Securing --rpcaddr endpoint on Go Ethereum node

Question

I have been connecting nodes to a PoA blockchain based server and the only way I could get it to work was to specify the server address in the geth connection string as follows -

 --rpcaddr xx.xxx.xx.x

I understand this allows anyone to access the node. It is a private network and it seems to me I have now created a security hole.

Is there a way to actually allow access from my own server but deny access to others? So I want in effect a server IP list and to allow the approving server for new nodes to restrict access to just those IPs.

Answer 1

The Ethereum node does not have built in accesss control list features. I feel this would not be the set of core features. It can be also handled easily externally.

What you can do

• JSON-RPC listens to localhost and you use a front proxy (Nginx) with access control list: https://tokenmarket.net/blog/protecting-ethereum-json-rpc-api-with-password/

• Use IP whitelisting on server internal firewall level (ufw on Ubuntu Linux)