Description
Version information:
go-ipfs version: 0.4.15-
Repo version: 6
System version: amd64/linux
Golang version: go1.9.7
Type:
Bug
Description:
IPFS randomly connects to addresses in a way that resembles port scanning, without any indication of what is happening in the logs (level=debug).
A few days after installing IPFS daemon on my public server, I've got email from provider (AWS) with abuse report, indicating that sombeody received a port scan from my address (700 TCP ports scanned in total).
To be safer and not get banned, I've done the following steps:
- Disable all NAT traversal, MDNS, and other "magic" technologies in IPFS server (as based on the searches, they may be responsible for things similar to port scanning)
- To ensure I don't get blamed for port scanning, configured firewall to allow outgoing connections to only pot 4001
- Configured IPFS to advertise only my public IP address (and not e.g. 127.0.0.1, or internal address of Docker container), to ensure none of the NAT "piercing" logic is needed.
- Added logging on AWS to monitor all traffic going to and from machine
- Added debug level logging on ipfs daemon
This is my full config: https://ipfs.io/ipfs/QmQUWSFqV9bDckgpzBaKBBZsPSwHCxVAjKRx31TD5zuLVV/
This is how I generate the config (start script of my Docker image): https://github.com/raw/burdakovd/dapps.earth/master/ipfs/start.sh
Now, I started looking into rejected outgoing connections, and indeed I see behavior resembling port scan, despite all my settings. Luckily this time, my local firewall prevented another abuse report.
Here are logs indicating my node (internal IP is show in logs) connecting to 54.186.184.82. First connection is OK, and then 10 minutes later it starts connecting to random ports of 54.186.184.82.
Schema: [version, account, eni, source, destination, srcport, destport, protocol, packets, bytes, windowstart, windowend, action, flowlogstatus]
ACCEPT/REJECT means just whether the connection was accepted/rejected by my firewall, not necessarily means that the connection successfully went through, as it could've been rejected on the other side.
In the meantime, in ipfs logs (debug level of logging enabled), there is no mention of 54.186.184.82 whatsoever!
(note: 01:42:00 is the moment when I have restarted my node, after having updated log level to "debug")
Furthermore, I see that in third line of network logs 54.186.184.82 was attempting to connect to me at port 1024, despite me advertising only 4001.