Node RED is a powerfull tool, and one that fits perfectly in the ever increasing connected world.
But when doing so, security should be the first priority, sadly a lot of users do not adhere to this.
With this in mind, there are various tools / services that can help protect access to Node RED, specifically it's editor.
- Cloudflare
- ZeroTier
- VPN
- Countless others
Node RED it's self has an authentication mechanism, and this should be used at the minimum.
However, not all services are easy to configure, and we need to expect that Network Security Solutions is not something understood by all users.
So here is another method, that adds a surprisingly effective barrier to Node RED.
This method only allows IP Address's that you specify to access Node RED.
there are drawbacks you need to be aware of
-
You need to know the IP Address (or range) that you access Node RED from
(your office internet IP Address for example)
the same applies to accessing Node RED from your mobile. -
This will require Node JS v15+
So with that out of the way,
-
Open up
settings.js
This is usually~/.node-red/settings.js -
Above the line that reads
module.exports = {
Add the below
const allowedIPs = [];
const { BlockList } = require("net");
const WL = new BlockList();
allowedIPs.forEach((v, i, a) => {
if (v.includes("/")) {
const Parts = v.split("/");
WL.addSubnet(Parts[0].trim(), parseInt(Parts[1].trim()));
} else if (v.includes("-")) {
const Parts = v.split("-");
WL.addRange(Parts[0].trim(), Parts[1].trim());
} else {
WL.addAddress(v.trim());
}
});
allowedIPs should be an array of IP address's or ranges or subnets
- "172.16.0.0/24" (i.e your subnet)
- "172.16.0.0-172.16.0.20" (i.e a network range)
- "216.58.201.99" (i.e your office public IP address)
Example:
const allowedIPs = [
"127.0.0.1", /* Localhost */
"172.16.0.0/24", /* Private Network */
"103.22.200.1-103.22.203.254" /* CloudFlare range example */,
];
- Find the line that reads
httpAdminMiddleware, and uncomment it, and use the following.
httpAdminMiddleware: function (req, res, next) {
if (WL.check(req.ip)) {
next();
} else {
res.status(401).end();
}
},
- Restart Node RED
The Node RED Admin API/Editor will no longer respond to any IP address or range that you did not add to the allowedIPs array.
Final Note(s):
This WILL NOT stop hacking attempts of your device, but it is one that has an instant effect on what or who can access the Node RED editor and Admin API.
This does not open up access to Node RED from external Networks, it limits what Networks can access Node RED if you choose to open it up to the internet i.e a port forward
