> For the complete documentation index, see [llms.txt](https://dozza.gitbook.io/pulsechain_node_guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dozza.gitbook.io/pulsechain_node_guide/part-6-networking-and-security.md).

# Part 6 — Networking and security

## 6.1 Router port forwarding (P2P only)

Forward the peer-to-peer ports to the VM's reserved IP for healthy inbound peering. **Confirm the beacon's real P2P port first** — this build uses Lighthouse defaults:

```bash
sudo ss -tulnp | grep -E 'geth|lighthouse'
```

Forward these to `192.168.1.***` (as separate rules where the router requires one protocol each):

| Port  | Protocol / purpose                  |
| ----- | ----------------------------------- |
| 30303 | TCP + UDP — Geth (execution) P2P    |
| 9000  | TCP + UDP — Lighthouse (beacon) P2P |

{% hint style="danger" %}
**Never forward the RPC ports.** **Only** forward the P2P ports above. **Never** forward 8545, 8546, or 22 to the internet. The RPC and SSH must stay LAN-only. If the machine has a public IP, an exposed RPC (especially with `admin`/`debug` namespaces enabled) is a real risk.
{% endhint %}

## 6.2 Check for CG-NAT first

Port forwarding only works if you have a real public IP. Compare your router's WAN IP to a "what's my IP" lookup. If the WAN IP starts with `10.x` or `100.64–100.127.x` and differs from your public IP, you're behind carrier-grade NAT and must ask your ISP for a public/static IP. The node still syncs fine on outbound peers without forwarding — it's an optimisation, not a requirement.

## 6.3 Firewall (UFW) — verify LAN-only RPC

The installer sets most of this. Confirm and, if needed, add a rule for the WebSocket port:

```bash
sudo ufw status verbose

# If 8546 (WebSocket RPC) is missing, add it LAN-only:
sudo ufw allow from 192.168.1.0/24 to any port 8546 proto tcp comment 'WS RPC LAN only'
```

Target posture: `8545` and `8546` allowed from `192.168.1.0/24` (and localhost) only; `22` from LAN only; `30303` and `9000` from Anywhere.

## 6.4 Harden the Windows host against unexpected reboots

A node needs continuous uptime. On the host:

* **Windows Update (Pro):** `gpedit.msc` → Computer Configuration → Administrative Templates → Windows Components → Windows Update → Manage end user experience → `Configure Automatic Updates` → Enabled → option **2 - Notify for download and auto install**. Apply with `gpupdate /force`.
* **Disable sleep/hibernate** (admin cmd):

```bat
powercfg /change standby-timeout-ac 0
powercfg /change hibernate-timeout-ac 0
powercfg /change monitor-timeout-ac 0
powercfg /change disk-timeout-ac 0
powercfg /hibernate off
```

* **Stop NIC power-down:** Device Manager → Network adapters → your adapter → Properties → Power Management → untick `Allow the computer to turn off this device to save power`.
* **UPS:** a small uninterruptible power supply with USB monitoring guards against power loss corrupting the database — the one thing software can't cover.

{% hint style="warning" %}
**A note on consumer modems.** An always-on node with many peers opens a lot of simultaneous connections. Some ISP combo modems have small NAT/connection-tracking tables that can fill up under this load, stalling your whole internet connection even on a fast line. If that happens: reduce peer counts (see Part 7), disable P2P port forwarding, or put the modem in bridge mode behind a capable router. It's a device limit, not a bandwidth limit.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://dozza.gitbook.io/pulsechain_node_guide/part-6-networking-and-security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.