Can anyone share a knowledge how to

_ secure LND node

_ backup node with all Channels

I think only a seed will not be sufficient. What is your plan B in case of disaster? How to do an Emergency restore, migration to other server, or set up high availability solution? thanks

2 Answers 2


You can secure an LND node in the same way how you would secure any host on the internet. You can for example use ufw to set up a firewall. You could also have a physical firewall in front of you node. Also a big step towards security would be to run no other software on the node.

As for backups it is a little bit more tricky. The seedwords will not include the state of all of your channels. With the current channel design you cannot restore an old backup. As an old channel state would - following the protocol - allow your channel partners to claim all bitcoins in that channel. However you can use a distributed file system or a distributed data base to store your channel state. If configured properly writing to the file system or database will certainly be slower as all calls have to be synchronized and blocking. Also you could at least have a raid system that helps if a disk crashes.

Generally you can shutdown your lightning node and migrate it to another computer by copying the database. As mentioned again it is tricky as you really have to make sure that you don't migrate old state. I have a video showing this for c-lightning. The process for lnd should be similar.

  • Thank you Rene for the great anwer. So regular backups make no sense... Jan 17, 2019 at 13:14
  • Yes exactly. You will need a better strategy line the ones I mentioned. Maybe others have better strategies Jan 17, 2019 at 18:33

Newer versions (0.6) of LND support channel backups/restore without restarting. So doing a backup of the seed plus channels should help, but I think you need to to frequent backups, maybe with every channel transaction, to have always the latest state of the channels.

Also I secure my LND keeping it into a docker container, with restricted access only to port 9735, and using the GRPC from inside the container or from a private network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.