of time and effort to get this to work, and there is an option just to pay and get static it might be worth it to save you some of that time and effort.

I can see you getting this to work and then something else someplace else changes and it stops working and you are back to spending time and effort to get it to work again till the next time something changes.

TOR will always work, but if you want a clearnet public IP, paying for it, if it's available might just be easier.

-Dave

Hey, thanks for all the replies.


I am using Tor now and it took some time, but I have inbound connections now. I also have been running i2p for a while but I think I never had any connection using I2P ever. I guess not many nodes run on I2P? Or I need a seed node?


Ah, I guess that's where services like https://tunnelsats.com/ come into play? I guess I could create my own VPN with my VPS using WireGuard?


TBH, that sounds like a ChatGPT response, haha. Interesting times we live in.

Regarding Dynamic DNS: I already tried that and as others pointed out, a node advertises IP addresses, not hostnames. So this doesn't work.

Regarding VPS: I tried this but I couldn't get inbound connections to work. Do you have a guide for that? I used `ssh -D` for outbound connections and `ssh -R` for inbound connections but that didn't work as described in my initial post:



My port forwarding works since I do get inbound connections when I restart my node. Only when my public IP changes, the inbound connections are lost and for some reason, no inbound connections appear again until I restart my node. Shouldn't I at least get new inbound connections after some time?


Yes, I tested it. I have been monitoring my public IP using a custom script and after every public IP change, all inbound connections were dropped. However, my IP was never found again.

I think I waited for at least a day once but nothing. I also thought my new IP should be eventually found but this does not seem to be the case. Maybe I have to dig into the code to understand this better. Wanted to do this anyway sometime, haha


The simple answer is that it is not possible


Isn't NO-IP the same as a DynDNS service? So this will not work since bitcoin does not advertise hostnames?

So I think my only viable solution here is to (also) continue using Tor or look into a VPN solution.

The right way to fix your issue is with NO-IP

https://www.noip.com/

Remember to configure your PC in the modem as DMZ, that way you will allow any call from WAN, that's the right way to do it, but you should have in mind that now anyone can try to access your server, so, before opening it to the WAN you should learn about some secure ways to protect your server.

Last time I tried it (in v21), Bitcoin Code did not support using hostnames for node addresses. And there is no DNS code in Bitcoin Core at all, all of that is actually in a separate, independent program called dnsseed. So how is this possible?

Does your IP address change during the day, or only when you reset your modem?

Either way: have you tested it? I'm pretty sure the network can handle it if your IP goes offline, nodes will just continue with their other connections and eventually find your new IP again.

I cannot find it now, but I remember some time ago there was a quite similar question, OP had problems with shared IP.
The problem was that his IP provider had a very limited pool of IP addresses and several customers where using the same IP, therefore there was no way to use port forwarding. You should check if it is not the case in your situation.

Running a Bitcoin node on a home network with a dynamic IP address can be challenging, as the IP address of the node will change over time. This can disrupt inbound connections to the node, making it difficult for other nodes on the network to connect to it.

One solution to this problem is to use a Dynamic DNS service, which allows you to use a hostname (e.g. "mynode.dyndns.org") to refer to your node's IP address, even if the IP address changes over time. The hostname can then be used in the externalip setting in your Bitcoin configuration file, so that other nodes on the network can connect to your node using the hostname.

Another solution is to use a Virtual Private Server (VPS) with a static IP address as a proxy for your home node. In this setup, you can use ssh tunnels to forward traffic between your home node and the VPS. This allows other nodes on the network to connect to your home node via the VPS, using the static IP address of the VPS.

Running Bitcoin over the Tor network is another option that could allow for uninterrupted inbound connections to your node. In this setup, your node would be accessible via a hidden service on the Tor network, which would provide a stable address that other nodes can use to connect to your node.

Overall, there are several solutions to the problem of running a Bitcoin node with a dynamic IP address. Each solution has its own advantages and disadvantages, and the best option for you will depend on your specific situation and requirements.

I think I mentioned this about 5 years ago (for myself) and no-IP seemed to be an option members had heard of to get a hostname (I think they used to give static IPs but might not do).

Tor is an alternative and quite a good one for running a lightning service (some wallets enforce its use). I don't think it matters too much if you're running a node connected via a hidden service or one on clearnet - you don't need as much firewall configurations to use tor in my experience anyway.

Hey!

I was wondering how people run nodes on their home network with an ISP which does not provide a static IP while keeping inbound connections during public IP changes.

I have been googling around for a while and was quite surprised that I haven't found a solution to this. This issue describes my problem that only restarts seem to help: https://github.com/bitcoin/bitcoin/issues/10262

At first, I thought I could use DynDNS and set externalip in my bitcoin config to this hostname. But in https://bitcointalksearch.org/topic/0201-how-to-make-my-full-node-advertise-domain-name-5282693, it is explained that the bitcoin network only advertises IP addresses:


which makes sense to me. So now I understand why using externalip with DynDNS can't work.

Then I thought I could use my virtual private server as a proxy since it has a static IP. I thought this could work using `ssh -D 8330 vps` for outbound connections and `ssh -R 8333:localhost:8330 vps` for inbound connections.

But no inbound connections are made. This is my bitcoin config:


I would be very glad if this would be possible. I really want to have the "full bitcoin node experience" with 24/7 inbound connections and seeing who connects to me and how long etc.

Also, I think running a lightning routing node without a static IP could become troublesome.

I also read about https://tunnelsats.com/ and I think this could also solve my problem even though I am not running (yet) a lightning node.

But I thought I could solve this using a simple proxy setup or similar easy tools.

Thanks for your time reading this!

Edit:

I guess running bitcoin over tor would be a viable solution for uninterrupted inbound connections? But there is no workaround for clearnet?