How to change port of Gunbot’s GUI for better security

As of Gunbot v8.0.3, Gunbot’s GUI (gunthy-gui) defaults to port 5000 and for security reasons, you might want to change it. (the default for

What’s Going On

Gunbot v8 and later (XT, CS and RT) can run in two modes – by itself on the command-line (aka “Gunbot Core”) or with a GUI (aka “Gunbot GUI”).

Gunbot v8, v9: Gunbot itself is the “gunthy” executable (named either gunthy.exe, gunthy-linx64, gunthy-macos, or gunthy-arm) and is what runs in both modes.  The GUI is optional.  The GUI (named gunthy-gui) presents a friendly interface for configuration, control and surface-level monitoring, and then runs the gunthy executable for you.

Gunbot v10 and later: Gunbot executable is just one file, and based on your configuration file (config.js), it will either run in “Gunbot Core” mode or “Gunbot GUI” mode.  This is in the “GUI” section of the config file.

“enabled”: [true | false]
“start”: [true | false]
“port”: 5000

In Gunbot v10 and up, if “enabled” is true, then the GUI will run on the “port” specified.  “start” indicates whether or not Gunbot Core should automatically start when Gunbot runs.

Both gunthy and gunthy-gui use what’s known as a network port to communicate with itself or other components.  For Gunbot, this is configured in the “ws” section of the config.js file and contains “port” and “clientport” settings. For the GUI, this is an HTTP port (not configurable from the config.js file in Gunbot versions before v10) and is part of the URL you can use to access the GUI, both locally on the box and from an external system.

Default port

The default port that Gunbot GUI runs on is 5000.  This means you would access “http://localhost:5000” when you’re actually accessing the system that runs Gunbot directly, or “http://<ip address>:5000” when accessing the system remotely.  If you have a DNS server or hosts file, you can configure those to point a user-friendly name to the IP address, such as myvpsisawesome.gunbotuniversity.com.  If you do that, you would still add the “:5000” at the end so the full URL is http://myvpsisawesome.gunbotuniversity.com:5000.  Without the “:5000” at the end, then your browser tries to connect to port 80 (http) or port 443 (https) and this won’t work.

Why Security is Important to Some

If you leave the Gunbot GUI settings at default and use the default port of 5000, then you run the risk of being too-easily discovered by remote systems.  Once it’s known that the default port is 5000 for Gunbot, there are hackers, crawlers and systems such as http://shodan.io that can collect data and tell others that you’re running Gunbot.  Shodan even has a gunbot query already set up so that you can search for Gunbots on the network.

I don’t know about you, but I’d rather my Gunbot GUI not be so easily found.  It won’t be long before we hear of some Gunbotter whose system was hacked, DDOS’ed or otherwise compromised and losses occur.

The first step in making your Gunbot more secure is to change from the default port.  There are other steps you can take, such as using a VPN to access your GUI, limiting the IP addresses that can talk to your server, on these ports, and adding SSL certificates (Gunbot v8, v9 require a reverse proxy; Gunbot v10 and up can have SSL natively supported if you have a certificate).  Those steps are not covered in this guide.

How to Fix

Change your port number

How to change your port number is different with various Gunbot versions.  You want to pick a port number that makes sense and will work:

  1. Well known ports are ports 0 – 1023. You should not pick these ports unless you know what you’re doing and have taken appropriate security precautions.
  2. Registered ports are 1024 – 49151.  It’s ok to pick a port in this range, as long as you don’t pick a port that conflicts with something else running on your machine.  You may or may not want to use common registered ports that systems frequently search for, like 8000, 8080
  3. Make sure you do not pick the same port that’s listed in config file under ws:port.  or clientport.  Generally, this means avoiding 5001 and 3000.
  4. Dynamic / private ports are those from 49152 to 65535.

Gunbot v10 and later:

In the `config.js` file, Change the “GUI”: port parameter from something other than port 5000.

"GUI": {
   "enabled": true,
   "start": false,
   "port": 5000, <--- change this

For example, if you change it to 5158, then you would access Gunbot GUI at http://<your IP address>:5158

Gunbot v8, v9:

In order to change the default port that gunthy-gui uses, you need to set an “environment variable” called PORT to the port number you want the GUI to use.  Depending on what operating system you use, how you change this varies.

For Windows users, you set the port before you run the command:

set PORT=5003
gunthy-gui.exe

This should now make the GUI respond to URL with :5003 at the end instead of :5000.

You can also make a batch file to launch Gunbot GUI:

@echo off
set PORT=5003
start /d gunthy-gui.exe

For Linux/MAC/ARM users, you can do it all on one line.  From the directory gunbot is installed, running the following will launch the GUI and use port 5003:

env PORT=5003 ./gunthy-gui

If you use pm2, you can do the same thing on one line:

env PORT=5003 pm2 start ./gunthy-gui --name binance

Then use your normal pm2 list all and pm2 info binance and other commands to manage the gunthy-gui process.

Websocket port

It’s important to note that the PORT that the GUI uses to speak HTTP is not the “clientport” in the config file.

"ws": {
"port": 5001,
"clientport": 3000,
"hostname": "127.0.0.1"
},

In Gunbot v8, websockets were important and it impacted how clients talked with graphs and such on the GUI.  This is less so in later versions and supposedly websockets are not used at all.  However, both of these ports *are* used.

This 5001 port here can be changed as well, but it needs to NOT conflict with any other port being used on the system.  You cannot use the same port for ws:port and PORT=xxxx.  They must be different ports.

Multiple instances on same device

Most of the time, you don’t need to change ws: port setting.  However, if you run multiple Gunbot instances on the same machine manually, then each port needs to be unique.

For example, the first time you install Gunbot on a machine, it can run with port:5000 for the GUI and port:5001 for ws:port.  If you put a second Gunbot instance in another folder and want to run it, you need to change ws:port from 5001 to something else, like 5003.  If you also wanted a second GUI running, you would use the changes described earlier, and maybe use 5002 for that.

Also, if you are accessing your Gunbot GUI from a remote system, you will want to change the hostname setting inside of ws to be the IP address or FQDN (fully-qualified domain name) of the machine running Gunbot GUI.  For example, if you’re using a VPS, you would put in the IP of the VPS. Otherwise, in Gunbot 8.0.3 and earlier, the GUI will be slow and open up a lot of websocket connections to a box that won’t respond (again, this was much more the case in Gunbot v8 than later versions, but I still highly recommend changing hostname anyway)

For example:

"ws": {
"port": 5021,
"clientport": 3000,
"hostname": "4.2.2.1"
},

Or

"ws": {
"port": 5021,
"clientport": 3000,
"hostname": "myawesomegunbot.gunbotuniversity.com"
},

Gunbot version 9 no longer uses websockets and doesn’t officially require the hostname update, although GBU still recommends the change.

Note: in previous versions, running multiple GUIs, even when changing the port, didn’t work well for me.  I haven’t tested it in version 8.  Instead, I just spin a new VPS for another instance so that I’m not subject to any IP address problems, resource constraints, or interoperability issues.  As of version 10, there aren’t any known issues with this.

Summary:

  1. If you keep default settings for things like what port the GUI listens to, you increase your risks.
  2. It’s fairly trivial to change the GUI port so you’re not so easily found.
  3. While the instructions differ for older versions, the port can be configured in the config.js file under the GUI: port setting.

 

Help me understand Gunbot’s MFI – Money Flow Index

Do you want to know more about Gunbot’s Money Flow Index, or MFI?  Here are some things you will want to know.

What’s going on

The BTC/USD money flow index (MFI) is calculated by Gunbot looking at the ASK book of BTC/USD and takes both price and volume information. It’s supposed to help indicate overbought or oversold conditions, much like RSI (Relative Strength Index) does. However, RSI indicator is price-only, and the benefit of the MFI is that it uses volume as well. Volume can help predict a pump or dump.

So, MFI is a volume-weighted RSI-type metric. If BTC/USD is oversold, the MFI number goes lower and lower. The idea is that oversold BTC/USD means the volume is growing on the ASK book, and that means there may be a pump of BTC soon.

MFI is a volume-weighted RSI-type metric

Why MFI is important to some

Anyone who’s been around crypto a while knows that pumping of BTC price might mean the altcoin’s value will drop in contrast. So, OKKIES_MODE is a feature Gunbot offers that allows you to temporarily stop Gunbot from trading if it senses a BTC pump coming up.

For a long time in crypto, when BTC “mooned” (shot up in value quickly), the altcoins bled in the streets.  There wasn’t enough liquidity or ability to buy alts with anything but BTC.  But as the market grew, and more ETH pairs, BCH pairs, XMR pairs, USDT/TUSD/USD pairs came online, there were more ways to buy altcoins than just with BTC.  For this reason, it’s more and more common that when BTC moons, so will several altcoins, which is different than it was for many years.

The original scenario of “BTC rises signals ALTs demises” is still valid for many pairs much of the time.  Because of this, if BTC rises and ALTs drop, Gunbot would normally see a price drop of an ALT as a buying opportunity.  It would buy the ALT and then be left with a bag because BTC kept rising and rising, and then set a new high and sit there.  The likelihood of the ALT price recovering any time soon was not very high.

OKKIES_MODE was created to help Gunbot prevent getting into a bag situation.

But more recently, it has indicated the opposite, so it’s not as hard and fast of a rule as it used to be.  For this reason, the savvy Gunbotter won’t just blindly turn this on or off – it doesn’t always mean it will protect against bags all the time.  It is recommended that Gunbotters review pair-by-pair what that specific coin pair’s likelihood is of tanking when BTC goes up.  You can use Allanster’s backtesting tuners on Trading View for help with that.  Check out the tuners on Trading View or two posts on Gunthy Forums: here and here.

How it’s Used

BTC_MONEY_FLOW is the setting in the config you want it to use as a threshold to decide whether to make trades or not.  OKKIES_MODE is what you set to true or false as to whether or not you want Gunbot to collect (v8) or care (v8 and v9) about this metric.

Default setting:

Most strategies come with default setting of “true” and “35” in Gunbot version 8.0.3.  TSSL Strategy uses default of “false” and “32”.

"OKKIES_MODE": true,
"BTC_MONEY_FLOW": 35,

On some exchanges, the MFI isn’t calculated easily or consistently.  Be sure to review console logs for the MFI values and make sure they are coming across, if you have OKKIES_MODE turned on.  In Gunbot version 8.0.3, if OKKIES_MODE is false, then the Money Flow Index values will show “undefined”.

When MFI has prevented Gunbot XT from buying, you will see a message that says

There is too much enthusiasm… waiting to buy

Summary:

  1. If Gunbot produces bags for you when BTC price pumps, consider enabling OKKIES_MODE and setting the `BTC_MONEY_FLOW` to 35 or lower.
  2. If your exchange or pair produces “undefined” results for MFI when you have `OKKIES_MODE` enabled, disable it.
  3. Before blindly setting this variable, research a coin pair’s history of reaction to BTC pumps.

 

 

 

How do I fix Telegram api – make sure that only one bot instance is running errors?

originalHost: ‘api.telegram.org’,
originalHostHeaderName: ‘host’,
responseContent: [Circular],
_destdata: true,
_ended: true,
_callbackCalled: true },
toJSON: [Function: responseToJSON],
caseless: Caseless { dict: [Object] },
read: [Function],
body:
{ ok: false,
error_code: 409,
description: ‘Conflict: terminated by other getUpdates request; make sure that only one bot instance is running’ } } }

You might see this error in your err.log or console log or in the GUI.

What’s going on

Gunbot version 8 added direct Telegram support.  Whenever there are buys or sells, Gunbot can connect to the Telegram API and send you a message.  It requires a chatbot token, your Telegram id and an arbitrary label.

If you’re running just one bot, you might not see this very often.  However, if you run multiple bots (or the one bot is very busy), you may see this error.

First, don’t worry.  This error doesn’t mean there’s anything wrong with Gunbot, or your trades aren’t happening.  It only means you are missing out on a few Telegram Notifications about buys and sells.

Second, Gunbot caches the missed telegram notifications.  So, if it had a problem trying to send you a notification yesterday, it’s going to KEEP TRYING to send the notification, but it will most likely keep getting this error.  So, you will continue to see the error until you restart Gunbot.

How to Fix It

For Gunbot Version 8, there’s not much you can do to permanently fix the problem other than creating a different chatbot for each Gunbot instance.  And even that won’t 100% fix the problem.

According to several reports, such as this one, this problem is caused by an outdated set of code.  It’s most likely that Gunbot has this older node_modules compiled into it, and will continue to have the problem until the next version.  It is rumored that Gunbot v9 no longer has the problem, so GBU’s guess is that the newer node_modules was compiled into Gunbot v9.

In order to stop getting errors for the telegram notifications it’s continuing to retry, you need to restart Gunbot.  That clears the cache of missed notifications and it will stop retrying.  You’ll be good until the next notification that fails.

So, in summary:

  1. In Gunbot Version 8, make a different chat bot for each instance.
  2. Restart Gunbot to clear out old notification retries
  3. Wait for Gunbot Version 9, which supposedly fixes the issue.

 

 

 

How do I fix Cannot read property ‘askPrice’ of undefined error?

TypeError: Cannot read property ‘askPrice’ of undefined
at Binance.parseOrderBook (C:\snapshot\Gunbot-master\ctx\js\binance.js:0:0)
at module.exports.fetchOrderBook.Promise.binance.allBookTickers (C:\snapshot\Gunbot-master\ctx\js\binance.js:0:0)
at Request.module.exports._makeRequest.request [as _callback] (C:\snapshot\Gunbot-master\ctx\helper\binance\binance-api.js:0:0)
at Request.init.self.callback (C:\snapshot\Gunbot-master\node_modules\request\request.js:186:22)
at emitTwo (events.js:126:13)
at Request.emit (events.js:214:7)
at Request. (C:\snapshot\Gunbot-master\node_modules\request\request.js:1163:10)
at emitOne (events.js:116:13)
at Request.emit (events.js:211:7)
at IncomingMessage. (C:\snapshot\Gunbot-master\node_modules\request\request.js:1085:12)
at Object.onceWrapper (events.js:313:30)
at emitNone (events.js:111:20)
at IncomingMessage.emit (events.js:208:7)
at endReadableNT (_stream_readable.js:1056:12)
at _combinedTickCallback (internal/process/next_tick.js:138:11)
at process._tickCallback (internal/process/next_tick.js:180:9

You might be getting this error and wondering “what did I do wrong?”  “How do I fix it?”  “Why does botting hate me?”

This error message – keyed on the TypeError: Cannot read property askprice of undefined tagline – usually means one MAJOR thing is wrong with your configuration.

One of your pairs is wrong.

“But, my pairs are right!” I can hear you saying.  Check again, I say.

Gunbotting isn’t a science – it’s an art.  Go through your pairs and actually check on the exchange if they exist. Gunbot does what you tell it to do, even if it’s wrong.

For example, if you’re running Binance, and you didn’t correct the typo in the default config, you might be running BTC-IOT instead of BTC-IOTA.

If you use the GUI, and gunbot and Trading View support the exchange, then the graph will show you if the pair is good or not.  If you see an actual graph, then your pair is for sure good.

However, if you see “Invalid Symbol” then that’s telling you that the pair is no good.  Remove it.

invalid symbol

If you’re sure the pair name is correct, then it could be an API error, or, in some cases, the Exchange allows the coin to be traded normally (ie, through the web interface) but the Exchange doesn’t allow API trading.

Other things to check if all else fails:

  • Ensure your API key is valid on the Exchange.
  • Ensure your time is synced properly
  • Make sure you’re not banned from the Exchange on a temporary IP ban or a permanent ban.