Failed to connect with gRPC to remote LND: failed to connect to all addresses unavailable

[Luca-Fischer]

I want to connect to my LND running on a raspberry pi linux from my macOS with gRPC. On the raspberry pi is also a bitcoin full node running bitcoind regtest. I used this tutorial: https://github.com/lightningnetwork/lnd/blob/master/docs/grpc/python.md There is a good chance I do something obvious wrong.

lnd.conf on linux:

[Application Options]
#this is the public ip of the raspberry pi
tlsextraip=87.228.187.58 

[Bitcoin]
bitcoin.active=true
bitcoin.regtest=true
bitcoin.node=bitcoind

[Bitcoind]
bitcoind.rpchost=localhost
bitcoind.rpcuser=aUser
bitcoind.rpcpass=aPass
bitcoind.zmqpubrawblock=tcp://127.0.0.1:28332
bitcoind.zmqpubrawtx=tcp://127.0.0.1:28333

I deleted the tls.cert and tls.key and restarted lnd.

bitcoin.conf on linux:

rpcauth=...

zmqpubrawblock=tcp://127.0.0.1:28332
zmqpubrawtx=tcp://127.0.0.1:28333

txindex=1
regtest=1
daemon=1

Works perfectly.

On macOS i followed the steps in the tutorial. Created the virtualenv, installed dependencies, cloned the repo, copied the proto file and compiled it.

I created client.py file with this content:

import lightning_pb2 as ln
import lightning_pb2_grpc as lnrpc
import grpc
import os

os.environ["GRPC_SSL_CIPHER_SUITES"] = 'HIGH+ECDSA'

cert = open(os.path.expanduser('~/Library/Application Support/Lnd/tls.cert'), 'rb').read()
creds = grpc.ssl_channel_credentials(cert)
channel = grpc.secure_channel('87.228.187.58:10009', creds)
stub = lnrpc.LightningStub(channel)

response = stub.WalletBalance(ln.WalletBalanceRequest())
print(response.total_balance)

When I execute the client.py, first it said it can not find the file tls.cert because this file is (in my understanding) supposed to be on the linux system. Anyway I installed the LND also on macOS with the same lnd.conf file and run it.

When I execute the client.py now, I get this error:

Traceback (most recent call last):
  File "~/Documents/projects/lnd/client.py", line 18, in <module>
    response = stub.WalletBalance(ln.WalletBalanceRequest())
  File "~/Documents/projects/lnd/lib/python3.10/site-packages/grpc/_channel.py", line 1030, in __call__
    return _end_unary_response_blocking(state, call, False, None)
  File "~/Documents/projects/lnd/lib/python3.10/site-packages/grpc/_channel.py", line 910, in _end_unary_response_blocking
    raise _InactiveRpcError(state)  # pytype: disable=not-instantiable
grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
        status = StatusCode.UNAVAILABLE
        details = "failed to connect to all addresses; last error: UNAVAILABLE: ipv4:87.228.187.58:10009: Failed to connect to remote host: FD shutdown"
        debug_error_string = "UNKNOWN:failed to connect to all addresses; last error: UNAVAILABLE: ipv4:87.228.187.58:10009: Failed to connect to remote host: FD shutdown {grpc_status:14, created_time:"2023-04-22T17:06:33.920693+03:00"}"

Bitcoind and LND is running on Linux. LND says:

RPC server listening on 127.0.0.1:10009
I got the tlsextraip from a website saying this is my public ip address.

I tried setting rpclisten=87.228.187.58:10009 and rpclisten=0.0.0.0:10009 on linux but does not work. Same error.

Am I doing something obvious wrong, or until now is the main part correct? How can I fix the problem?

Thanks in advance

[guggero]

Is your raspberry pi connected to the internet directly or through a home router? You might need to forward the port 10009 on your router for it to be reachable from the outside. Also, you definitely need rpclisten=0.0.0.0:10009, otherwise only connections from the same machine will work (which is what the 127.0.0.1 indicates here: RPC server listening on 127.0.0.1:10009).

[guggero]

Okay, that sounds good. Correct, you don't have to run lnd on the client side. The tls.cert is required on the client side to authenticate the encrypted connection, to verify you are talking to the correct node. So you don't have to create a tls.cert on the client side, you have to copy the one from the server side to the client (so the client can verify the public key in the certificate against the one offered by lnd during the TLS encrypted connection).

[Luca-Fischer]

ok, thanks. good to know.
Maybe the problem, but I dont know what to do with it.
I run lncli getinfo and get rpc error: signature missmatch.
Makes sense, because I created some more configs and the lncli1 getinfo works. I cant find in the python code were to change lncli to lncli1. Do you know?

[guggero]

Did you try with the copied tls.cert file? Because the connection will fail if you don't use it on the client side.
From the client computer, what do you get if you run openssl s_client -connect 87.228.187.58:10009?

[Luca-Fischer]

Ah ok, so the tls.cert file is not based on settings, but changes for each node? Makes sense. I will get back to you if I get the chance to do that. For the command I get:
connect: Operation timed out
connect:errno=60

[guggero]

connect: Operation timed out

Okay, but that means there is a firewall between your client and the lnd server that blocks the connection. As long as that openssl command doesn't show a certificate your client code won't be able to connect either.