Is it safe to expose my Monero node's RPC port to the internet?

Exposing your Monero node’s full RPC port to the internet is not a safe default. If only you or your mining software need access, keep it private; if you want to offer a public node, use Monero’s restricted RPC mode and add network protections.

What you are exposing

RPC means “remote procedure call.” It lets software ask your node for blockchain information, submit transactions, and, depending on the settings, perform administrative actions.

Your node’s RPC connection is different from its peer-to-peer connection, which exchanges blocks and transactions with other Monero nodes. Allowing peer-to-peer traffic does not mean you also need to expose RPC.

On Monero’s main network:

• 18080 is the usual peer-to-peer port.
• 18081 is the default node RPC port.
• 18089 is often chosen for a separate restricted RPC service, but you must configure it yourself.

A port number does not provide protection. An unrestricted service on port 18089 is still unrestricted.

Why unrestricted access is risky

The full RPC interface includes functions that strangers should not control. Depending on your node’s version and configuration, unrestricted access can expose administrative information or allow commands that interfere with your node’s operation.

Even restricted access has risks:

• Resource abuse: Repeated requests can consume your internet bandwidth, processor time, and memory.
• Service disruption: Heavy traffic can make your node less reliable for your own wallet or mining.
• Privacy exposure: A public service makes your server easier to identify and may reveal information about its operation. Your hosting or home IP address is also visible.

Exposing a node does not automatically expose your wallet’s seed phrase—the secret words used to restore your funds. The node normally does not hold your wallet’s spending keys. However, that does not make an exposed node harmless.

Also, do not confuse node RPC with wallet RPC. Wallet RPC controls wallet functions and needs much tighter protection. Do not publish it as a public-node service.

The safer setup for your own mining

If your node and mining software run on the same computer, keep RPC bound to localhost, an address that only that computer can reach.

For P2Pool, which coordinates mining without a central pool operator, your local P2Pool software needs access to your node. That does not require making your node’s RPC service public. P2Pool may also need a configured ZMQ connection, a message channel for node updates; keep that private too.

If you connect from another device:

• Prefer a private VPN, an encrypted connection between your devices.
• Use a firewall to allow only the devices or addresses you trust.
• Avoid router port forwarding for RPC unless you deliberately need outside access.

If you deliberately run a public node

Use the daemon’s documented restricted RPC options, such as --restricted-rpc or a separately configured --rpc-restricted-bind-port. Check the documentation for your installed version and verify which interface is actually reachable from outside.

Keep any unrestricted endpoint private. Update your node software, apply connection and request limits where practical, and monitor resource use. If you require a password, protect the connection with encryption too; authentication alone does not encrypt traffic.

Restricted RPC reduces what visitors can do. It does not prevent every attack or guarantee availability.

The bottom line

For your own wallet, solo mining, or P2Pool setup, keep node RPC private. Expose only a deliberately configured restricted service if you genuinely want to serve other users—and treat it as an internet-facing service that needs ongoing care.