I am running bitcoind on a DigitalOcean droplet with public IP address e.g. 1.1.1.1.
I would like to connect to it via RPC from another DigitalOcean droplet with public IP address e.g. 2.2.2.2.
Both Droplets are running Ubuntu Linux 18.04.
~/.bitcoin/bitcoin.conf on 1.1.1.1:
datadir=/mnt/vol1
disablewallet=1
rpcbind=1.1.1.1
rpcuser=x
rpcpassword=x
rpcallowip=2.2.2.2/32
server=1
netstat -ln | grep 8332 on 1.1.1.1 yields:
tcp 0 0 127.0.0.1:8332 0.0.0.0:* LISTEN
tcp6 0 0 ::1:8332 :::* LISTEN
RPC commands on 1.1.1.1 such as ./bitcoin-cli -rpcuser=x -rpcpassword=x -rpcconnect=localhost -rpcport=8332 getnetworkinfo return normally.
However, on machine 2.2.2.2, when I run ./bitcoin-cli -rpcuser=x -rpcpassword=x -rpcconnect=1.1.1.1 -rpcport=8332 getnetworkinfo I get:
error: Could not connect to the server 1.1.1.1:8332
Make sure the bitcoind server is running and that you are connecting to the correct RPC port.
Machine 1.1.1.1 has firewall rules in DigitalOcean as follows:
Type Protocol Port Range Sources
SSH TCP 22 2.2.2.2/32
Custom TCP 8332 2.2.2.2/32
Note that SSH into 1.1.1.1 from 2.2.2.2 is working just fine.
sudo iptables -L on 1.1.1.1 gives:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Is there anything obviously wrong in my configuration or setup?
Running curl -v 1.1.1.1:8332 on 2.2.2.2 immediately returns with:
* Rebuilt URL to: 1.1.1.1:8332/
* Trying 1.1.1.1...
* connect to 1.1.1.1 port 8332 failed: Connection refused
* Failed to connect to 1.1.1.1 port 8332: Connection refused
* Closing connection 0
curl: (7) Failed to connect to 1.1.1.1 port 8332: Connection refused
which from what I have read likely indicates a firewall issue.
bitcoindis only binding by default on the localhost interface which in inaccessible to the outside world. Also, what you're doing is highly inadvisable, as anyone on the internet will have access to your RPC interface; it's better to tunnel it using ssh proxies, or using something like stunnel for security.rpcbind=1.1.1.1in my bitcoind.conf and now I can connect successfully. Regarding your second comment, surely it is safe if I use an IP address whitelist at the network level? Or are you suggesting that someone can spoof the whitelisted IP and connect to my RPC service using the plaintext credentials?