Exit Node Setup Guide

A comprehensive guide to setting up your exit node

System Requirements

Below are the system requirements and the minimum specifications of dedicated server or VPS

S. No.

Spec

Note

CPU Cores

2 or more

RAM

4 GB

Storage

40 GB SSD

Higher Bandwidth

At least 1 GB preferable

Step 1: Install BelNet on your VPS

Copy and paste the following link into the terminal

This will download the Belnet binaries from cloud

wget https://deb.beldex.io/Beldex-projects/Belnet/deps/v0.9.7/linux/belnet-linux-x86_64-v0.9.7.zip

Unzip the file using the following command

unzip belnet-linux-x86_64-v0.9.7.zip

Execution

install vim editor using the following command

sudo apt install vim

Install tmux in your system

sudo apt install tmux

Create a tmux session

tmux new -s belnet

Run the Belnet binary

sudo ./belnet

Download the bootstrap file using belnet-bootstrap

sudo ./belnet-bootstrap

Step 2: Configure Belnet.ini using vim

Go to Belnet config directory

cd /var/lib/belnet/

Edit the belnet.ini file by entering the following command

vim belnet.ini

Add the following lines under the [router] section or uncomment the following by removing the #.

This will configure the number of connections that an exit node can maintain.

netid = belnet
worker-threads=0 (It uses all threads)
min-connections=18
max-connections=20

Add the following lines under the [network] section or uncomment the following by removing the #.

keyfile=/var/lib/belnet/exit.private
ifaddr=10.0.0.1/16
ifname=exit0
hops=2
paths=8
exit=true

Step 3 Enable IP Forwarding via ''sysctl''

Open the following folder

sudo vim /etc/sysctl.conf

Add the following lines. This will allow IP forwarding for both IPV4 and IPV6

net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1

Press ESC + :wq to save and exit to /etc/sysctl.conf

Enable the changes using the following command

sysctl -p

Step 4: Setup firewall

Please check firewall status using the following command

iptables -S

Default result should return the following

-P INPUT ACCEPT

-P FORWARD ACCEPT

-P OUTPUT ACCEPT

Add firewall rules for IPv4

Copy and paste the following commands

iptables -t nat -A POSTROUTING -s 10.0.0.0/16 -o eth0 -j MASQUERADE

iptables-save

ip6tables -t nat -A POSTROUTING -s fd00::a00:0/112 -o eth0 -j MASQUERADE

ip6tables-save

Add route for Belnet interface's IPv6

ip -6 route add fd00::a00:0/112 dev exit0

It is beneficial to block ports for Simple Mail Transfer Protocol (SMTP), SMTP over Secure Sockets Layer (SSL), SMTP over Transport Layer Security (TLS), Internet Relay Chat (IRC) and IRC over SSL. This is non-mandatory but may protect your exit node from Distributed Denial Of Service (DDOS) attacks. For more details, kindly check with your VPS host.

for port in 25 465 587 666{0,1,2,3,4,5,6,7} 6697 ; 
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport $port -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport $port -j REJECT --reject-with tcp-reset

Now it is completed

Then, enter the following commands,

iptables-save

ip6tables-save

The above commands unroll to:

iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 25 -j REJECT --reject-with tcp-reset
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 465 -j REJECT --reject-with tcp-reset
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 587 -j REJECT --reject-with tcp-reset
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 6660 -j REJECT --reject-with tcp-reset
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 6661 -j REJECT --reject-with tcp-reset
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 6662 -j REJECT --reject-with tcp-reset
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 6663 -j REJECT --reject-with tcp-reset
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 6664 -j REJECT --reject-with tcp-reset
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 6665 -j REJECT --reject-with tcp-reset
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 6666 -j REJECT --reject-with tcp-reset
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 6667 -j REJECT --reject-with tcp-reset
iptables -A FORWARD -s 10.0.0.0/16 -p tcp -m tcp --dport 6697 -j REJECT --reject-with tcp-reset

iptables-save

ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 25 -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 465 -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 587 -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 6660 -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 6661 -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 6662 -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 6663 -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 6664 -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 6665 -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 6666 -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 6667 -j REJECT --reject-with tcp-reset
ip6tables -A FORWARD -s fd00::a00:0/112 -p tcp -m tcp --dport 6697 -j REJECT --reject-with tcp-reset

ip6tables-save