name: MystNodes slug: mysterium category: bandwidth status: active website: https://mystnodes.com description: > MystNodes (Mysterium Network) is a decentralized VPN and proxy network built on blockchain technology. You earn MYST tokens by running a node that provides VPN, proxy, and data scraping services to users. Requires NET_ADMIN, SETUID and SETGID capabilities and a TUN device, which it uses inside its own network namespace on the fenced earner bridge. Includes a built-in web UI for node management. Works on both residential and VPS connections. short_description: Decentralized VPN node - blockchain-based, works on VPS referral: signup_url: "https://mystnodes.co/?referral_code=do7v7YOoBBpbOstKQovX2pUvZYKia4ZhH3QIdNtE" code: "do7v7YOoBBpbOstKQovX2pUvZYKia4ZhH3QIdNtE" docker: # Pinned by digest: the node holds NET_ADMIN, so the catalog refuses it any # image it has not named exactly (app/catalog.py). Bump tag and digest together. image: "mysteriumnetwork/myst:1.39.9-alpine@sha256:f89347d244efeeaf29555e876404cf8aebcd41561c5cbed06c365ba64beb8564" # gVisor cannot run this node (no iptables-nft, no kernel WireGuard), so an # operator default of CASHPILOT_CONTAINER_RUNTIME=runsc must not reach it. runtime: runc platforms: [linux/amd64, linux/arm64, linux/arm/v7] resources: mem_limit: "768m" oom_score_adj: -100 env: - key: UI_ADDRESS label: "WebUI address" required: false secret: false description: >- The host addresses the node's WebUI (port 4449) is published on. 127.0.0.1 keeps it on this machine. To reach it through a reverse proxy, add the address the proxy connects to, comma separated with no spaces: 127.0.0.1,172.18.0.1. default: "127.0.0.1" # Each address becomes one host binding of port 4449 (ui_port below), so # anything but addresses would fail the deploy. # Each octet 0 to 255, ASCII digits only ([0-9], not \d, which in Python also # matches other scripts' digits): 256.0.0.1 is not an address, and the WebUI # listener would fail to bind while the node kept running. pattern: '(?:localhost|(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3})(?:,(?:localhost|(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))*' - key: UDP_PORTS label: "UDP port range" required: false secret: false description: >- The UDP ports the node uses for VPN sessions, as start:end. Forward this same range on your router. default: "56000:56100" # Without it the node picks from 10000:60000, so a forwarded 56000-56100 # is never used and every session falls back to hole punching. # ASCII digits only, as above; port_range checks start <= end <= 65535. pattern: '[0-9]{4,5}:[0-9]{4,5}' port_range: true # No static ports. The WebUI is published on each UI_ADDRESS address, and the # VPN range 1:1 on every address, from the env (app/catalog.py). ui_port: env: UI_ADDRESS port: 4449 udp_port_range: env: UDP_PORTS max_ports: 1000 # Docker never starts this node on its own (restart policy "no"). The worker # starts it only after it has confirmed the LAN fence is in place, at deploy, # after a reboot and after a crash, and stops it within 30 s if the fence or # the container's shape changes (app/lan_fence.py guard). fence_gated: true volumes: - "mysterium-data:/var/lib/mysterium-node" critical_volumes: - target: "/var/lib/mysterium-node" holds: >- Node identity keystore. Destroying it creates a brand-new identity: the node loses its reputation and any earnings still held against the old one. # The node runs in its own network namespace on the fenced earner bridge, so # 0.0.0.0 inside it reaches only that namespace: the WebUI (4449) is # reachable from the host only where ui_port publishes it, loopback by # default. Nothing off the machine needs it: the worker reads the node's # earnings from inside the container (collector.node_read below). Reach the # WebUI from another machine over an SSH tunnel (ssh -L 4449:127.0.0.1:4449 # ), or add the one address a reverse proxy connects to in UI_ADDRESS. # The Tequila API stays on the node's own loopback: the WebUI proxies to it # from inside the node. # --firewall.protected.networks: the node blackholes these for its customers. # Its default leaves out 100.64.0.0/10 (CGNAT and Tailscale) and # 169.254.0.0/16 (cloud metadata). It stays as a second layer inside the # node's namespace; the host's fence is the first. command: "--ui.address=0.0.0.0 --tequilapi.address=127.0.0.1 --firewall.protected.networks=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8,100.64.0.0/10,169.254.0.0/16 --udp.ports=${UDP_PORTS} service --agreed-terms-and-conditions" # The node's own firewall for its customers, read by the worker's isolation # check: the ranges in this flag of `command` go to the nat chain MYST, which # sends each one to the blackhole address. node_firewall: flag: "--firewall.protected.networks=" chain: MYST blackhole: "240.0.0.1" # SETUID and SETGID are for sudo. The node runs as root and still configures # its interface and firewall through `sudo ip ...` / `sudo iptables ...`, and # sudo switches uid and gid on the way (setresuid, setgroups). Every container # is deployed with cap_drop ALL, so without these two that call fails with # "sudo: PERM_SUDOERS: setresuid(-1, 1, -1): Operation not permitted", every # session dies at setup, and the node keeps registering and looking healthy. # no-new-privileges stays on: the node is already root, so it blocks nothing here. # NET_ADMIN reaches only the node's own network namespace: its tun and wg # interfaces, its routes and its own NAT. It cannot touch the host's # firewall, routes or interfaces, and the host's fence on the bridge drops # what the node sends to the LAN, the host, the tailnet and cloud metadata # whatever the node does to its own tables. cap_add: [NET_ADMIN, SETUID, SETGID] # Wireguard/dvpn need a TUN device. Without it the node starts, registers and # advertises itself to the network but carries no traffic - it looks healthy # and earns nothing. See docs/guides/mysterium.md. devices: - "/dev/net/tun" privileged: false health_signals: # Seen live (Sep 2026) on three nodes at once: the container was healthy, # the node was listed in discovery, and no session ever completed. - pattern: "sudo: PERM_SUDOERS" means: >- The node cannot run sudo inside its container, so it cannot configure its VPN interface or firewall and every session fails at setup: it looks online and earns nothing. The container was created without the SETUID and SETGID capabilities. Update CashPilot and the worker running this node, then redeploy Mysterium from the dashboard; the node identity lives in its data volume and is kept. state: failing # Judged over 6 hours by the UI's sweep, not over the log tail (a minute of # this node's logs). Each session logs one line per NAT traversal method # tried: "manual" is the forwarded range, and when it fails the session # falls back to hole punching. Seen live (Oct 2026) on three nodes: 325 # sessions in 24 h, none direct, because the node was not using the # forwarded range. A node with no sessions logs neither line and stays quiet. - pattern: "Method:manual Success:false" unless: "Method:manual Success:true" window_hours: 6 # Five failed direct attempts and not one success: a node an hour old with # one unlucky session is not flagged. The three unreachable nodes logged 28 # to 74 in 6 h; reachable ones logged none. min_matches: 5 means: >- No VPN session in the last 6 hours reached this node directly. Every one fell back to hole punching, and many buyers fail to connect that way, so the node earns less. Its UDP ports are not reachable from the internet. On your router, forward the UDP port range ${UDP_PORTS} (start:end, the same range on both sides) to ${HOST_ADDRESS}. This clears by itself once a session connects directly. state: failing requirements: residential_ip: false devices_per_ip: 0 min_bandwidth: "" gpu: false min_storage: "" payment: methods: [crypto] minimum_payout: "5 MYST" currency: MYST frequency: "Automatic on-chain settlement each time a node holds 5 MYST unsettled" earnings: monthly_low: 0 monthly_high: 10 currency: USD per: "device" notes: "Earnings in MYST tokens. Residential IPs earn significantly more. Node WebUI at port 4449 (loopback by default) for management. VPS accepted. Port forwarding UDP 56000-56100 (the UDP_PORTS default) strongly recommended -- without it, nodes get Strict NAT status and many VPN sessions fail, severely reducing income. Important: after first run, set your beneficiary (settlement) wallet via the node WebUI or CLI to match your mystnodes.com account -- this links on-chain earnings to your cloud dashboard." cashout: method: auto dashboard_url: "https://my.mystnodes.com/rewards" min_amount: 5.0 currency: MYST notes: >- No button to press. Each node settles on Polygon by itself once it holds 5 MYST unsettled, and about 21% goes in fees (the 20% Hermes fee plus a small transaction fee), so roughly 3.9 MYST reaches the beneficiary wallet per settlement. Each node's TequilAPI lists its settlements at /transactor/settle/history. The "total earnings" figure on MystNodes covers the last 30 days only; it is neither a balance nor a lifetime total. Bonus MYST from the MystNodes rewards program does not settle by itself: claim it on the Rewards page, within 30 days of distribution according to the MystNodes help center. platforms: [docker, windows, macos, linux, android, browser-extension] collector: type: api # Days the balance can stand still while this works normally. # Earnings move when someone buys a session through the node, and on a # quiet exit that can be days apart; settlements arrive in batches. quiet_days: 14 notes: >- The balance and lifetime come from each node's own TequilAPI identity, read by the worker (node_read). The cloud's earningsTotal is a trailing 30-day sum and its per-node lifetimeEarnings is 0, so neither is used. # How the worker reads one node's figures (app/node_read.py): TequilAPI's # identity, on 127.0.0.1:4050 inside the node, which answers reads without a # login there. earnings_tokens is the unsettled amount, the next settlement; # earnings_total_tokens is everything the node ever earned, settled or not, # before the Hermes fee. The first identity is the node's own. The node's # settlement history follows it: each item's amount (paid to the wallet) and # fees (kept by Hermes and the chain), in wei, give the share of a settlement # that never reaches the wallet. A failed history read leaves the figures. node_read: command: - sh - -c - >- id=$(wget -qO- -T 5 http://127.0.0.1:4050/identities | grep -o '0x[0-9a-fA-F]\{40\}' | head -1) && wget -qO- -T 5 "http://127.0.0.1:4050/identities/$id" && { echo; wget -qO- -T 5 "http://127.0.0.1:4050/transactor/settle/history?page_size=1000" || true; } node: '"id":"(0x[0-9a-fA-F]{40})"' balance: '"earnings_tokens":\{[^}]*"ether":"([0-9]+(?:\.[0-9]+)?)"' lifetime: '"earnings_total_tokens":\{[^}]*"ether":"([0-9]+(?:\.[0-9]+)?)"' settled_net: '"amount":([0-9]+)' settled_fees: '"fees":([0-9]+)' # MystNodes reports earnings per registered node, not just an # account total, so the UI can break the figure down by machine. per_node_earnings: true credential_hint: "Use your MystNodes account email and password (same as my.mystnodes.com)." # What this service does with the user's machine (CashPilot-66x). # Written to be read by someone deciding whether to trust it. disclosure: sells: >- Bandwidth. Your connection is used as an exit node for the Mysterium network, which sells VPN, proxy AND data-scraping services. Scraping traffic leaving a residential IP is the use most likely to draw complaints, and you cannot choose which of the three your node carries. third_party_traffic: >- Yes. Strangers route their traffic through your IP address — that is the product. data_collected: >- Node identity (a blockchain address), your IP, and coarse location (country/city/ISP), which the node publishes to the network so buyers can select it. isp_risk: >- Real and worth understanding. Traffic from other people leaves your connection attributed to you, so anything they do appears to originate from your line. Many consumer ISP contracts prohibit this. Check yours before running it. account_rules: >- Unlimited devices per account and per IP. payout: model: external chain: polygon address_source: manual notes: "The beneficiary wallet is set AFTER deploy, via TequilAPI or the node WebUI -- not by an env var, so it cannot be read from the container spec." # How the worker reads it back (app/payout_read.py): the node's TequilAPI, # which listens on 127.0.0.1:4050 inside the node and answers reads without a # login there. The first identity is the node's own. address_read: command: - sh - -c - >- id=$(wget -qO- -T 5 http://127.0.0.1:4050/identities | grep -o '0x[0-9a-fA-F]\{40\}' | head -1) && wget -qO- -T 5 "http://127.0.0.1:4050/identities/$id/beneficiary" pattern: '"beneficiary":"(0x[0-9a-fA-F]{40})"' # Provider rating: the verdicts behind the grade (method: services/_ratings.yml, # published at docs/ratings.md). The grade itself is computed, never written here. rating: reviewed_on: "2026-11-04" verdicts: payout_record: unknown payout_terms: fair account_safety: unknown terms_fit: good traffic_transparency: fair privacy: good identity_checks: good support: unknown earnings_realism: unknown longevity: good notes: payout_record: Settlements are on-chain and automatic; we have not published our own settlement history yet. payout_terms: About 21% of each settlement goes in fees, paid in MYST account_safety: Settled earnings sit in a wallet you own, but we found no stated ban rule and no reports either way. terms_fit: Own Docker image, mysteriumnetwork/myst traffic_transparency: Exit for VPN, proxy and scraping customers, no choice privacy: Open-source node software (GPL-3.0) identity_checks: Paid to your own wallet, no phone or ID needed support: Trustpilot has 16 reviews and none in the last year; not enough to judge. earnings_realism: Not measured against a provider figure. longevity: Developed by Blockdev AG in Zug, node project running since 2017 cons: - text: About 21% of every settlement goes in fees, the 20% Hermes fee plus a transaction fee, and earnings are paid in the MYST token. criterion: payout_terms kind: our_experience source: https://github.com/GeiserX/CashPilot/blob/main/services/bandwidth/mysterium.yml checked_on: "2026-11-04" - text: Your node is an exit for Mysterium's VPN, proxy and data-scraping customers, and you cannot choose which of them it carries. criterion: traffic_transparency kind: our_experience source: https://github.com/GeiserX/CashPilot/blob/main/services/bandwidth/mysterium.yml checked_on: "2026-11-04" pros: - text: The node software is open source under the GPL-3.0. criterion: privacy kind: terms source: https://github.com/mysteriumnetwork/node checked_on: "2026-11-04" - text: Mysterium publishes its own Docker image, mysteriumnetwork/myst. criterion: terms_fit kind: terms source: https://hub.docker.com/r/mysteriumnetwork/myst checked_on: "2026-11-04" - text: Settlement goes to a wallet you own; no phone number or ID is needed. criterion: identity_checks kind: our_experience source: https://github.com/GeiserX/CashPilot/blob/main/services/bandwidth/mysterium.yml checked_on: "2026-11-04" - text: The node project has run since 2017. criterion: longevity kind: terms source: https://github.com/mysteriumnetwork/node checked_on: "2026-11-04" - text: Mysterium's site says the network is developed by Blockdev AG, Zug, Switzerland. criterion: longevity kind: terms source: https://www.mysterium.network/ checked_on: "2026-11-06"