Allow a Diode node through the ufw firewall

Lite-Node Category
1

Hi all,
After installing Diode Lite following these instructions the node dashboard says:

Connection Failed
Couldn't contact node for connectivity status on port **8545** . Ensure the node is running and accessible on port 8545. Check your firewall settings if you have them enabled.

Then when allowing port 8545 with ufw allow 8545 the node dashboard says: Partially Connected and wants connectivity on ports 443, 993, 1723, 10000, 41046 and 51055 too.
Rather than opening up all these ports, is there an elegant way to let diode-node pass the ufw firewall?

2

You should be ok with below
snap set diode-node edge2-port=41046,1723,10000

make sure you have the settings correct on the lite node and it should kick in. at the moment I am seeing network errors that may add to your delay.

3

Thank you James. After running that command, and by allowing all traffic through ports 8545, 410461 1723 and 10000 through the firewall, the node was connected.

Instead of allowing all traffic through these ports, how would I allow only diode-node activity through these ports?

4

If your firewall allows restrict it to just diode.

The easiest way to do this on Linux is if you reserve a chunk at the top or bottom range of the standard ephemeral port range.

Find out what your current range is by running

cat /proc/sys/net/ipv4/ip_local_port_range

Then set it by echoing something different into it (and modifying sysctl.conf or similar to make it happen on boot as well). My system uses 32768-61000, so I could change that to 32768-60000 in conjunction with SELinux/AppArmor to reserve 60001-61000 for my application.

echo "32768 60000" > /proc/sys/net/ipv4/ip_local_port_range

I’m not aware of a way to carve out a gap in the middle of the ephemeral range.