Shu
February 12, 2025, 6:07am
21
There a few types off NATs that can be at play: full cone nat, symmetric nat, restricted cone nat, and port restricted cone nat etc.
Depending on the NAT on the VPS side, your ports that you set for your local LAN may not be the same ports seen by external peers outside of the VPS’s public IP. In other words, it may not be mapping 1:1 port mappings (internal vs external port range) regardless of your port forwarding (inbound rules).
Symmetric NAT & Variation of Restricted NAT will be further prevent connections from coming in bound back to your LAN depending on src ip/port vs dst ip/port of the request, and vice versa. In addition, it requires an initiation from your side first to outbound host, before the outbound peer can communicate back through the NAT (the rest off external hosts would get blocked).
2 Likes
Using the same command to add nodes:
antctl add --count 500 --node-port 49000-49499 --metrics-port 33000-33499 --rewards-address … evm-arbitrum-one
and redirecting all UDP > port 1023 to the machine, I still have antctl status show greater than half of nodes with 0 connected peers. I’m watching firewall blocks and it’s very little.
My updated VPN’s firewall (pf) config is:
set block-policy drop
nat on vtnet0 from 192.168.0.15 to any → vtnet0
no rdr on vtnet0 proto udp from any to port 6000
block in quick on vtnet0 to { 224.0.0.0/4, 239.0.0.0/8 }
block log all
pass out quick on vtnet0 from any to any
pass in quick on wg0 from 192.168.0.15 to any
pass in quick on vtnet0 proto tcp from any to port 2200
I’ve restarted the nodes with --home-network, and now every node has (many) connected peers. How can I fix my firewall rules so that I can run with port forwarding and properly support the network?
Update: @drirmbda has hero status as adding --node-ip 192.168.0.15 fixed it (!!!)
neo
February 14, 2025, 12:19am
23
That could cause issues in your network, especially if you stream stuff on other machines.
If your nodes are using 49000 and above then do >= 49000
antctl is showing instantaneous active connections and not routing table peers. Routing table peers is the important figure since this shows how connected your nodes are. Look at logs or use the /metrics function and look for routing tablehttps://127.0.0.1:49000/metrics
Do you mean VPS? VPN might be another issue to deal with (double NAT and all that)
If VPS who is the provider and do they apply their own firewall upstream to your VPS and there is a web page to set the firewall rules for that one
So that worked for you. Does your machine have multiple NIC’s ?
Ok I was just investigating that and running some tests. What I observed was a large number of connected peers, then it’d drop down to 0. Good to know there’s a different value for a node’s routing table. IMHO it would be helpful for antctl status to show both types of peer connections for each node.
I keep getting connection refused when I try to pull from /metrics. Mind sharing a full command? Update: Nevermind, figured it out. Will answer the rest of your questions after I figure out what’s going on.
neo
February 14, 2025, 1:13am
25
And it has been said it is noted for future change when they have time
neo:
Do you mean VPS?
Both. It’s a VPS that I have configured as both a firewall and Wireguard server. I wanted something off of my home LAN so I could do better testing than I could with other node machines running and being afraid to mess all of them up.
None.
neo:
So that worked for you.
Now that I know antctl status shows a different value than routing table it’s hard to say. I must say though, --home-network seems to be performing better. (sadly)
Forward all UDP, port forwarding enabled, node ip set, starting node every 15s.
records: 0
conns:
Forward only UDP that’s port forwarded, port forwarding enabled, node ip set, starting node every 15s.
records: 0
conns:
Forward all UDP, home network, node ip set, starting node every 15s.
records: 2
conns:
Forward no UDP, home network, node ip set, starting node every 15s.
records: 2
conns:
1 Like
Setting --node-ip did double or more the throughput I observed nodes using, so I would say yes. And ‘yes’ re: multiple NICs, specifically the physical NIC and the wg0 interface that traffic needed to go out/in over.
1 Like
system
April 11, 2025, 7:17am
28
This topic was automatically closed after 60 days. New replies are no longer allowed.