External wallet connection

[djdookie]

Hi.
I just saw that an external wallet IP is connected to my full node on port 8449 without having this port open in my NAT!
Upnp was enabled at this time but my router doesn't show any additional port forwardings besides the manually configures 8444 to this host.
How can this happen?
Could this be a security flaw?

[artshevchenko]

Also noticed the connected external wallet. Very strange behavior, looks like a security problem. So far, I fixed it in Ubuntu like this:
sudo ufw deny out 8449

[shhhmel]

Could this somehow affect my local (origin) wallet? Because it seems like this command deny all outgoing requests from 8449 port.

[lvpcguru]

Any luck on this one? is it a wallet sync? or vulnerable port?

[ziomik]

If it's a problem… I have a problem too. Someone has vutro way to learn more .. I have wallet and fullnode on Windows and harvest on Linux ..

[lvpcguru]

So I have been doing some research on this. The only port inbound from the internet that you should allow is 8444 the others like 8449 and 8447 can be opened to your remote harvester or GUI machines per the guides but never to the internet. There are a number of api ports that might inadvertently be exposed if you just blanket NAT your router to the full_node instead of just that one port.

I have taken to setting up the firewall to block all but the 8444 port inbound with holes poked for my local harvesters and management. on Ubuntu using ufw this looks like this:
To Action From
-- ------ ----
[ 1] 3389/tcp ALLOW IN 10.0.0.41
[ 2] 55400/tcp ALLOW IN 10.0.0.41
[ 3] 8448/tcp ALLOW IN 10.0.0.41
[ 4] 8447/tcp ALLOW IN 10.0.0.41
[ 5] 22/tcp ALLOW IN 10.0.0.41
[ 6] 8444 ALLOW IN Anywhere
[ 7] 8444 (v6) ALLOW IN Anywhere (v6)

and default deny sudo ufw default deny incoming

[moonlitbugs]

Before I saw this discussion, I added a comment to issue #9048 detailing my findings.
Nota Bene: The incoming wallet does not connect on port 8449! It connects on port 8444, and then somehow morphs itself from a full_node into a wallet. It sure does smack of a wallet-exfiltration hack, although it's also possible it's just badly-written code that says "wallet" when it means "garbled full-node".

[BrandtH22]

If you are still experiencing the issues it is recommended to upgrade to the latest version of chia. Please download it from here: https://www.chia.net/downloads/

Since this issue has been open for a number of years without additional comments, we will be closing this ticket but if we have closed this ticket in error do not hesitate to reach out to us again with any followup questions, comments, or if the issue persists after an update.

Please note that upgrading major versions of chia generally requires the config.yaml to be recreated using these steps:
1. Stop chia
2. Rename the config or move it to a different directory
3. In CLI run chia init
4. Copy any custom settings from the old config to the new (plot drive directories, pool info, trusted node info, etc) - be careful here as yaml is very picky about formatting including those leading spaces
5. Start Chia

The best place to reach our support team is on Discord (https://discord.gg/chia) or by reopening this ticket.