VPN
A VPN gives you remote access to your ASICs as if you were on their local network. The alternative, forwarding ports to the outside, feeds the scanner bots.
Why a farm needs a VPN
ASIC web interfaces were never meant for the open internet: factory passwords, old firmware, plain login forms. An ASIC port exposed to the outside gets found by scanners within hours, and then it is luck of the draw: from someone else's pool in your config to your farm joining a botnet.
A VPN solves this like an adult: a tunnel to the site's router, and you are inside the local network with all the web interfaces, SSH and monitoring. Nothing stays open to the outside except the tunnel itself, and unlike ASIC firmware it is built to take attacks.
Setting it up is simple these days: WireGuard lives in the firmware of most decent routers, the configuration is one file, and clients exist for everything from a phone to a laptop. Good old OpenVPN works too, it just takes longer to set up.
A separate bonus for sites behind a shared provider address, where an inbound tunnel is impossible: the inside-out connection, where the site's router itself keeps a tunnel up to your server or cloud. The farm stays reachable even though the provider gave it neither a public address nor ports.
The short version
| What it gives | access to ASICs as if on the local network |
| What it replaces | forwarding ports to the outside |
| What to run | WireGuard on the site's router |
| If the address is shared | an inside-out tunnel to your own server |
| What stays open | only the tunnel port |
How to do it right
Bring up WireGuard on the site's router and hand out configs to your devices. One evening of work for years ahead.
Close everything that was forwarded before: ASIC web interfaces and SSH must not be visible from the internet at all.
Change factory passwords on the ASICs even inside the VPN: the tunnel guards against the street, not against a guest who got into the network.
Give monitoring its own access: a service only needs the pool API, it has no business inside the farm's local network.
An example from practice
A garage with six ASICs and a shared address from the provider. The router keeps a WireGuard tunnel up to a cheap cloud server, and the owner's phone connects there too. From anywhere you can see the web interfaces of all six, while internet scanners don't see the garage at all: not a single port is open to the outside.
Related terms
Where to go next on the site
Software
- Software firmware
Hardware
- ASIC Miner knowledge base
Questions and answers
What's wrong with just forwarding a port with a password
An ASIC's login form won't survive a week of brute force, and firmware doesn't get fixed quickly. A port facing the outside gets found by scanners within hours.
Will a VPN slow down mining
No, mining runs straight from the ASIC to the pool and never enters the tunnel. The VPN is only for your access to management.
What if the site has a shared provider address
An inside-out tunnel: the site's router itself connects to your server or cloud, and you come in through it. No public address needed.
How the terms connect
Every link in the chain is clickable. Orange marks where you are now.
Looking for an ASIC miner
The catalog holds 212 models. You can compare them by hashrate and by joules per terahash, then plug your own rate into the calculator and see what stays in your pocket.
Page written and checked by Denys Klimchuk. Updated .