proxmox/docs/04-configuration/ALI_RPC_PORT_FORWARDING_CONFIG.md

ALI RPC Port Forwarding Configuration

Last Updated: 2026-01-31
Document Version: 1.0
Status: Active Documentation

---

Date: 2026-01-04
Rule Name: ALI RPC
Target Service: VMID 2501 (Permissioned RPC Node)
Status: Configuration Guide

---

📋 Port Forwarding Rule Specification

Rule Configuration

Parameter	Value	Notes
Rule Name	ALI RPC	Descriptive name for the rule
Enabled	✅ Yes	Enable to activate the rule
Source IP	0.0.0.0/0	All source IPs (consider restricting for security)
Interface	WAN1	Primary WAN interface (76.53.10.34)
WAN IP	76.53.10.34	Router's WAN IP (or use specific IP from Block #1 if needed)
DMZ	--	Not used
Source Port	* (Any)	All source ports accepted
Destination IP	192.168.11.251	VMID 2501 (Permissioned RPC Node)
Destination Port	8545	Besu HTTP RPC port
Protocol	TCP	RPC uses TCP protocol

---

🎯 Target Service Details

VMID 2501 - Permissioned RPC Node

• IP Address: 192.168.11.251
• Service: Besu HTTP RPC
• Port: 8545
• Type: Permissioned RPC (requires JWT authentication)
• Current Public Access: Via Cloudflare Tunnel (https://rpc-http-prv.d-bis.org)

---

⚠️ Security Considerations

Current Architecture (Recommended)

The current architecture uses Cloudflare Tunnel for public access, which provides:

• ✅ DDoS Protection: Cloudflare provides DDoS mitigation
• ✅ SSL/TLS Termination: Automatic HTTPS encryption
• ✅ No Direct Exposure: Services are not directly exposed to the internet
• ✅ IP Hiding: Internal IPs are not exposed
• ✅ Access Control: Cloudflare Access can be configured

Public Endpoint: https://rpc-http-prv.d-bis.org

Direct Port Forwarding (This Configuration)

If you configure direct port forwarding, consider:

• ⚠️ Security Risk: Service is directly exposed to the internet
• ⚠️ No DDoS Protection: Router may be overwhelmed by attacks
• ⚠️ No SSL/TLS: HTTP traffic is unencrypted (unless Nginx handles it)
• ⚠️ IP Exposure: Internal IP (192.168.11.251) is exposed
• ⚠️ Authentication: JWT authentication must be configured on Besu

Recommended: Use direct port forwarding only if:

1. Cloudflare Tunnel is not available
2. You need direct IP access for specific use cases
3. You have additional security measures in place (firewall rules, IP allowlisting)

---

🔧 Recommended Configuration

Option 1: Restrict Source IP (More Secure)

If you must use direct port forwarding, restrict source IP addresses:

Parameter	Value	Notes
Source IP	[Specific IPs or CIDR]	Restrict to known client IPs
Example	203.0.113.0/24	Allow only specific network

Option 2: Use Different WAN IP (Isolation)

Use a different IP from Block #1 instead of the router's primary WAN IP:

Parameter	Value	Notes
WAN IP	76.53.10.35	Use secondary IP from Block #1
Purpose	Isolation from router's primary IP

Available IPs in Block #1 (76.53.10.32/28):

• 76.53.10.33 - Gateway (reserved)
• 76.53.10.34 - Router WAN IP (current)
• 76.53.10.35-46 - Available for use

---

📝 Complete Rule Configuration

For ER605 Router GUI

Rule Name: ALI RPC
Enabled: ✅ Yes
Interface: WAN1
External IP: 76.53.10.34 (or 76.53.10.35 for isolation)
External Port: 8545
Internal IP: 192.168.11.251
Internal Port: 8545
Protocol: TCP
Source IP: 0.0.0.0/0 (or restrict to specific IPs for security)

Alternative: Use Secondary WAN IP (Recommended for Isolation)

Rule Name: ALI RPC
Enabled: ✅ Yes
Interface: WAN1
External IP: 76.53.10.35 (secondary IP from Block #1)
External Port: 8545
Internal IP: 192.168.11.251
Internal Port: 8545
Protocol: TCP
Source IP: [Restrict to known IPs if possible]

---

🔍 Verification

Test from External Network

After enabling the rule, test from an external network:

curl -X POST http://76.53.10.34:8545 \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'

Expected Response (if JWT auth is not configured):

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": "0x8a"
}

If JWT Authentication is Required: You'll need to include the JWT token in the request. See RPC_JWT_AUTHENTICATION.md for details.

Test from Internal Network

curl -X POST http://192.168.11.251:8545 \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'

---

🔐 Security Recommendations

1. Enable IP Allowlisting (If Possible)

Restrict source IP addresses to known clients:

• Configure source IP restrictions in the router rule
• Or use firewall rules to restrict access
• Consider using Cloudflare Access for IP-based access control

2. Use HTTPS/TLS

If exposing directly, ensure HTTPS is used:

• VMID 2501 should have Nginx with SSL certificates
• Forward to port 443 instead of 8545
• Or use a reverse proxy with SSL termination

3. Monitor and Log

• Enable firewall logging for the port forward rule
• Monitor connection attempts
• Set up alerts for suspicious activity

4. Consider Cloudflare Tunnel (Preferred)

Instead of direct port forwarding, use Cloudflare Tunnel:

• Current endpoint: https://rpc-http-prv.d-bis.org
• Provides DDoS protection, SSL, and access control
• No router configuration needed

---

📊 Comparison: Direct Port Forward vs Cloudflare Tunnel

Feature	Direct Port Forward	Cloudflare Tunnel
DDoS Protection	❌ No	✅ Yes
SSL/TLS	⚠️ Manual (Nginx)	✅ Automatic
IP Hiding	❌ Internal IP exposed	✅ IP hidden
Access Control	⚠️ Router/firewall rules	✅ Cloudflare Access
Configuration	Router port forward rule	Cloudflare Tunnel config
Monitoring	Router logs only	Cloudflare analytics
Cost	Free (router feature)	Free tier available

---

🎯 Current Architecture Recommendation

Recommended Approach: Continue using Cloudflare Tunnel

• ✅ Already configured and working: https://rpc-http-prv.d-bis.org
• ✅ Provides better security and DDoS protection
• ✅ No router configuration needed
• ✅ SSL/TLS handled automatically

Direct Port Forwarding Use Cases:

• Emergency access if Cloudflare Tunnel is down
• Specific applications that require direct IP access
• Testing and development
• Backup access method

---

📋 Summary

Rule Configuration

• Name: ALI RPC
• Destination: 192.168.11.251:8545 (VMID 2501)
• External Port: 8545
• Protocol: TCP
• Security: ⚠️ Consider restricting source IPs and using secondary WAN IP

Recommendation

• ✅ Current: Use Cloudflare Tunnel (https://rpc-http-prv.d-bis.org)
• ⚠️ Direct Port Forward: Use only if necessary, with security restrictions
• 🔐 Security: Enable IP allowlisting, use secondary WAN IP, monitor access

---

Last Updated: 2026-01-04
Status: Configuration Guide
Current Access Method: Cloudflare Tunnel (Recommended)