Secure RPC: offer a public restricted node safely

Keep the full RPC private, publish only the restricted RPC, and add TLS.

8 min read · checked 2026-10-30

Rule one

Never expose the unrestricted RPC (default 18081) to the internet. It allows admin calls such as stopping the daemon, banning peers or starting mining.

Restricted public RPC

# keep the full RPC local
rpc-bind-ip=127.0.0.1
rpc-bind-port=18081
# separate restricted RPC for wallets (read + submit tx only)
rpc-restricted-bind-ip=0.0.0.0
rpc-restricted-bind-port=18089
confirm-external-bind=1
public-node=1                 # advertise the restricted port to peers (optional)
rpc-ssl=autodetect            # TLS with a self-signed certificate

sudo ufw allow 18089/tcp

Private RPC with a login

For a node only you use, keep it restricted and add a login so random scanners cannot use it:

rpc-login=youruser:a-long-random-password

Valid certificates

Wallets accept the self-signed certificate. For browsers and services that require a valid certificate, put a reverse proxy (Caddy or nginx) with a Let's Encrypt certificate on port 443 in front of 127.0.0.1:18089.

Sources

monerod RPC reference