What does --confirm-external-bind do in monerod?
--confirm-external-bind tells monerod, the Monero node program, that you intentionally want its RPC interface to listen on a non-local address. It acknowledges a safety warning; it does not add a password, encrypt traffic, or make remote access safe.
What you are confirming
RPC means Remote Procedure Call. It is the interface that lets other software ask your node for blockchain information or tell it to perform supported actions.
By default, the node’s main RPC interface listens on 127.0.0.1, also called localhost. That means software on the same computer can connect, but other computers cannot connect directly.
If you change the listening address with --rpc-bind-ip to a non-loopback address, monerod requires explicit confirmation before accepting that configuration. “Loopback” means an address that points back to your own computer.
For example:
--rpc-bind-ip 192.168.1.50selects that particular local-network address, assuming it belongs to your computer.--rpc-bind-ip 0.0.0.0selects every available IPv4 network interface, potentially including one reachable from the internet.--confirm-external-bindacknowledges that you understand the risk of that broader listening scope.
Here, “external” does not necessarily mean the public internet. An address on your home network counts too.
What the flag does not do
Think of this flag as an “I understand” checkbox, not a security feature.
It does not:
- Change the listening address by itself.
- Open your firewall or set up router port forwarding.
- Require a username and password.
- Turn on encrypted connections.
- Restrict which RPC commands a connecting client can use.
Actual reachability still depends on the address you bind to, your firewall, your router, and any hosting-provider network rules.
An unrestricted RPC interface can expose powerful node operations. That does not automatically give someone your wallet’s private keys—monerod is not your wallet—but it can allow abuse or disruption of your node.
When you need it for mining
If your solo-mining software or P2Pool runs on the same computer as monerod, you generally do not need this flag. Keep the RPC connection on localhost.
If P2Pool or your mining software runs on another computer, you may need your node’s RPC interface to listen on a reachable network address. That is where --confirm-external-bind becomes relevant.
It does not enable solo mining, change mining difficulty, or improve your earnings. It only acknowledges the RPC listening configuration.
Also, it is not permission for ordinary Monero peer connections. Those connections share blocks and transactions through a separate interface. P2Pool’s node setup can also use a separate notification connection called ZMQ; this flag does not configure that connection.
How to use it safely
Before adding the flag, decide exactly which computer needs access.
Prefer a private network or an encrypted private connection, such as a VPN. Use firewall rules to allow only the required computers. RPC authentication can add protection, but it is not a substitute for encryption.
Monero also offers restricted RPC options that disable sensitive methods. However, do not assume restricted RPC supports your mining setup: P2Pool and solo-mining software may need methods unavailable through a restricted interface.
The bottom line
Use --confirm-external-bind only when you deliberately need non-local RPC access. It confirms your choice; securing that access remains your responsibility.
