<blockquote>
  <p>figure the <code>--rpcuser</code> setting is not what I need, right?</p>
</blockquote>

<p>That is correct, <code>-rpcuser</code> is completely unrelated to what you want to do.</p>

<p>You can start bitcoind with the <code>-maxconnections=&lt;n&gt;</code> option where  is the maximum number of connections that you want to allow (or add the option to the bitcoin.conf file). </p>

<p>Then you can setup an external firewall to manage your connections. With that firewall, you allow through n-8-1 external connections on port 8333. This means that you are allowing other nodes to connect to you, but still keep one unused connection less than your <code>maxconnections</code> setting for your SPV wallet. Then you add another rule to the firewall to allow 1 connection on a different port which just forwards traffic to port 8333. You connect your SPV wallet to that other port.</p>

CC BY-SA 3.0
2017-10-25T18:40:59.930Z
That sounds good but could I have it even easier? If I set my bitcoind to listen on a non-standard port, it will not advertise this fact all over the place and keep all inbound connections available for me, wihtout having to config firewall?

With the firewall config it would obviously not know about the second port. Sounds easy, too.
Giszmo
CC BY-SA 3.0
2017-10-25T18:42:26.867Z
If you use a non-standard port, it will still be advertised and you will still get connections to it. You might get fewer connections, but there is no guarantee that using a non-standard port will ensure that you have at least one connection available for your SPV wallet.
Ava Chow
CC BY-SA 3.0
2017-10-25T15:22:35.987Z
2017-10-25T15:22:35.987Z
Ava Chow
<p>Accepted answer's implementation attempt:</p>

<pre><code>iptables -t mangle -A PREROUTING -p tcp --dport 8444 -j MARK --set-mark 0x444
iptables -t nat -A PREROUTING -p tcp --dport 8444 -j REDIRECT --to-ports 8333
iptables -A INPUT -p tcp --dport 8333 -m mark --mark 0x444 -j ACCEPT
iptables -A INPUT -p tcp --dport 8333 -m state --state NEW -m connlimit --connlimit-mask 0 --connlimit-above 100 -j REJECT --reject-with tcp-reset
</code></pre>

<p>This allows maximum of 100 inbound connections per world to the default port 8333, while connections to custom port 8444 are limited by bitcoind's <code>maxconnections</code> and systemd's <code>LimitNOFILE</code>.</p>

CC BY-SA 3.0
2018-03-04T09:22:07.860Z
2018-03-04T09:22:07.860Z
Alerticus
<p>How can I setup a bitcoind such that friends and family will always get a free slot on my trusted node, without having to configure a VPN or something, to back Schildbach's wallet for example.</p>

<p>I experience very poor performance if any at all from my "open" full node and figure the <code>--rpcuser</code> setting is not what I need, right?</p>

<bitcoind>
How can I limit who connects inbound to my bitcoind
Giszmo
# How can I limit who connects inbound to my bitcoind

(Asked by: username_0 on 2017-10-25)

How can I setup a bitcoind such that friends and family will always get a free slot on my trusted node, without having to configure a VPN or something, to back Schildbach's wallet for example.

I experience very poor performance if any at all from my "open" full node and figure the `--rpcuser` setting is not what I need, right?

**Tags:** bitcoind


---

## 2 answers

### Answer by username_1 on 2017-10-25. Score: 2 | Accepted answer

> figure the `--rpcuser` setting is not what I need, right?

That is correct, `-rpcuser` is completely unrelated to what you want to do.

You can start bitcoind with the `-maxconnections=<n>` option where is the maximum number of connections that you want to allow (or add the option to the bitcoin.conf file).

Then you can setup an external firewall to manage your connections. With that firewall, you allow through n-8-1 external connections on port 8333. This means that you are allowing other nodes to connect to you, but still keep one unused connection less than your `maxconnections` setting for your SPV wallet. Then you add another rule to the firewall to allow 1 connection on a different port which just forwards traffic to port 8333. You connect your SPV wallet to that other port.

> **Comments:**
> **username_0**: That sounds good but could I have it even easier? If I set my bitcoind to listen on a non-standard port, it will not advertise this fact all over the place and keep all inbound connections available for me, wihtout having to config firewall?  With the firewall config it would obviously not know about the second port. Sounds easy, too.  
> **username_1**: If you use a non-standard port, it will still be advertised and you will still get connections to it. You might get fewer connections, but there is no guarantee that using a non-standard port will ensure that you have at least one connection available for your SPV wallet.  

---

### Answer by username_2 on 2018-03-04. Score: 0

Accepted answer's implementation attempt:

```
iptables -t mangle -A PREROUTING -p tcp --dport 8444 -j MARK --set-mark 0x444
iptables -t nat -A PREROUTING -p tcp --dport 8444 -j REDIRECT --to-ports 8333
iptables -A INPUT -p tcp --dport 8333 -m mark --mark 0x444 -j ACCEPT
iptables -A INPUT -p tcp --dport 8333 -m state --state NEW -m connlimit --connlimit-mask 0 --connlimit-above 100 -j REJECT --reject-with tcp-reset

```

This allows maximum of 100 inbound connections per world to the default port 8333, while connections to custom port 8444 are limited by bitcoind's `maxconnections` and systemd's `LimitNOFILE`.


---

