<p>There are two ways by which <code>bitcoind</code> connects to peers.</p>
<p>The default is purely outbound connections - the node will use DNS seeds, as well as its own database of previously seen peers, and attempt to establish connections to them as needed (upon startup, or when existing connections are closed).</p>
<p><code>Allow incoming connections</code> allows you to return this favour - it lets other peers initiate the connection to your node, instead of all your connections only being with peers where your node initiates it (of course, on the other side of those connections, is a node with <code>Allow incoming connections</code> enabled).</p>
<p>These peer connections are used for syncing network state, such as blocks, transactions, and information on other peers.</p>
<p>Barring a catastrophic flaw in <code>bitcoind</code>'s implementation, this is not a security risk.</p>
<p>Depending on your network setup, you may need to enable port forwarding in your router and/or local machine's firewall before enabling this option has any effect.</p>

CC BY-SA 4.0
2020-08-15T14:13:36.567Z
2020-08-15T15:05:10.970Z
2020-08-15T15:05:10.970Z
Raghav Sood
<p>A network is formed by computers connecting to other computers. If nobody had that option turned on there would be no network, and no bitcoin. It's possible for some fraction of the nodes to participate while making only outbound connections, without accepting connections from anyone else, but only because there are enough <em>other</em> nodes out there to accept their connections and handle their traffic.</p>

CC BY-SA 4.0
2020-08-16T05:04:29.543Z
2020-08-16T05:04:29.543Z
hobbs
<p>Software authors seem to enjoy consciously freaking me out by having vaguely or entirely uncommented options in their software with very ominous labels.</p>
<p>In Bitcoin Core's settings, it says &quot;[X] Allow incoming connections&quot;, which has an entirely meaningless &quot;elaborate description&quot; on hover which just repeats what it already said with a couple more words: &quot;Accept connections from outside.&quot;</p>
<p>What does this actually do? My first thought is that this enabled-by-default option somehow allows people from all over the world to connect to my computer and freely grab Bitcoins from my wallet.dat and look through and download files from my computer. Naturally, it doesn't mean that, but the way it's so vaguely described does <em>not</em> make me feel good, to put it that way.</p>
<p>My serious guess is that it has some kind of hard to understand technical explanation, but why is it an option to begin with if it's crucial for Bitcoin to function? Is there some privacy/security benefit to me unchecking it? Does leaving it on pose some sort of privacy/security threat*? Why is it an option?</p>
<p>(* Usually when you ask that kind of question, people will lie to you and claim that there is no security/privacy issue, when in fact there actually is. For example, PHP developers told me that there's nothing lost by keeping the <code>expose_php</code> and other configuration options on, but to me, there definitely is as it sneakily lets the world know that you use PHP and even which version. It seems that, whenever something is bad for users, but good for the authors of something, they claim that it doesn't pose a security/privacy threat.)</p>
<p>Would appreciate some clarification.</p>
<p><a href="https://i.sstatic.net/eE1LY.png" rel="noreferrer"><img src="https://i.sstatic.net/eE1LY.png" alt="enter image description here" /></a></p>

<bitcoin-core><connection><peer-discovery>
What exactly does the scary option "Allow incoming connections" do in Bitcoin Core?
Dujon W.
# What exactly does the scary option "Allow incoming connections" do in Bitcoin Core?

(Asked by: username_0 on 2020-08-15)

Software authors seem to enjoy consciously freaking me out by having vaguely or entirely uncommented options in their software with very ominous labels.

In Bitcoin Core's settings, it says "[X] Allow incoming connections", which has an entirely meaningless "elaborate description" on hover which just repeats what it already said with a couple more words: "Accept connections from outside."

What does this actually do? My first thought is that this enabled-by-default option somehow allows people from all over the world to connect to my computer and freely grab Bitcoins from my wallet.dat and look through and download files from my computer. Naturally, it doesn't mean that, but the way it's so vaguely described does *not* make me feel good, to put it that way.

My serious guess is that it has some kind of hard to understand technical explanation, but why is it an option to begin with if it's crucial for Bitcoin to function? Is there some privacy/security benefit to me unchecking it? Does leaving it on pose some sort of privacy/security threat\*? Why is it an option?

(\* Usually when you ask that kind of question, people will lie to you and claim that there is no security/privacy issue, when in fact there actually is. For example, PHP developers told me that there's nothing lost by keeping the `expose_php` and other configuration options on, but to me, there definitely is as it sneakily lets the world know that you use PHP and even which version. It seems that, whenever something is bad for users, but good for the authors of something, they claim that it doesn't pose a security/privacy threat.)

Would appreciate some clarification.

[![enter image description here](https://i.sstatic.net/eE1LY.png)](https://i.sstatic.net/eE1LY.png)

**Tags:** bitcoin-core, connection, peer-discovery


---

## 2 answers

### Answer by username_1 on 2020-08-15. Score: 11

There are two ways by which `bitcoind` connects to peers.

The default is purely outbound connections - the node will use DNS seeds, as well as its own database of previously seen peers, and attempt to establish connections to them as needed (upon startup, or when existing connections are closed).

`Allow incoming connections` allows you to return this favour - it lets other peers initiate the connection to your node, instead of all your connections only being with peers where your node initiates it (of course, on the other side of those connections, is a node with `Allow incoming connections` enabled).

These peer connections are used for syncing network state, such as blocks, transactions, and information on other peers.

Barring a catastrophic flaw in `bitcoind`'s implementation, this is not a security risk.

Depending on your network setup, you may need to enable port forwarding in your router and/or local machine's firewall before enabling this option has any effect.


---

### Answer by username_2 on 2020-08-16. Score: 2

A network is formed by computers connecting to other computers. If nobody had that option turned on there would be no network, and no bitcoin. It's possible for some fraction of the nodes to participate while making only outbound connections, without accepting connections from anyone else, but only because there are enough *other* nodes out there to accept their connections and handle their traffic.


---

