3

I've been wondering about this. From what I read, people only open 9735 to run a "successful" node.

To me it makes sense not to open bitcoins port, but I could also imagine that some scanners out there scan for bitcoin nodes and upon success check the same IP for an additional lightning node.

3 Answers 3

1
+50

Maybe some lightning implementations scan for bitcoin nodes and then look for lightning capability on top?

I'm not aware of any Lightning implementations that do this. The Lightning P2P network is a separate network to the Bitcoin P2P network and although Lightning nodes are required to watch the Bitcoin blockchain for counterparty cheat attempts to enforce Lightning's security model this could be done through connecting to a block explorer (e.g. the Core Lightning plugin Sauron) rather than running a Bitcoin full node. It is not broadcast on the Lightning Network whether a Bitcoin full node is being run in parallel with that Lightning node or not and what the IP address of that Bitcoin full node is.

To me it makes sense not to open bitcoins port, but I could also imagine that some scanners out there scan for bitcoin nodes and upon success check the same IP for an additional lightning node.

If you are running a Bitcoin full node with your Lightning node (which would generally be recommended for trust minimization) then whether you open the Bitcoin port (8333) is a Bitcoin related question and not a Lightning one. Do you want to allow inbound connections on the Bitcoin P2P layer, potential peers to message your Bitcoin full node and to be discoverable on a full node indexing service like bitnodes.io?

1
  • 1
    No, I don't want to expose my bitcoin node to any other person to be honest. If it is to no advantage, I would keep my Bitcoin node in the onion network only and just open lightning for the clearnet. This answer is currently the best one, the other ones seem to be guessing. I will accept this answer and if no better one appears, you can have the bounty. Thanks!
    – codepleb
    Commented Feb 14 at 15:36
-1

I think this heavily depends on how you define exposure. However, I don't think the patterns you describe for scanning lightning nodes would make sense. Not only would it leave out nodes that are not exposing the 8333 port, but it also assumes that both nodes are being run on the same machine. It would be perfectly plausible to run them in different machines under the same network, or even as different containers under a dockerized setup.

So all in all I think exposing the lightning port should suffice

-1

There's no need to open the bitcoin ports to run a "successful" lightning node (whatever successful means in that context). It arguably improves your security stance if you open up less ports to the outside world.

The key part is that you're accessible on port 9375 and some nodes expose on clearnet and onion to allow for more flexibility.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.