External wallet connection

[djdookie]

Hi.
I just saw that an external wallet IP is connected to my full node on port 8449 without having this port open in my NAT!
Upnp was enabled at this time but my router doesn't show any additional port forwardings besides the manually configures 8444 to this host.
How can this happen?
Could this be a security flaw?

[artshevchenko]

Also noticed the connected external wallet. Very strange behavior, looks like a security problem. So far, I fixed it in Ubuntu like this:
sudo ufw deny out 8449

[shhhmel]

Could this somehow affect my local (origin) wallet? Because it seems like this command deny all outgoing requests from 8449 port.

[lvpcguru]

Any luck on this one? is it a wallet sync? or vulnerable port?

[ziomik]

If it's a problem… I have a problem too. Someone has vutro way to learn more .. I have wallet and fullnode on Windows and harvest on Linux ..

[lvpcguru]

So I have been doing some research on this. The only port inbound from the internet that you should allow is 8444 the others like 8449 and 8447 can be opened to your remote harvester or GUI machines per the guides but never to the internet. There are a number of api ports that might inadvertently be exposed if you just blanket NAT your router to the full_node instead of just that one port.

I have taken to setting up the firewall to block all but the 8444 port inbound with holes poked for my local harvesters and management. on Ubuntu using ufw this looks like this:
To Action From
-- ------ ----
[ 1] 3389/tcp ALLOW IN 10.0.0.41
[ 2] 55400/tcp ALLOW IN 10.0.0.41
[ 3] 8448/tcp ALLOW IN 10.0.0.41
[ 4] 8447/tcp ALLOW IN 10.0.0.41
[ 5] 22/tcp ALLOW IN 10.0.0.41
[ 6] 8444 ALLOW IN Anywhere
[ 7] 8444 (v6) ALLOW IN Anywhere (v6)

and default deny sudo ufw default deny incoming

[moonlitbugs]

Before I saw this discussion, I added a comment to issue #9048 detailing my findings.
Nota Bene: The incoming wallet does not connect on port 8449! It connects on port 8444, and then somehow morphs itself from a full_node into a wallet. It sure does smack of a wallet-exfiltration hack, although it's also possible it's just badly-written code that says "wallet" when it means "garbled full-node".