Any tips on hardening Umbrel’s PI security? Can I use UFW and if so what ports does Umbrel need open? Fail2ban? My umbrel is behind a router in a LAN with no ports open on the router to it; nevertheless I am in the habit of hardening pi’s whenever I use them.

None of those are necessary for Umbrel. All traffic is behind Tor, so no ports need to be open in your router/machine. Tor is using onion addresses for each Umbrel app (like being a port) without need of any port. Only in special cases if you really want to use reverse proxy Tor-to-clearnet, will be necessary more changes, but those are mostly for BTCpay, LNbits and are guides dedicated to that. But for normal use as a BTC/LN node is enough and you can connect all your mobile apps using Tor onion address.

Thanks for reply and it is understood that using onion addresses requires no open ports on router, but what about on node/pi. While UFW may not be necessary for Umbrel while using the onion addresses, if I have some other apps running where UFW would be helpful for security, I just wanted to make sure that by using UFW, I wouldn’t accidently prevent umbrel from working. So, the question is: would blocking ports via UFW on my umbrel node (not on the router) in any way hinder umbrel from working?

the simple answer is NO. You can play with UFW as much as you like and if you know what are you doing. Just in case, to not use some of the other apps ports from Umbrel, open your Umbrel from local IP and open the apps, one by one. You will see for each which port they are using. So note those ports NOT to be used for other of your apps you install on that machine and NOT to be open in UFW (only if you really want it). Actually you just gave me an idea to add to my Umbrel guides a list of all ports used.

Thanks. A list of all ports used by Umbrel would be perfect for helping us avoid any conflicts with other apps.

Yes, I am planning to extend this getting started guide for Umbrel to a larger manual. I will add there the ports for apps.

@DarthCoin One more request if possible for your “getting started guide”. I am wondering about the best ways to share my umbrel node with family and friends. I am aware of Spectre Desktop which allows me to create other user accounts for cold/hardware wallets. But my question is regarding on chain hot wallets (not the Lightning wallets). Can I allow friends to use the Wallet connect info for a specific wallet to use my node for checking for on chain transactions? Is it a security risk or could it cause confusion for my transaction records? I am assuming hot wallets are just connecting to the umbrel node to watch for transactions and confirmations, but are not saving info on the umbrel node. Is this correct for all those wallets available in the connect wallet area?

Here you have another 2 guides that you can use: [image] Umbrel + BlueWallet + LNDHub Guides Description This is a major step forward for all node operators. Why? Because is one more step for a node in becoming a “Bitcoin Sovereign Bank”, being a HUB for your family, friends and all those who do not/can’t have a node for themselves. Practically you can “rent” them space and liquidity from your node. More details about LNDhub here and also here is the announcement from Bluewallet team. There’s a very important aspect in Bitcoin world and few understand it: custodial wallets (your fun… and [image] Umbrel LNBits app - Description and basic use Guides LNURL + LN node + LNDHUB + NFC + merchant support = anyone with sats and a LN channel being able to self issue their own “debit card” against their own “checking account.” Description LNBits it’s an amazing app that is adding a suite of features to Umbrel node and users can adapt to their needs. This app is using the node liquidity (onchain and LN) and is adding a separate database for management. You can use it for multiple wallets, as a LNDhub or specific usage for merchants, content creato…

It is easy to check with nmap which ports are open by default. nmap umbrel.local Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-17 20:19 CEST Nmap scan report for umbrel.local (192.168.21.3) Host is up (0.0020s latency). Other addresses for umbrel.local (not scanned): ::f14f:5bae:c04f:3d2b Not shown: 991 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 3000/tcp open ppp 3006/tcp open deslogind 8000/tcp open http-alt 8080/tcp open http-proxy 8333/tcp open bitcoin 10009/tcp open swdtp-sv 50001/tcp open unknown

This is exactly the reason for using ufw (or any other firewall) on umbrel! The node may be behind a NAT, but there are multiple insecure devices inside the local network which could pose a threat to the system security. So many IoT devices are in everybody’s home network running on obsolete software. Those devices could very easily be used for brute-force attacking umbrel if it is not firewalled properly. In my opinion the best way is to close all ports to all IP addresses except the one is used for administration. Also, the dhcp / router device must reserve IP addresses by MAC address.

UFW with Umbrel?

General Discussion

DarthCoin September 21, 2021, 10:40pm 8

Here you have another 2 guides that you can use:

and

Topic		Replies	Views
Firewalling Umbrel Support and Troubleshooting	30	3765	April 5, 2023
How to use Umbrel from everywhere? General Discussion	2	2264	July 2, 2022
VPN and Umbrel on a Raspberry General Discussion	14	5371	November 23, 2023
How "insecure" is Umbrel, really? General Discussion	14	7384	August 12, 2021
Not able to connect Electrum desktop wallet to Umbrel over tor Support and Troubleshooting	11	2518	October 13, 2022

UFW with Umbrel?

Related topics