0
How can I setup a bitcoind such that friends and family will always get a free slot on my trusted node, without having to configure a VPN or something, to back Schildbach's wallet for example.
I experience very poor performance if any at all from my "open" full node and figure the --rpcuser setting is not what I need, right?
2
figure the
--rpcusersetting is not what I need, right?
That is correct, -rpcuser is completely unrelated to what you want to do.
You can start bitcoind with the -maxconnections=<n> option where is the maximum number of connections that you want to allow (or add the option to the bitcoin.conf file).
Then you can setup an external firewall to manage your connections. With that firewall, you allow through n-8-1 external connections on port 8333. This means that you are allowing other nodes to connect to you, but still keep one unused connection less than your maxconnections setting for your SPV wallet. Then you add another rule to the firewall to allow 1 connection on a different port which just forwards traffic to port 8333. You connect your SPV wallet to that other port.
0
Accepted answer's implementation attempt:
iptables -t mangle -A PREROUTING -p tcp --dport 8444 -j MARK --set-mark 0x444
iptables -t nat -A PREROUTING -p tcp --dport 8444 -j REDIRECT --to-ports 8333
iptables -A INPUT -p tcp --dport 8333 -m mark --mark 0x444 -j ACCEPT
iptables -A INPUT -p tcp --dport 8333 -m state --state NEW -m connlimit --connlimit-mask 0 --connlimit-above 100 -j REJECT --reject-with tcp-reset
This allows maximum of 100 inbound connections per world to the default port 8333, while connections to custom port 8444 are limited by bitcoind's maxconnections and systemd's LimitNOFILE.
That sounds good but could I have it even easier? If I set my bitcoind to listen on a non-standard port, it will not advertise this fact all over the place and keep all inbound connections available for me, wihtout having to config firewall?
With the firewall config it would obviously not know about the second port. Sounds easy, too. – Giszmo – 2017-10-25T18:40:59.930
1If you use a non-standard port, it will still be advertised and you will still get connections to it. You might get fewer connections, but there is no guarantee that using a non-standard port will ensure that you have at least one connection available for your SPV wallet. – Andrew Chow – 2017-10-25T18:42:26.867