Add port and firewall configuration section - #102
Merged
Conversation
Operators of validator nodes often misread the RPC-node port instructions as general advice and open the EVM JSON-RPC and CometBFT RPC ports publicly on their validators, which exposes them to denial-of-service attacks and other abuse. Add a Network exposure section with a per-node-type port table stating that validators must expose only the CometBFT P2P port publicly and allow only the central monitoring IPs on the EVM JSON-RPC port. Add a warning to the RPC node section that its port list does not apply to validators, a firewall reminder to the PoA submission section, and a clarification of what allowlisting means to the central monitoring section.
Replace the per-node-type port table and the warnings scattered across the RPC node, PoA submission, and central monitoring sections with one Port and firewall configuration section. It is the single source of truth for which ports mezod uses, how to change the defaults, and what to expose per node type. Sections that previously listed ports inline now reference it instead. Document that an RPC node does not need the P2P port open to inbound traffic: mezod inherits stock CometBFT peering with PEX enabled and seeds baked in, and dials up to 30 outbound peers on its own, so inbound P2P only helps peer discovery.
lukasz-zimnoch
changed the title
List the Cosmos gRPC (9090) and REST API (1317) ports alongside the CometBFT and EVM JSON-RPC ports for completeness. Present the per-node type exposure rules as a port-by-node-type matrix table instead of bullets. Move the Port and firewall configuration section after Non-validator nodes so it follows the sections that describe the node types.
RPC nodes primarily serve EVM JSON-RPC; the CometBFT RPC port only needs to be open if that API is served to clients.
tomaszslabon
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduction
Operators of validator nodes often misread the port instructions in the "RPC node" section of the README as general advice and open the EVM JSON-RPC and CometBFT RPC ports publicly on their validators. That is a security issue: a validator with publicly exposed RPC ports is vulnerable to denial-of-service attacks that can lead to downtime and missed blocks. The README previously had no single place describing which ports each node type should expose; port details were scattered across the seed node, RPC node, and central monitoring sections.
Changes
mezoduses (CometBFT P2P26656and RPC26657, EVM JSON-RPC8545/8546, Cosmos gRPC9090, Cosmos REST API1317) with the config parameters that change the defaults, followed by a port-by-node-type matrix: validators expose only the P2P port publicly and allow the central monitoring IPs on the EVM JSON-RPC HTTP port; RPC nodes expose the EVM JSON-RPC ports to their clients, with CometBFT RPC, gRPC, and REST optional; seed nodes expose only the P2P port.mezodinherits stock CometBFT peering (PEX enabled, seeds baked in, up to 30 outbound peers dialed by the node), so a non-validator node syncs over outbound connections alone; an open inbound P2P port only helps network peer discovery. The CometBFT RPC, Cosmos gRPC, and Cosmos REST API ports are likewise marked optional on RPC nodes, which primarily serve EVM JSON-RPC.Testing
Docs-only change. Verified the rendered Markdown tables and that the in-page anchor links (
#port-and-firewall-configuration,#central-monitoring) match the section headings. Port defaults verified against the mezod codebase (Cosmos SDK v0.50.10 defaults: gRPC9090enabled, REST API1317disabled by default; no mezod overrides).