[Request] Add sentry node configuration

[asmodat]

Enable sentry node configuration of polkadot service in order not to expose validator node directly to the hostile environment.

That is provide a way to mitigate DDOS, and disallow external connections to be made directly to validator node.

[lsaether]

As I understand sentry nodes, they are nodes which are connected to the gossip network and provide a layer of separation to the validator. That way in case of DDOS attacks, it would only take down the sentries and hopefully a validator is running a few of them to be resilient.

Would it be possible to mimic this function by passing flags to the cli? Something like this:

$ polkadot  --no-mdns --validator  --out-peers 1 --in-peers 0 --bootnodes <URL_of_your_sentry>

[xlc]

there is reserved-nodes flag that can be used for this purpose.

[dbpatty]

so is it now possible in Alexander to configure a sentry?

[lsaether]

It should be possible if you're willing to do some tinkering :)

Otherwise, there is currently a bounty being worked on w3f/General-Grants-Program#122 that will deliver a configuration and guide for setting up sentry nodes.

[gavofyork]

@mxinden is working on this.

[mxinden]

Current status: Sentry node setup can be simulated via substrate/blob/master/scripts/sentry-node/docker-compose.yml with blocks being produced and finalized.

Next up: A way to authenticate a sentry node as a valid sentry node for a given validator. This enables validators to keep long living connections to other validators even when only accessible through sentry nodes.

[dbpatty]

Ty I'll study it

[gilescope]

closing as sentry nodes are not needed any more.