ASIC Static IP and Firewall Config: A Setup Guide

An ASIC on a flat home network with default credentials is one of the more reliably compromised devices on the internet. The mining community has watched waves of botnet activity target exposed miners for years, occasionally hijacking pool configurations to redirect hashrate to attacker-owned addresses. The fix is straightforward: assign predictable IPs, isolate miners on a management LAN, allow only the outbound traffic the miner actually needs, and never — under any circumstance — expose the miner’s web UI to the public internet. This guide on asic static ip firewall config walks the practical setup for home and small-farm deployments.

Static IP versus DHCP reservation

Two approaches give miners predictable addresses. Static IP configured on the miner itself: the miner ignores DHCP and uses the configured address. DHCP reservation on the router or DHCP server: the miner asks DHCP for an address, and the server always returns the same one based on the miner’s MAC address.

DHCP reservation is the easier path for small to medium fleets. All addressing logic lives in one place — the router. Moving a miner to a different IP is a one-line config change in the DHCP server. Replacing a failed miner with a spare means updating the MAC-to-IP mapping rather than touching the miner’s config. Most consumer and prosumer routers (UniFi, Mikrotik, OPNsense, pfSense) support DHCP reservation through the web UI.

Static IP on the miner is more resilient to DHCP server outages — the miner keeps its address regardless of what the DHCP server does. The downside is that every change requires touching each miner. For very small deployments (one to three miners) where the operator wants the miner to come up even if the router is in an odd state, static can be the right choice. For larger fleets, DHCP reservation usually wins on operational simplicity.

Configuring static IP on stock Bitmain firmware

The Network tab in the Antminer web UI exposes static IP configuration. Choose Static instead of DHCP, enter the desired address, subnet mask, gateway, and DNS server. Save and reboot. Verify the miner comes back at the expected address. Stock MicroBT, Canaan, and Goldshell firmware follow the same pattern with minor UI differences. Custom firmware like BraiinsOS, LuxOS, and Vnish expose the same controls through their own interfaces.

Configuring DHCP reservation on common routers

On UniFi: Settings → Networks → choose the network → Static DHCP Lease. Enter the MAC address and desired IP. On Mikrotik RouterOS: IP → DHCP Server → Leases → Add new with Make Static enabled. On pfSense and OPNsense: Services → DHCPv4 → choose the interface → DHCP Static Mappings. Most routers ship with a similar workflow regardless of brand.

Management LAN: isolating miners from the rest of the network

Miners belong on their own VLAN or their own physical network segment. The reason is containment: if miner firmware is ever compromised — through a vulnerability, a malicious firmware update, or an attacker who got in through some other vector — the compromise should not spread to household devices or to other infrastructure. VLAN segmentation makes this enforcement automatic.

A typical small-farm scheme uses three VLANs:

VLAN 10 (Household / Office): Personal devices, laptops, phones, printers. Full internet access.

VLAN 20 (Miners): ASICs and their PDUs. Restricted outbound, no inbound from other VLANs except from VLAN 30.

VLAN 30 (Monitoring): Monitoring server, environmental sensors, IP cameras. Allowed to reach VLAN 20 for polling but not the public internet by default.

The router or Layer 3 switch enforces inter-VLAN policy through firewall rules. The household VLAN cannot reach the miner VLAN by default. The miner VLAN cannot reach the household VLAN. The monitoring VLAN can reach miners on specific ports (typically 80 for web UI and 4028 for the cgminer API). The companion piece on mining network setup covers the broader topology.

Outbound firewall rules: only what the miner needs

A miner needs outbound access to a small set of destinations: its configured stratum pools (TCP, ports vary by pool — 3333 and 4444 are common, 443 for TLS-wrapped), NTP for time sync (UDP 123), DNS for name resolution (UDP 53), and the manufacturer’s update servers if firmware auto-update is enabled (HTTPS 443). Nothing else.

A restrictive outbound firewall rule for the miner VLAN looks like:

Allow TCP outbound to pool stratum endpoints on common stratum ports (3333, 4444, 25, 443).

Allow UDP 53 to chosen DNS server only.

Allow UDP 123 to chosen NTP server only.

Block everything else outbound.

This kind of egress firewall is the most effective defense against miner-based botnet recruitment. Even if a miner gets compromised, the attacker cannot communicate with command-and-control infrastructure unless it happens to be on one of the allowed pool endpoints. Most home routers have firewall rules permissive enough by default that this requires deliberate configuration; on pfSense, OPNsense, Mikrotik, and UniFi the rules are explicitly configurable.

Inbound: nothing from the WAN, ever

The miner’s web UI should never be reachable from the public internet. Period. Port forwarding port 80 to a miner is among the worst configurations seen in the wild. The web UIs on stock firmware have historically had vulnerabilities; even patched versions are a poor risk-reward trade. The right answer for remote access is a VPN.

Tailscale, WireGuard, OpenVPN, or a router-integrated VPN all work. Tailscale is the easiest for small operators — it handles NAT traversal and key management automatically. Install Tailscale on a small Linux device on the mining VLAN (or directly on the router if the router supports it), connect from offsite, and reach miner web UIs over the VPN as if local. No public exposure required.

For commercial deployments with multiple sites, a site-to-site VPN between the mining facility and the office network achieves the same result at larger scale. The principle does not change: miners speak outbound only, management traffic arrives via authenticated VPN.

Stratum ports and pool destinations

Each pool publishes its accepted ports. Common patterns:

Braiins Pool: 3333 plain stratum, 443 TLS-wrapped stratum.

F2Pool: 3333 and 1314 plain stratum.

Foundry USA: 3333 plain, 443 TLS.

AntPool: 3333 and 25 plain, 443 TLS.

ViaBTC: 3333 plain.

For an outbound firewall that needs to allow all major pools, opening TCP outbound to ports 25, 443, 1314, 3333, and 4444 covers most cases. Where the firewall supports it, narrow further by IP — pools publish their stratum endpoint IPs, and locking the outbound rule to those specific addresses tightens the egress further at the cost of needing to update when pools change infrastructure.

For setups behind aggressive corporate or campus firewalls that block non-standard ports, the TLS-wrapped stratum endpoints on port 443 look like normal HTTPS to the network and almost always pass. Detail on stratum-side configuration lives at stratum error troubleshooting.

Change default credentials, every time

Stock Bitmain ships with default credentials (commonly “root” / “root” on older builds). MicroBT, Canaan, and Goldshell ship with documented defaults. Every miner needs the default password changed at first boot, ideally to a unique strong password per unit. A password manager makes per-unit unique passwords practical at small fleet scale.

The credential change is not theoretical. Mining-targeted malware has scanned for default-credentialed miners on the public internet for years; instances of compromised miners getting their pool configuration silently changed to attacker-owned addresses are well documented in mining forums and trade press.

Firmware updates and supply-chain caution

Stock firmware updates from Bitmain, MicroBT, and Canaan come through their official channels. Custom firmware from BraiinsOS, LuxOS, and Vnish is distributed through the publisher’s official sites. Never install firmware downloaded from unofficial mirrors, file-sharing sites, or unverified third parties — the supply-chain risk includes backdoored firmware that mines for an attacker rather than the operator. The broader trade-offs of custom versus stock firmware are unpacked in custom ASIC firmware risks.

Practical implementation checklist

The configuration order that works in the field:

1. Connect the miner to the dedicated mining network segment.

2. Note the MAC address and configure a DHCP reservation for it.

3. Power on the miner and verify it gets the expected IP.

4. Access the web UI from a device on the same network. Change the default password.

5. Configure pool URLs and worker credentials.

6. Verify the miner reaches the pool and starts hashing.

7. Enable the egress firewall rules on the miner VLAN.

8. Verify the miner continues to hash with the firewall in place.

9. Configure remote access through VPN only. Test from offsite before relying on it.

10. Document the IP, MAC, model, and serial in a fleet inventory.

For multi-unit deployments where this needs to repeat dozens of times, a provisioning script or template config reduces the per-unit time. Background on the broader operational layer lives at ASIC remote monitoring stack.

What stays in scope for the operator

This kind of network hygiene is not a one-time setup. Firmware updates need verification. Pool changes need firewall rule updates. New miners need provisioning. Quarterly review of the firewall rules catches drift; annual audit of credentials, VPN access, and exposed services catches gaps. For operators thinking through the broader stack from network through power through hardware, the Bitcoin mining hardware lineup is the starting point on the equipment side.

References

• Bitmain Antminer network and firmware documentation — Bitmain
• BraiinsOS network configuration and security — Braiins
• MicroBT Whatsminer network setup guide — MicroBT
• Canaan Avalon network configuration documentation — Canaan

For operators sourcing new hardware to slot into a properly segmented network, the Coin Web Mining catalog carries current-generation ASICs with live pricing.