Node RED is a powerfull tool, and one that fits perfectly in the ever increasing connected world. But when doing so, security should be the first priority, sadly a lot of users do not adhere to this. With this in mind, there are various tools / services that can help protect access to Node RED, sp…

[image] marcus-j-davies: A Restart of NR will be needed of course The Nodejs BlockList class seems not to have much methods to change the ip addresses at runtime. Isn't it better to do it in another way, so you can change the list without restarting?

Is whitelisting public IP addresses like this a good idea? One would have to open a port which if a bot spotted would identify your IP as an attack target. Combine that with whitelisting a whole range of public IP addresses which you are not using but someone else is ... There are much better way…

[image] jbudd: Is whitelisting public IP addresses like this a good idea? As opposed to allowing all Public IP's? This is in response to many events on the forum, where those that have opened up ports, are not restricted to who can access those open ports - we have seen the posts. This "Hel…

Don't want to be negative here. This is certainly useful, thanks for sharing. However, there are, I think, some notable caveats that relate to different network configurations. Not at my pc so can't test my assumptions for now. Anyway, this method does no harm and should help in many cases. But c…

[image] marcus-j-davies: As opposed to allowing all Public IP's? No. As opposed to whitelisting any public ips whatsoever. Yes I know some people discover they can open a port and do so without any further thought until they get hacked. Your post gives easily followed instructions for one w…

Was wondering if it might have some benefit to add logging of 401 responses?

[image] E1cid: Was wondering if it might have some benefit to add logging of 401 responses? intriguing idea to identify the Mr Meaners [image] jbudd: It probably isn't much help if you hope to turn off your lights from the pub, does the hotspot give you a cloudflare IP address? Depen…

[image] marcus-j-davies: intriguing idea to identify the Mr Meaners Or some form alert that access attempts are happening from non white list IP's. [image] jbudd: It probably isn't much help if you hope to turn off your lights from the pub I wonder why you would need to give access to…

[image] E1cid: I wonder why you would need to give access to the editor to turn off lights from the pub. Good point. I suppose I use the editor as a dashboard! Happy Christmas all :evergreen_tree: :turkey:

You’ll be on Santa’s naughty list ! Merry Xmas.

Node-RED

Node-RED Forum

How to 'whitelist' IP address's that can access Node RED

FAQs

TotallyInformation 12 January 2024 14:18 29

I have updated the security FAQ with references to Node.js security best practices, the blocklist functions and this thread.

Topic		Replies	Views
Nodered hacked by adding invisible nodes General security	143	3070	6 March 2024
Dashboard suddenly asks for password (Hacked Node-RED servers) General security	128	4460	4 December 2022
Securing Node-Red General security	33	8576	24 December 2023
Safely accessing Node-RED over the Internet FAQs security	21	7203	18 May 2023
How to detect if someone access our Node-red with ip General	1	531	30 December 2019

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

How to 'whitelist' IP address's that can access Node RED

Related topics