Running bitcoin node in docker behind NAT

Question

A running bitcoin node doesn't accept incoming connections when it's running behind NAT in a docker container.

To confirm the problem is related to docker I edited NAT settings on my router. If router's WAN port 8333 redirects to a machine running full node as a process incoming connections are possible. But if WAN port 8333 redirects to a machine running full node in docker container - I get inaccessible from outside bitcoin node.

To test accessability that I used this URL https://bitnodes.earn.com/#join-the-network (the website auto detects your external IP address and auto fills the box; only thing left is to press the button). If the node is accessible the test finishes green, if not - red.

Answer 1

Root cause.

The root cause of the problem is default settings in docker container. More precisely, network settings mode which has bridge mode by default. In bridge mode all incoming connections are seen from inside docker container as coming from the same IP address (which is 172.17.0.1). There are multiple hard forks out there so a foreign node running BCH or other forked bitcoin stuff would connect to your node and try to propagate invalid transaction(s). After few attempts your bitcoin node puts such misbehaving incoming connection in a blacklist. Having one connection banned, your node effectively bans all other incoming connections as they are seemed to come from the same IP address.

Confirmation from a technical point of view (via RPC).

To confirm such situtation we can setup RPC to call bitcoin node. Configuration options such as -rpcconnect and -rpcauth can be put into bitcoin.conf file so I skip them here. The command

bitcoin-cli listbanned

shows list of blacklisted misbehaving nodes where we can see only one address.

In my case the output was like that

[
  {
    "address": "172.17.0.1/32",
    "banned_until": 1572109811,
    "ban_created": 1572023411,
    "ban_reason": "node misbehaving"
  }
]

After a successful diagnosis it's possible to clear blacklist with the following command to temporarily clear blacklist

bitcoin-cli clearbanned

Having blacklist cleared we can run another test here https://bitnodes.earn.com/#join-the-network and confirm the node is now visible from outside.

Solution.

1. Network settings in docker. The most proper solution. In my case, running on a Synology NAS, I had to recreate the container to switch off the bridge mode.

2. Schedule (eg, via cron) a task to clear banned.

3. Whitelist the only address docker accepts connections from. Couldn't find a way to permanently implement it.

PS. Can someone tag the topic with a 'nat' and 'docker' tags. It looks like I need some reputation to make it happen.