Smaller default value for `peer-connection.max-no-channels` (#3180)
What the developer wrote
Authored by Bastien Teinturier
Smaller default value for `peer-connection.max-no-channels` (#3180)
We previously allowed 250 parallel incoming connections from nodes with
whom we don't have any channels yet. While this makes sense for wallet
providers, this is too large for standard routing nodes and exposes them
to more DoS risk. We reduce the default value to 64 instead, which can
of course be overridden by node operators in their `eclair.conf`.
What changed, and why it matters
This commit lowers a default setting that controls how many incoming connections Eclair will accept from strangers who have no payment channel with the node. The old default of 250 could let someone open a large number of connections to a routing node and waste its resources, a form of denial-of-service. The new default of 64 reduces that exposure while still allowing node operators to change the value if they need more for wallet-style services.
Adopt the new default or review your own `eclair.conf` to ensure `peer-connection.max-no-channels` is set appropriately for your node's role. Routing nodes should generally use a lower value; wallet providers may still override it.
Security signals we found
Default configuration tightened to reduce DoS exposure
Resource-limiting change for unauthenticated incoming peer connections
Commit message explicitly frames change as DoS-risk reduction
Evidence from the diff
The change updates eclair.peer-connection.max-no-channels in reference.conf from 250 to 64. This setting caps the number of simultaneous incoming peer connections from nodes that have no open channels with the local node. A lower default shrinks the connection-state surface available for unauthenticated resource exhaustion, but it is a configuration hardening change rather than a code fix for a specific vulnerability.
Changed components
eclair-core/src/main/resources/reference.confpeer-connection.max-no-channels defaultInspect captured patch +1 / −1
diff --git a/eclair-core/src/main/resources/reference.conf b/eclair-core/src/main/resources/reference.conf
index 4bfe117..55a1041 100644
--- a/eclair-core/src/main/resources/reference.conf
+++ b/eclair-core/src/main/resources/reference.conf
@@ -405,7 +405,7 @@ eclair {
// When enabled, if we receive an incoming connection, we will echo the source IP address in our init message.
// This should be disabled if your node is behind a load balancer that doesn't preserve source IP addresses.
send-remote-address-init = true
- max-no-channels = 250 // maximum number of incoming connections from peers that do not have any channels with us
+ max-no-channels = 64 // maximum number of incoming connections from peers that do not have any channels with us
}
// When relaying payments or messages to mobile peers who are disconnected, we may try to wake them up using a mobile
Why this scored 54/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.