How to Run an Ethereum Sepolia Full Node with Geth and Lighthouse

Architecture & Protocol Overview

Execution topology, consensus mechanics, and operational assumptions.

Running a paired Ethereum testnet node allows you to verify blocks locally, broadcast transactions without third-party rate limits, and test smart contract deployments in a production-identical PoS environment. ### Prerequisites - An Ubuntu 24.04 / 22.04 LTS server with root or sudo access. - Static public IPv4 address. - Configured firewall (UFW) with required P2P ports open. ### Architecture Overview Ethereum requires two software daemons running concurrently and communicating via the JWT-authenticated Engine API on port 8551: 1. **Execution Client (Geth):** Manages the state trie, processes EVM bytecode, and handles transaction gossip. 2. **Consensus Client (Lighthouse):** Follows the Proof of Stake beacon chain and tracks block attestations.

Tags:#Ethereum#Geth#Lighthouse#Sepolia#PoS#Linux

Pre-Flight System Check (Ubuntu 22.04 / 24.04 LTS)

PRE-FLIGHT

Run this single diagnostics command on your host before beginning the installation to ensure you have sufficient compute, disk headroom, and proper privileges:

preflight-check.sh

lscpu | grep "Model name\|CPU(s):"
free -h
df -h /
uname -a

Step-by-Step Runbook Execution(4 Verified Modules)

Click checkmark to save progress

Step 1 of 4

System Preparation and Firewall Configuration

Update existing packages, install essential tools, and configure UFW to protect RPC interfaces while exposing P2P ports.

bash ~ root@validator

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl ufw git jq
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp comment "SSH"
sudo ufw allow 30303/tcp comment "Geth P2P TCP"
sudo ufw allow 30303/udp comment "Geth P2P UDP"
sudo ufw allow 9000/tcp comment "Lighthouse P2P TCP"
sudo ufw allow 9000/udp comment "Lighthouse P2P UDP"
sudo ufw enable

Expected Stdout / Terminal VerificationSTDOUT STREAM

Firewall is active and enabled on system startup

Security Protocol & Warning:Never expose port 8545 (HTTP RPC) or 8551 (Engine API) to 0.0.0.0. Keep them bound strictly to 127.0.0.1.

How to Verify Step Success:Run 'sudo ufw status verbose' and confirm that only ports 22, 30303, and 9000 are open to incoming traffic.

Step 2 of 4

Generate Engine API Authentication Secret (JWT)

Generate a cryptographically secure 32-byte hexadecimal secret shared between Geth and Lighthouse to secure inter-process communication.

bash ~ root@validator

sudo mkdir -p /var/lib/ethereum/jwt
openssl rand -hex 32 | sudo tee /var/lib/ethereum/jwt/jwt.hex > /dev/null
sudo chmod 600 /var/lib/ethereum/jwt/jwt.hex

Expected Stdout / Terminal VerificationSTDOUT STREAM

(Command outputs nothing on success)

Security Protocol & Warning:If permissions are wrong, Geth or Lighthouse will refuse to start for security.

How to Verify Step Success:Verify file presence and permissions with 'ls -la /var/lib/ethereum/jwt/jwt.hex'. It should show -rw-------.

Step 3 of 4

Install and Configure Go-Ethereum (Geth)

Install Geth using the official Ethereum PPA and create a dedicated systemd service.

bash ~ root@validator

sudo add-apt-repository -y ppa:ethereum/ethereum
sudo apt update && sudo apt install -y geth

Expected Stdout / Terminal VerificationSTDOUT STREAM

Setting up geth ...

How to Verify Step Success:Run 'geth version' and verify version >= 1.14.0.

Step 4 of 4

Launch Sepolia Sync and Verify Logs

Start the execution client on the Sepolia network and inspect peer discovery logs.

bash ~ root@validator

geth --sepolia --datadir /var/lib/ethereum/geth --authrpc.jwtsecret /var/lib/ethereum/jwt/jwt.hex --http --http.api eth,net,web3

Expected Stdout / Terminal VerificationSTDOUT STREAM

INFO [03-18|10:14:02.124] Starting Geth on Sepolia testnet...
INFO [03-18|10:14:04.912] Looking for peers...

How to Verify Step Success:Look for 'Looking for peers' followed by peer connection notifications and block header sync.

Network Port Matrix & UFW Firewall Hardening

Configure your server firewall so that P2P gossip ports are accessible to network peers while internal RPC and Engine APIs remain strictly protected from public port scanners.

Port / Protocol	Interface	Access Level	UFW Command
22 / TCP	SSH Management	Restricted / VPN	sudo ufw allow 22/tcp
P2P Peer Ports	Gossip & Block Sampling	Public (0.0.0.0/0)	sudo ufw allow 26656/tcp
RPC / REST / API	Node Query & Transactions	Localhost Only (127.0.0.1)	(Do not open publicly)

Was this guide helpful?

Let us know if you encountered any command errors or out-of-date instructions.

First Runbook in Track

Next Runbook

Setting Up a Celestia Light Node on Mocha Testnet

20mBEGINNER

Loading NodeDrops...

Architecture & Protocol Overview

Pre-Flight System Check (Ubuntu 22.04 / 24.04 LTS)

Step-by-Step Runbook Execution(4 Verified Modules)

System Preparation and Firewall Configuration

Generate Engine API Authentication Secret (JWT)

Install and Configure Go-Ethereum (Geth)

Launch Sepolia Sync and Verify Logs

Network Port Matrix & UFW Firewall Hardening

Was this guide helpful?

Setting Up a Celestia Light Node on Mocha Testnet