Nano node RPC bind address and control interface exposure

Answer to the core questions

• Default RPC listen address for a package‑installed Nano node: 127.0.0.1 (IPv4 localhost) with port 7076. This is the address that most package managers set in config-node.toml for the [rpc] section. The exact value can differ if the packager altered the defaults, so check the file on your system.
• Does enable_control = true open the RPC port without authentication? No. The flag merely enables the control RPC API on whatever address/port is already configured. Nano’s RPC has no built‑in authentication, so the network binding remains the only access boundary.
• Configuration keys that enforce a localhost‑only binding before startup:
  • [rpc] address = "127.0.0.1" (IPv4) or "::1" (IPv6).
  • Keep enable_control = false unless you explicitly need control commands.
  • Do not leave address blank or set to 0.0.0.0 or ::.

Why this matters

Nano’s RPC has historically lacked authentication. The only practical way to prevent accidental public exposure is to bind the socket to a loopback interface. If the node runs inside a container or is exposed via a host‑level port forward, the config-node.toml setting alone does not stop the port from being reachable—container networking or host port publishing can override it.

Steps to verify and enforce the binding

1. Check the current configuration:

   cat /etc/nano/config-node.toml | grep -A2 "\[rpc\]"
   

2. Confirm the listening socket after startup:

   ss -ltnp | grep 7076
   # Expected output: "LISTEN  0  128  127.0.0.1:7076  *:*  users:("nano",pid=1234,fd=5)"
   

3. Test remote reachability from another host on the same network:

   telnet  7076
   # Should fail or time out.
   

4. Test local reachability from the node itself:

   curl -sS http://127.0.0.1:7076/version
   # Should return JSON with the node's version.
   

5. Adjust the config if needed:

   sudo nano /etc/nano/config-node.toml
   # Set: address = "127.0.0.1"
   # Ensure enable_control = false unless required.
   

6. Restart the node:

   sudo systemctl restart nano
   

7. Re‑run the socket check to confirm the change took effect.

What to ask next

If your node was built from source or runs in a container, the defaults can differ. Knowing the exact Nano version and install method (package, source build, Docker image) would let us confirm the bundled config-node.toml values and any container‑specific networking settings. Let us know those details if the above assumptions don’t match your environment.