onflow / onflow/flow

Option to disable traffic to RFC 1918 ranges

Open
#469 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Feature Feedback
Dominant language
Go
Stars
361
Forks
159
PR merge metrics
No merged PRs in 30d

Description

Instructions

Add a flag or config option like --no-private-ipv4 to Flow daemon. Polkadot and other Subtrate-based protocols have this flag to prevent libp2p peer discovery from trying to connect to RFC 1918 ranges.

Issue To Be Solved

Hetzner is really strict when it comes to traffic to RFC 1918 private network ranges.
Recently, our flow nodes have been generating traffic to hundreds of unroutable IPs in private network ranges.
Hetzner mistook this for a port scan and pulled the plug on our servers after two hours.

As a short term fix, we patched in firewall rules that prevent outgoing packets to the affected network ranges.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in the Flow daemon's existing flag or configuration handling and trace the libp2p peer-discovery path that attempts connections to RFC 1918 ranges. Add coverage for the new option, and consider the work done when enabling it prevents outbound attempts to those private IPv4 ranges without affecting other peer connections.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
blockchain, networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.