What is --restricted-rpc in monerod?

--restricted-rpc tells monerod, the Monero node software, to offer a limited set of commands through its RPC interface. It is useful when you want other people’s wallets to use your node without giving them access to sensitive or administrative functions—but it does not make an internet-facing node completely safe.

What “restricted RPC” means

RPC stands for remote procedure call. Think of it as a service desk where a wallet or another program asks your node to do something.

A wallet might ask your node to:

• Provide blockchain data so it can find incoming payments.
• Report whether the node is up to date.
• Send a signed transaction to the Monero network.

An unrestricted interface also exposes more powerful functions, including node administration. With --restricted-rpc, monerod blocks certain commands and limits or filters some responses.

The important distinction is that restricted means fewer permissions, not private access. Anyone who can reach that interface may still use its allowed functions unless you add separate access controls.

How you enable it

For a basic local setup, you can start your node with:

monerod --restricted-rpc

You can also put this in your monerod configuration file:

restricted-rpc=1

This flag changes what the RPC server permits. It does not, by itself, make the server reachable from the internet.

Network reachability depends on its bind address, which is the network address the server listens on, and on your firewall and router settings. Monero’s usual main-network RPC port is 18081. A port is simply a numbered connection point for a service.

If you only need your own wallet on the same computer, keep RPC listening on 127.0.0.1, also called localhost. That address accepts connections from your own computer rather than from other devices.

What it does not protect you from

Restricted RPC is a useful safeguard, but it is not a complete security setup.

It does not automatically:

• Require a username and password.
• Encrypt the connection.
• Prevent heavy requests from using your bandwidth or computer resources.
• Hide every detail about your node.

Authentication controls who can connect. Encryption protects information while it travels. Firewall rules limit which computers can reach the service. Those are separate from restricting commands.

Also, this flag controls your node’s RPC service, not its normal connections to other Monero nodes. You do not need to expose RPC publicly just to help relay blocks and transactions.

Using it with solo mining or P2Pool

For mining, the distinction matters because mining software needs more than ordinary wallet access.

P2Pool, the decentralized mining pool software, needs mining-related information from monerod. A restricted endpoint is not a replacement for the unrestricted RPC connection used in a standard P2Pool setup.

A sensible arrangement is to:

• Keep unrestricted RPC private for your own mining software.
• Offer a separate restricted RPC port only if you want to serve other wallets.
• Keep any other required mining connections private too.

monerod supports a separate restricted listener through --rpc-restricted-bind-port. This lets you provide limited public access without exposing your private administrative interface.

The bottom line

Use --restricted-rpc to reduce what RPC clients can ask your node to do. Keep unrestricted mining access local or tightly controlled, and remember that restricting commands does not replace a firewall, authentication, or connection encryption.