Bitcoin Node / Lightning Journey (Phase 2)

Phase 1 was all about getting Bitcoin Core running solidly. Now comes the fun part: turning that node into a Lightning node. This means installing LND, setting up wallets, securing channels, and making sure nothing leaks onto the internet that shouldn’t. Think of this as going from “observing the highway” to actually driving on it.

---

Step 1: Install LND

There are basically two main options for running a Lightning node: LND and Core Lightning. I went with LND here, but the steps for Core Lightning aren’t wildly different. I may circle back and do a CL walk-through later. For now, let’s roll with LND.

Download, extract, and install LND:

wget https://github.com/lightningnetwork/lnd/releases/download/v0.17.0-beta/lnd-linux-amd64-v0.17.0-beta.tar.gz
wget https://github.com/lightningnetwork/lnd/releases/download/v0.17.0-beta/manifest-v0.17.0-beta.txt

# Verify download
sha256sum --check manifest-v0.17.0-beta.txt --ignore-missing

# Extract and install
tar -xzf lnd-linux-amd64-v0.17.0-beta.tar.gz
sudo install -m 0755 -o root -g root -t /usr/local/bin lnd-linux-amd64-v0.17.0-beta/*

---

Step 2: Configure LND

Set up the config file here. Make sure to use the same RPC password you generated when you installed Bitcoin Core (see Phase 1).

This is also your chance to give your node a fun alias and color. Totally cosmetic, but it shows up in explorers and mapping tools. (Yes, this is the “pick your gamer tag” moment.)

We’ll get into advanced settings later, but if you’re curious, the LND docs linked at the bottom go much deeper.

~/.lnd/lnd.conf:

[Application Options]
listen=0.0.0.0:9735
rpclisten=127.0.0.1:10009
restlisten=127.0.0.1:8080
alias=MyLNDNode
color=#3399FF

[Bitcoin]
bitcoin.active=1
bitcoin.mainnet=1
bitcoin.node=bitcoind

[Bitcoind]
bitcoind.rpchost=127.0.0.1:8332
bitcoind.rpcuser=bitcoinrpc
bitcoind.rpcpass=YOUR_RPC_PASSWORD_FROM_BITCOIN_CONF
bitcoind.zmqpubrawblock=tcp://127.0.0.1:28332
bitcoind.zmqpubrawtx=tcp://127.0.0.1:28333

[autopilot]
autopilot.active=false

[wtclient]
wtclient.active=true

---

Step 3: Fire It Up

Let’s run this bad boy and see what happens.

lnd --configfile=~/.lnd/lnd.conf

In another terminal, create a wallet for your Lightning node (if you have an existing wallet, this is when you’d restore it):

lncli create  # Follow prompts

⚠️ Mainnet sanity check before funding anything:

1. Bitcoin Core must be fully synced

2. Write down your 24-word seed offline

3. Start with small amounts while learning

4. Remember: Lightning ≠ free lunch. Mismanagement = lost sats

Immediately back up your wallet seed and channels:

# Create channel backup
lncli exportchanbackup --all --output_file ~/backups/channels-$(date +%Y%m%d).backup

# Set up automatic backups
mkdir -p ~/backups
echo "0 2 * * * lncli exportchanbackup --all --output_file ~/backups/channels-\$(date +\%Y\%m\%d).backup" | crontab -

Check LND status:

lncli getinfo

# Should show mainnet and synced_to_chain: true

If you want auto-unlock on startup (convenient, but less secure):

# Create password file (secure it properly)
echo "YOUR_WALLET_PASSWORD" > ~/.lnd/wallet_password
chmod 600 ~/.lnd/wallet_password

---

Step 4: Lightning Basics

Here are some commands you’ll run a lot. We’ll use them later when opening channels and sending sats, but for now, just know the toolkit:

lncli getinfo
lncli newaddress p2wkh
lncli connect PUBKEY@HOST:PORT
lncli openchannel PUBKEY AMOUNT
lncli sendpayment --pay_req=BOLT11_INVOICE

---

Step 5: Systemd Services

Now that we’ve been manually starting everything, let’s make life easier with systemd services.

bitcoind service

/etc/systemd/system/bitcoind.service:

[Unit]
Description=Bitcoin Daemon
After=network.target

[Service]
ExecStart=/usr/local/bin/bitcoind -conf=/home/bitcoin/.bitcoin/bitcoin.conf -datadir=/home/bitcoin/.bitcoin
ExecStop=/usr/local/bin/bitcoin-cli -conf=/home/bitcoin/.bitcoin/bitcoin.conf stop
Restart=on-failure
User=bitcoin
Group=bitcoin
Type=simple
TimeoutSec=300

[Install]
WantedBy=multi-user.target

(This is where auto-unlock for the LND wallet comes in. Otherwise, every restart = manual unlock.)

lnd service

/etc/systemd/system/lnd.service:

[Unit]
Description=LND Lightning Daemon
After=bitcoind.service
Requires=bitcoind.service

[Service]
ExecStart=/usr/local/bin/lnd --configfile=/home/bitcoin/.lnd/lnd.conf
ExecStop=/usr/local/bin/lncli stop
Restart=on-failure
User=bitcoin
Group=bitcoin
Type=simple
TimeoutSec=300
LimitNOFILE=128000

[Install]
WantedBy=multi-user.target

Enable on boot:

sudo systemctl daemon-reload
sudo systemctl enable bitcoind.service
sudo systemctl enable lnd.service

---

Step 6: Remote Access with Tailscale

Services are up and auto-restarting. But right now, you can only access your node via direct login or LAN SSH. That’s not very global-payments-future, is it?

Instead of opening ports to the world (risky) or fiddling with Tor (doable but clunky), I went with Tailscale. It builds a private mesh network between your devices, so you can securely connect from anywhere—phone, laptop, whatever.

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Now you can securely hop into your node from anywhere. ✈️⚡

---

Step 7: Security Audit

Quick opsec check:

sudo netstat -tlnp | grep -E "(8332|9735|10009|8080|28332|28333)"

• ✅ Bitcoin RPC (8332) → localhost only

• ⚠️ LND gRPC (10009) → make sure it’s not wide open

• ⚠️ LND REST (8080) → same check

• ✅ ZMQ ports → localhost only

• ✅ Lightning P2P (9735) → public, as expected

Check UFW status:

sudo ufw status verbose

🚨 If UFW is inactive, all LND ports are exposed. That’s… bad.

---

Step 8: Lock It Down

Firewall

# Enable UFW
sudo ufw enable

# Allow SSH (adjust port if you changed it)
sudo ufw allow 22/tcp

# Allow Tailscale
sudo ufw allow in on tailscale0

# Allow Lightning P2P (if you want incoming connections)
sudo ufw allow 9735/tcp

# Allow Bitcoin P2P (if you want to serve other nodes)
sudo ufw allow 8333/tcp

# Block everything else
sudo ufw default deny incoming
sudo ufw default allow outgoing

File Permissions

chmod 600 ~/.bitcoin/bitcoin.conf
chmod 600 ~/.lnd/lnd.conf
chmod -R 700 ~/.lnd/data/

Fail2ban

sudo apt update && sudo apt install fail2ban

Verify everything:

sudo systemctl status bitcoind.service lnd.service --no-pager
bitcoin-cli getblockchaininfo
lncli getinfo

---

Why It Matters

• Firewall keeps randos out

• Permissions protect configs + macaroons

• Fail2ban blocks brute-forcers

• Tailscale = private remote access, no sketchy open ports

Final scorecard:

• 🔒 Network Security = LOW RISK

• 👤 User Management = LOW RISK

• 💰 Financial Risk = MEDIUM (because sats are always real money)

---

Advanced: Hardening Services

ProtectSystem=full
ProtectHome=true
NoNewPrivileges=true
PrivateTmp=true
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN

Pros:

• Limits blast radius if compromised

• Locks services down to minimal environments

• Makes privilege escalation harder

Cons:

• May break upgrades or debugging

• Can block logging or Bitcoin connectivity if misconfigured

---

Your Bitcoin Lightning Node is Now Production-Ready! ⚡

You can safely:

1. Fund your Lightning wallet with real Bitcoin

2. Open channels and route payments

3. Access remotely via Tailscale

4. Monitor your node knowing it’s secured

---

Next Steps

At this point, your node is fully set up, secure, and running as a proper Lightning participant. Phase 3 will cover funding the node, testing payments, and managing channels, turning it into a living, breathing Lightning machine.

---

Resources

• Bitcoin Core Docs

• LND Documentation

• Ubuntu Server Docs

• Tailscale Docs

• My upcoming write-up: Phase 3 — Funding & Channels

---

This is Phase 2 of my “DIY Node Admin” series. If you’ve followed along, congrats—you now have a fully functional, hardened Bitcoin + Lightning node. Phase 3 will show how to actually use it, safely.