Ports & Endpoints
The matrix
| Port | Development | Public RPC | Validator |
|---|---|---|---|
| 30333 P2P | local | public | public |
| 9944 RPC | local | RPC_BIND: all interfaces on testnet (ufw denies it, Caddy in front), loopback on mainnet | loopback only (published on 127.0.0.1) |
| 9945 WS RPC | — | loopback only — Caddy's WSS upstream | — |
| 9615 metrics | — | host NIC — firewall it | loopback by default |
| 443 / 80 | — | public, Cloudflare only | — |
9944 serves both HTTP and WebSocket; on the public RPC, Caddy sends WebSocket
traffic to the rate-limited 9945 instead. The image's EXPOSE 9933 is unused.
Why the roles differ so much
The public RPC runs with network_mode: host. There is no port
mapping at all — the values in .env are the sockets the node listens on, and
the firewall is the only thing containing them. Get a ufw rule wrong and
the port is genuinely open.
The validator runs on bridge networking with an explicit ports: block, and
its defaults fail closed:
RPC_BIND=127.0.0.1 # leave this. NEVER 0.0.0.0 or a public IP
METRICS_BIND=127.0.0.1 # forget to set it and nothing is exposed
Those loopback defaults are why the validator's RPC is safe although it serves unsafe methods — see Node Flags.
Firewall
Every role:
sudo ufw allow 22/tcp # SSH — restrict to your own IP if you can
sudo ufw allow 30333/tcp # P2P
sudo ufw enable
Public RPC adds the Cloudflare-only rules for 80/443 and explicitly denies the node's own ports — Caddy reaches the node over loopback:
sudo ufw deny 9944 # RPC
sudo ufw deny 9615 # Prometheus
node-deploy ships scripts/sync-cloudflare-ufw.sh to load the Cloudflare
ranges and keep them current; run it from cron monthly. It fails closed — if the
range fetch fails it aborts rather than wiping the allow-list and locking
Cloudflare out.
Metrics on a private interface:
sudo ufw allow from <monitoring-ip> to any port 9615 proto tcp
sudo ufw deny 9615
Source-address restriction is the only thing protecting 9615. Never replace it
with a blanket ufw allow.
Endpoints a public RPC serves
See What you are serving.