Good practice how to choose ports

Question

I've setup a full node and while doing so was wondering about the following:

1. Would it be safer not to use the same prominent ports as everybody else does (e.g. 14600, 14700, 14265). If instead the last two digits would be randomly changed, wouldn't that make attacks targeting the network more difficult or would that make things over-complicated and not worth the pain?

2. I see everyone is using UDP. Wouldn't it be safer to use TCP. As far as I understand UDP is nice for streaming (movies, etc.) but for security relevant data TCP is a better choice. It adds little overhead but probably causes less corrupted, broken and lost packages.

3. When it comes to adding neighbors is it 'the more the better' or is there a maximum number of neighboring nodes e.g. to maintain efficiency?

Finally, a suggestive thought which worries me a little: Many full nodes are popping up these days which is great! People follow the instructions e.g. available on github. However, there is no word lost there about basic security concerns related to running server e.g. how to setup iptables or fail2ban. I think this should be much more debated and communicated in the community.

EDIT: As for point 3 I just found the answer here where it reads that "[...]more than 9 neighbours is highly advised against, as it is harming the network".

Answer 1

1. Using a non-standard port would make it more difficult for a potential attacker to find full iota nodes. But it would take more than just finding those nodes in order to wage an attack on them. Nodes have to add each other in both directions before they will accept transactions from one another. Full nodes do not expose their API port by default, so full nodes are only really exposed to attacks from their neighbour, regardless of their UDP port being accessible by the world.

2. I don't think UDP is a security risk. Due to the nature of the tangle protocol, one needs to do more than send malformed packets to harm security.

Having many tangle nodes running on insecure network devices could end up being the largest threat to the network. If a botnet were to infiltrate a large number of full nodes, they could then wage an attack on their neighbours. That said, software like "Nelson" could mitigate the effectiveness of such an attack by downgrading the reputation of nodes used in such an attack. It certainly wouldn't hurt to educate potential node operators more on how to keep the devices they use to run full nodes secure. By default the API port only listens on the local network interface, so a default installation on a vanilla OS without any other services running is not very exposed, but if many people are using the same vanilla OS that leaves certain public services running by default, a common vulnerability could lead to a large infiltration into many neighbours on the tangle.

Answer 2

1. There is a really good introduction on iota.partners

   I would use the standard ports. This makes it way easier for neighbors.

   UDP_RECEIVER_PORT = 14600
   TCP_RECEIVER_PORT = 15600
   

   But yes, security is a important topic. Since you have to add the neighbors by hand, you can also add a firewall in front of these ports. So that only these neighbors can talk through this firewall.

2. I personally had bad experience with UDP. TCP is way more stable. I had many connection breaks, no connections at all etc. I highly recommend TCP!

3. More is theoretical better, yes. But you have to take care about the CPU and RAM of your node. Each new neighbor will take more pressure on your node. So, select a number which your node can handle. At least 5 - 7. More nodes are more secure. There is currently the coordinator to take care about the security in the network. And choose also neighbors from different countries and continents. Just to get all transactions faster. This also prevent double spending attacks in the future. (Nelson is really interesting in the future. It's currently in a publich preview phase. So, just try it)