<h1>Root cause.</h1>

<p>The root cause of the problem is default settings in docker container. More precisely, network settings mode which has bridge mode by default. In bridge mode all incoming connections are seen from inside docker container as coming from the same IP address (which is 172.17.0.1). There are multiple hard forks out there so a foreign node running BCH or other forked bitcoin stuff would connect to your node and try to propagate invalid transaction(s). After few attempts your bitcoin node puts such misbehaving incoming connection in a blacklist. Having one connection banned, your node effectively bans all other incoming connections as they are seemed to come from the same IP address.</p>

<h1>Confirmation from a technical point of view (via RPC).</h1>

<p>To confirm such situtation we can setup RPC to call bitcoin node. Configuration options such as <code>-rpcconnect</code> and <code>-rpcauth</code> can be put into bitcoin.conf file so I skip them here. The command</p>

<pre><code>bitcoin-cli listbanned
</code></pre>

<p>shows list of blacklisted misbehaving nodes where we can see only one address.</p>

<p>In my case the output was like that</p>

<pre><code>[
  {
    "address": "172.17.0.1/32",
    "banned_until": 1572109811,
    "ban_created": 1572023411,
    "ban_reason": "node misbehaving"
  }
]
</code></pre>

<p>After a successful diagnosis it's possible to clear blacklist with the following command to temporarily clear blacklist</p>

<pre><code>bitcoin-cli clearbanned
</code></pre>

<p>Having blacklist cleared we can run another test here <a href="https://bitnodes.earn.com/#join-the-network" rel="nofollow noreferrer">https://bitnodes.earn.com/#join-the-network</a> and confirm the node is now visible from outside.</p>

<h1>Solution.</h1>

<ol>
<li><p>Network settings in docker.
The most proper solution.
In my case, running on a Synology NAS, I had to recreate the container to switch off the bridge mode.</p></li>
<li><p>Schedule (eg, via cron) a task to clear banned.</p></li>
<li><p>Whitelist the only address docker accepts connections from.
Couldn't find a way to permanently implement it.</p></li>
</ol>

<p>PS. Can someone tag the topic with a 'nat' and 'docker' tags. It looks like I need some reputation to make it happen.</p>

CC BY-SA 4.0
2019-10-31T18:46:51.167Z
2019-10-31T18:46:51.167Z
sancoder
<p>A running bitcoin node doesn't accept incoming connections when it's running behind NAT in a docker container.</p>

<p>To confirm the problem is related to docker I edited NAT settings on my router. If router's WAN port 8333 redirects to a machine running full node as a process incoming connections are possible. But if WAN port 8333 redirects to a machine running full node in docker container - I get inaccessible from outside bitcoin node. </p>

<p>To test accessability that I used this URL <a href="https://bitnodes.earn.com/#join-the-network" rel="nofollow noreferrer">https://bitnodes.earn.com/#join-the-network</a> (the website auto detects your external IP address and auto fills the box; only thing left is to press the button). If the node is accessible the test finishes green, if not - red.</p>

CC BY-SA 4.0
2019-10-25T21:02:15.670Z
Banning happens for a reason.
Claris
<bitcoin-core><bitcoind>
Running bitcoin node in docker behind NAT
sancoder
# Running bitcoin node in docker behind NAT

(Asked by: username_0 on 2019-10-25)

A running bitcoin node doesn't accept incoming connections when it's running behind NAT in a docker container.

To confirm the problem is related to docker I edited NAT settings on my router. If router's WAN port 8333 redirects to a machine running full node as a process incoming connections are possible. But if WAN port 8333 redirects to a machine running full node in docker container - I get inaccessible from outside bitcoin node.

To test accessability that I used this URL <https://bitnodes.earn.com/#join-the-network> (the website auto detects your external IP address and auto fills the box; only thing left is to press the button). If the node is accessible the test finishes green, if not - red.

**Tags:** bitcoin-core, bitcoind

> **Comments:**
> **username_1**: Banning happens for a reason.  

---

## 1 answers

### Answer by username_0 on 2019-10-31. Score: 1 | Accepted answer

# Root cause.

The root cause of the problem is default settings in docker container. More precisely, network settings mode which has bridge mode by default. In bridge mode all incoming connections are seen from inside docker container as coming from the same IP address (which is 172.17.0.1). There are multiple hard forks out there so a foreign node running BCH or other forked bitcoin stuff would connect to your node and try to propagate invalid transaction(s). After few attempts your bitcoin node puts such misbehaving incoming connection in a blacklist. Having one connection banned, your node effectively bans all other incoming connections as they are seemed to come from the same IP address.

# Confirmation from a technical point of view (via RPC).

To confirm such situtation we can setup RPC to call bitcoin node. Configuration options such as `-rpcconnect` and `-rpcauth` can be put into bitcoin.conf file so I skip them here. The command

```
bitcoin-cli listbanned

```

shows list of blacklisted misbehaving nodes where we can see only one address.

In my case the output was like that

```
[
  {
    "address": "172.17.0.1/32",
    "banned_until": 1572109811,
    "ban_created": 1572023411,
    "ban_reason": "node misbehaving"
  }
]

```

After a successful diagnosis it's possible to clear blacklist with the following command to temporarily clear blacklist

```
bitcoin-cli clearbanned

```

Having blacklist cleared we can run another test here <https://bitnodes.earn.com/#join-the-network> and confirm the node is now visible from outside.

# Solution.

1. Network settings in docker.
   The most proper solution.
   In my case, running on a Synology NAS, I had to recreate the container to switch off the bridge mode.
2. Schedule (eg, via cron) a task to clear banned.
3. Whitelist the only address docker accepts connections from.
   Couldn't find a way to permanently implement it.

PS. Can someone tag the topic with a 'nat' and 'docker' tags. It looks like I need some reputation to make it happen.


---

