#Applying iptables

iptables is a utility that allows system admins to configure IP packet filtering rules for Linux’s kernel firewall. These rules are organized in separate tables and determine how to treat network packets. Limiting connections to your node is highly recommended and shouldn’t be overlooked unless required by your system’s architecture and/or you’re aware of the security implications.

The most important rule caps how many P2P connections a single IP address can keep open at the same time, so one peer can’t exhaust your node’s connections. There are two ways to apply it. Use the first one if you followed the Port Knocking guide or used secure.sh, as both rely on ufw.

#Option 1: Using ufw

ufw is a front end for iptables (nftables on recent Ubuntu releases), so instead of running separate iptables rules we add the limit to ufw itself. Rules in /etc/ufw/before.rules are applied before the regular ufw allow rules.

1sudo nano /etc/ufw/before.rules

Add the following lines just before the final COMMIT line, replacing 4001 with your network’s P2P port (4001 mainnet, 4002 devnet, 4000 testnet):

file: /etc/ufw/before.rules

1# BEGIN ark-p2p-connlimit
2-A ufw-before-input -p tcp --syn --dport 4001 -m connlimit --connlimit-above 10 --connlimit-mask 32 -j REJECT --reject-with tcp-reset
3# END ark-p2p-connlimit
4 
5COMMIT

Do the same for IPv6 in /etc/ufw/before6.rules, using the ufw6-before-input chain and a /64 mask, since a single IPv6 user usually has a whole /64 range:

file: /etc/ufw/before6.rules

1# BEGIN ark-p2p-connlimit
2-A ufw6-before-input -p tcp --syn --dport 4001 -m connlimit --connlimit-above 10 --connlimit-mask 64 -j REJECT --reject-with tcp-reset
3# END ark-p2p-connlimit
4 
5COMMIT

Apply the rules:

1sudo ufw reload

Because these rules are part of the ufw configuration, they persist after a reboot without any extra steps.

#Option 2: The iptables Script

If you don’t use ufw, the iptables script offers the same protection for Core v3 nodes using plain iptables.

Specifically:

• Parallel/simultaneous P2P connections are restricted to a total of 10 per IP address; this number can be adjusted using the P2P_GLOBAL_CONN script variable.
• Global connections are limited to 4 NEW connections per 30-second interval.

#Script Usage

#Running the Script

Download and execute the iptables script using the following commands:

1curl -fsSLO https://raw.githubusercontent.com/ArkEcosystem/core/master/scripts/v3-iptables.sh
2bash ./v3-iptables.sh start

#Starting the Script on Boot

The filtering applied by the iptables script does not persist after a system reboot. Since the script needs root privileges, add it to root’s crontab, so it runs on boot without changing any sudo permissions:

1. edit root’s crontab file (choose the ‘nano’ editor when prompted):

   1sudo crontab -e

2. add the following line to the end of the crontab file, replacing ark with your username:

   1@reboot bash /home/ark/v3-iptables.sh start

3. save the changes and exit:

   1ctrl + x
   2 
   3# press 'y' then 'enter' to confirm