Simplest "design" to host a Minecraft server for me and a couple of friends? reddit / selfhosted ---------------------------------------------------------------------- No_Connection1258 · 2023-11-03 07:52 A lot of tutorials just talk about renting a VPS, or setting up a separate box at home, but my needs are as simple as they can be. Today, I port-forward Minecraft's port on my router and send my WAN IP to my friends. Whenever we want to play, I just spin up the server, I don't need it up 24/7. I understand it poses a security risk, so without over-complicating things, how do I secure my setup? I have a basic plan in mind: 1. buy domain 2. Use domain's DDNS option and point it to my WAN IP 3. Setup a reverse-proxy service on my PC 4. port forward 80/443 on my router I'm wondering if this would work, since Minecraft is not using HTTP so the reverse-proxy idea might not suit my needs? All I want is an on-deman option to run my server, play with friends, close it when I'm done :) ---------------------------------------------------------------------- thekrautboy · 2023-11-03 07:58 You dont need to buy a domain, a free subdomain from Duckdns.org or dedyn.io is enough. You dont need a reverse proxy either. Minecraft supports DNS SRV records, so you can use those to point your domain like `myminecraft.duckdns.org` to `111.222.333.444:56718` and players joining your server dont even need to add the port number. This also allows you to run multiple servers on different ports and then simply adding more DNS records to point to each server. You only need to portforward the actual gameserver port. Try /r/Admincraft ---------------------------------------------------------------------- No_Connection1258 · 2023-11-03 08:02 > 111.222.333.444:56718 oh wow, thanks. So in this case: `111.222.333.444` is my WAN IP? Also, it would mean I still need to port-forward `56718` on my router? Doesn't that pose a security risk of some sort? ---------------------------------------------------------------------- heapsion · 2023-11-03 08:06 It does. But how else will traffic get into your house and to your server ---------------------------------------------------------------------- thekrautboy · 2023-11-03 08:11 Yes. And because a lot of consumer IPs are dynamic (it changes from time to time) you would use a tool like `ddclient` that you run on your server for example which automatically updates your DDNS name with your current WAN IP. So you never need to bother with that and your friends only use the DNS name to connect. Yes you need to open that port on your router. Yes its a risk, if the Minecraft server software has a security flaw, it could be exploited by someone from the outside. But there is no real way around that. Unless you make all your friends install a VPN client to connect through that to your gameserver, Tailscale for example. ---------------------------------------------------------------------- No_Connection1258 · 2023-11-03 08:17 Wouldn't a reverse-proxy add some sort of layer of security in this case? ---------------------------------------------------------------------- [deleted] · 2023-11-03 08:19 [deleted] ---------------------------------------------------------------------- Stetsed · 2023-11-03 08:25 A reverse proxy in and of itself doens't add any security, usually the reason its seen as adding more security is because it centralizes the point of entry which makes it easier to implement firewalls etc. However in this case as it's a minecraft server you can't really do much except IP based ones such as Crowdsec as you can't use WAF or similar tools like you could for web traffic as it's only TCP forwarding for the minecraft server. Personally I do like using NGINX to centralize my point of entry(What I call my "Gateway"), and then from there it uses either HTTP(s) to go to web endpoints within my homelab, or TCP/UDP streams to go with that. However for some services I do just do them directly on the host, this is mostly for services that rely on interconnects like my GarageHQ cluster which shouldn't have a SPOF like a centralized gateway VM. ---------------------------------------------------------------------- Stetsed · 2023-11-03 08:30 So firstly I would recommend the docker route as there is a fantastic container for docker ([https://github.com/itzg/docker-minecraft- server](https://github.com/itzg/docker-minecraft-server)) which let's you setup any type of server you could imagine very easily including mods and other stuff. Secondly as u/thekrautboy mentioned you do not need a domain and you could simply use a free subdomain from a service like duckdns however imho it's always good to have a domain for other stuff.(I have [selfhostable.net](https://selfhostable.net) and [stetsed.xyz](https://stetsed.xyz) for example). And for me atleast it looks cleaner and more proffesional. And he also mentioned DNS SRV records so you don't need to enter an IP every time. Thirdly I would recommend setting up crowdsec([https://github.com/crow dsecurity/crowdsec](https://github.com/crowdsecurity/crowdsec)) for IP blocking as it's a great tool that does most of the heavy lifting for you, and if you ever add a service it can parse(Like NGINX), you could start setting up your own blocking with that but until then you get the benefits of there crowd sourced list. Lastly I would recommend setting up a whitelist and the usual things for minecraft servers as in my experience minecraft servers are like a magnet for sh\*theads if it's not locked down, for info on how to do this check the docker container I sent if your looking to use that or look at how to set it up on whatever platform your using. ---------------------------------------------------------------------- lilolalu · 2023-11-03 08:40 You asked for a simple solution, opening your Minecraft port to the outside on a dyndns name is the most straightforward solution. Like running other services on the internet, it can pose a security risk. The question here is, _how much_ risk. Since you wrote you are basically spinning up the server only when you are playing, and only on the Minecraft port, the actual risk is very low. ---------------------------------------------------------------------- thekrautboy · 2023-11-03 08:42 Reverse proxies are often used like that, yes. But then the proxy needs to be open to the internet. So you are only shifting from trusting one software to another. If there is reason to not trust a software but it still needs to be reached from the outside, then a reverse proxy is ideal because that software is specifically made for that and chances of a security flaw are lower in that. But on top of that, reverse proxies are made to proxy webservices, not gameservers. Most gameservers will not work with them. ---------------------------------------------------------------------- zfa · 2023-11-03 09:42 I run a couple of MC servers for my little boy and his mates. Got a Bedrock instance on an Oracle Always Free instance using [this github project](https://github.com/TheRemote/MinecraftBedrockServer), got a handful of Java instances on free Oracle ARM instance using [AMP](https://cubecoders.com/AMP). Could run Bedrock on the latter too if I wanted but the other server predates it so I keep it running. [Oracle were activley courting MC servers a while back](https://blogs.oracle.com/developers/post/how-to-set-up-and-run- a-really-powerful-free-minecraft-server-in-the-cloud). In both cases World backups go to VPS dirs which I have sync'ed to my desktop at home using Syncthing. As belt and braces the backups on each system are rsynced to each other but that's just overkill. You've not asked about that but that's more for the *don't-use-free-Oracle- for-anything-they'll-delete-you-without-notice* crowd. Suffice to say, I just keep backups of my worlds, and that's really all you need. There is no need for domain name as those servers have fixed IPs but you can use them if you like. /r/thekrautboy is correct about SRV records but that is a Java-only thing. If you're using Bedrock (i.e Android, ios, xbox users etc) you can't use SRV records and must specify the actual server IP:port as a connection string. Again as /u/thekrautboy says, MC traffic doesn't go over 80/443 - it uses 19132 for bedrock and 25565 for Java (those are ipv4 address, ipv6 are different again) so no need to proxy normal web traffic on there. You can secure server by using allowlists (remember to explicitly enable this in your server.properties and don't just create an allowlist thinking thats all you need). On top of that you can add the usual firewall rules to only allow access from your own country say (just load a firehol or ipdeny ipset for this). If you still want to keep things on your own network I guess the takeaways from my setup would be TheRemote's project (though there are also Docker projects including one form the same author), you only need to open the MC port, you don't need a domain name but can use one (or a dyndns name) if you want, and I'd advise the use of both allowlist.json and a somewhat restrictive firewall. ---------------------------------------------------------------------- zfa · 2023-11-03 09:48 Does crowdsec support MC log parsing do you know? There's constant in- fighting regarding MC support in fail2ban I seem to recall. ---------------------------------------------------------------------- yuri0r · 2023-11-03 09:54 [https://essential.gg/](https://essential.gg/) it wont get simpler than that if you just want to on demand play with friends. no domain no vps no port forwarding no ddns this was MADE for your described use case ---------------------------------------------------------------------- Stetsed · 2023-11-03 10:24 No it does not which is why I said you won't be able to parse minecraft logs with it, but you will still gain the benefits of the community block list. ---------------------------------------------------------------------- AnApexBread · 2023-11-03 10:27 >understand it poses a security risk, so without over-complicating things, how do I secure my setup? As long as you've only forwarded the Minecraft ports this doesn't really pose as much risk as people like to claim, and none of the risks are things that could be mitigated by using a domain name or a reverse proxy. There's not a ton of stuff someone can do with an IP. There's two things you should do. Close any ports that don't need to be open. Minecraft doesn't need 80 or 443 so don't open those. Only open the ports Minecraft absolutely needs. Second, make sure Minecraft is up to date. The biggest risk with port forwarding isn't the ports (those aren't actually a real thing). The risk is with what service the port points too. If the service is vulnerable then it's a problem. ---------------------------------------------------------------------- zfa · 2023-11-03 10:31 Ah right, shame. Thanks for the info. 👍 ---------------------------------------------------------------------- autogyrophilia · 2023-11-03 11:02 The easiest secure setup would be to join a common tailscale network ---------------------------------------------------------------------- Guilraw · 2023-11-03 12:25 Why not just hosting the server and port forwarding from the router with your friend's IP as whitelist. It is secure and works just fine if your public IP and friend's don't change too often. Even a change every week is a 1 minute operation. No need for ddns or whatever everything is already available and free without much work if you use IP adresses. For even further security you can also add a specific firewall rule on your machine with the Java executable to only accept connections from your friend's IP. You can also setup security inside the minecraft server with nametag whitelist and password if you're paranoid. Hf playing ---------------------------------------------------------------------- Ieris19 · 2023-11-03 12:34 As specific advice for Minecraft. Minecraft has a designated port for servers. I believe changing it means you NEED to specify the port when connecting so I’d advice against it ---------------------------------------------------------------------- lvlint67 · 2023-11-03 12:48 > I understand it poses a security risk The biggest risk is honestly that someone scans down the port, joins the server and covers your spawn in lava... Security wise... The exposure is fairly minimal. Awhile ago, I wrote this to cover exactly your use case: https://github.com/daniel-widrick/mcPortKnock It listens for a connection on the Minecraft port. If it gets one it throws the client a message: "server starting reconnect in x minutes". Whole the server runs, it monitors the above players. One it sits idle/empty for long enough it closes the server and takes back over the port. I haven't updated the code in awhile so you'd probably have to update the version parameter in the code? ---------------------------------------------------------------------- BruceDaShork · 2023-11-03 13:01 Check out Oracle Free Tier, there’s a good tutorial on how to set up a MC server. Free and proper hosting and no real* risk. ---------------------------------------------------------------------- rjames24000 · 2023-11-03 14:07 i think the only downside of this is due to the SRV record pointing at your home ip means your home ip is exposed i have this problem with my setup and i think the only way to fix it is to buy another remote server or use a free oracle vps and then expose that ip and then on the oracly vps you need to ssh tunnel it on the right port to your home port and this protects exposing your home address.. i really wish there was some cheap easier diy one-stop-shop to point a nice clean address like myminecraftserver.com to your own home network without exposing yourself ---------------------------------------------------------------------- thekrautboy · 2023-11-03 14:12 If you use the default port, then you dont need to specify it, as it is with most software. But using the default might not be wise, changing it to something more random might be a good idea to "keep it a bit more hidden". And no, you dont need to specify the port then either if you make use of DNS SRV records, basically the port number is then saved in DNS and the Minecraft client is able to read that record and use it. Without SRV records then yes, using a non-default port means you need to specifiy it, this should be very obvious. ---------------------------------------------------------------------- rjames24000 · 2023-11-03 14:14 require an openvpn connection for this or wireguard then no need to expose ssh which is nasty.. i have no problem trusting wireguard/openvpn to be on an open port then ssh would be good.. also i dont think you can reverse proxy a minecraft SRV which is why youd use a secondary server.. i mentioned in a higher thread most people would self host the server but use a vps and ssh tunnel vpn'd in to their home network expose the ip of a vps but not their home network i think there might be a tool called bungeecord to deal with this ---------------------------------------------------------------------- Ieris19 · 2023-11-03 14:14 Minecraft client WILL look for the specific default port. If there’s no server there for that IP, connection will fail. If you want to specify the port in the DNS or somewhere else that’s fair, but Minecraft cannot find a client from an ip unless the port is default. Non default ports need to be specified to the client. ---------------------------------------------------------------------- thekrautboy · 2023-11-03 14:15 Fuck Oracle.™ ---------------------------------------------------------------------- thekrautboy · 2023-11-03 14:16 No they dont. Did you even read my comment entirely? Maybe you should go and look up DNS SRV records. ---------------------------------------------------------------------- Ieris19 · 2023-11-03 14:18 I read your comment. My point is that whether you want to specify it within the client or within the DNS is irrelevant, but it has to be specified somewhere. Since Minecraft, when provided with an IP and no port to connect to, it will look at the default port and fail otherwise. If the DNS or the client are providing the port info for a non default port is irrelevant ---------------------------------------------------------------------- thekrautboy · 2023-11-03 14:19 The SRV actually points only at the port. The DNS A/AAAA record is what points at your home WAN IP. But this isnt exactly a problem. The whole "OMG someone knows my IP" thing is widely overblown. ---------------------------------------------------------------------- wh33t · 2023-11-03 14:20 If you already know how to setup an OS (assuming Windows) and you know how to setup a minecraft server, and you know how to port forward, then I suggest creating a Windows Virtual Machine dedicated to your minecraft server. Port forward to that. That will at least sandbox your server into a gated environment. And you pretty much know already how to do this. Virtualbox is super easy. I think Microsoft even has their VM solution as well. ---------------------------------------------------------------------- thekrautboy · 2023-11-03 14:21 > require an openvpn connection for this or wireguard then no need to expose ssh which is nasty.. Who said anything about exposing SSH? > also i dont think you can reverse proxy a minecraft SRV Nobody "reverse proxies a SRV". The SRV simply stores the info which port is used, thats all. Its different to a proxy. And as i mentioned, most gameservers will not work with reverse proxies. ---------------------------------------------------------------------- thekrautboy · 2023-11-03 14:22 > but it has to be specified somewhere. IT IS SPECIFIED IN THE SRV RECORD IN THE DNS omg. Go look up DNS SRV records for Minecraft. Goodbye. ---------------------------------------------------------------------- StewedAngelSkins · 2023-11-03 14:23 not really. use a vpn. if you dont trust your friends to know how to set up wireguard, use some freeware service like tailscale or logmein hamachi or whatever else people use these days. ---------------------------------------------------------------------- Ieris19 · 2023-11-03 14:26 Well, that’s why my comment said if you change it, you gotta specify it somewhere. Which is why I advised not to change it. Specifically to prevent having to setup the SRV record in the DNS! My point is changing it means you gotta tell Minecraft where to find it. And not changing it is just easier. You’re just trying to tell me you can use the DNS to specify it for the user, and I’m saying why even change it when the program can find it just fine if left default with just the IP. I’m not saying you CANNOT make an SRV record. Just that if you change the port, then you HAVE TO. Which is pointless ---------------------------------------------------------------------- Oujii · 2023-11-03 14:27 If you were to do all that, depending on the server, you could just host it at an Oracle Cloud instance directly. I host one like this, using Crafty Controller. ---------------------------------------------------------------------- StewedAngelSkins · 2023-11-03 14:28 ssh with key auth is totally fine to expose publicly. ---------------------------------------------------------------------- rjames24000 · 2023-11-03 14:28 i just worry about a ddos attack to my home ip especially when it comes to minecraft.. id rather a remote instance equipped with a free tcpshield plan get hit that i can disconnect from my server with ease than my own home ip.. ---------------------------------------------------------------------- rjames24000 · 2023-11-03 14:36 this is actually amazing thank you! ---------------------------------------------------------------------- TheWhiteSheep_ · 2023-11-03 14:53 Fuck Oracle. But a free server is a free server. But I recommend regular Backups ---------------------------------------------------------------------- thekrautboy · 2023-11-03 16:08 > I’m not saying you CANNOT make an SRV record. Just that if you change the port, then you HAVE TO. Which is pointless Thats not what you have been saying at all. And no its not pointless. Clearly you dont even want to try to understand it, so this comment chain is pointless. Blocked and goodbye. ---------------------------------------------------------------------- ithilelda · 2023-11-03 16:09 none of the options you provide solves any security issue (well maybe the ddos firewall is useful). the port is bound to the mc server, and any traffic initiated to that port is captured by the server, and nothing would be secure if the server itself is not. I would only concern myself with managing the server itself. a whitelist approach blocking all unwanted person from accessing your server is what you need. also try not to run it as root. ---------------------------------------------------------------------- thekrautboy · 2023-11-03 16:15 > Why not just hosting the server and port forwarding from the router with your friend's IP as whitelist. It is secure and works just fine if your public IP and friend's don't change too often. Even a change every week is a 1 minute operation. Sure thats possible. But it 1) requires the router to have a whitelist option and mostly 2) requires that the friends´ IP addresses dont change too often. Over here its very common for consumer lines to change every 24h with a forced reconnect. So if youre playing with 4 friends, thats changing 4 whitelist entries every evening when you want to play with them. > No need for ddns or whatever everything is already available and free without much work if you use IP adresses. Same applies there, if your own IP changes daily its too much of a bother to tell your friends the new one every evening. DDNS is simple and free and makes that part extremely simple. > For even further security you can also add a specific firewall rule on your machine with the Java executable to only accept connections from your friend's IP. Thats a good option too, but again depends entirely how often those IPs are changing. > You can also setup security inside the minecraft server with nametag whitelist and password if you're paranoid. That should be done either way imo. ---------------------------------------------------------------------- thekrautboy · 2023-11-03 16:15 How is it selfhosted? I assume they use some centralized server to establish the connections and run a tunnel from your MC server to theirs? ---------------------------------------------------------------------- thekrautboy · 2023-11-03 16:17 If they are running Windows Professional edition then Hyper-V is included with that as a Hypervisor for VMs, it only needs to be enabled (and of course the hardware needs to support it but if its a half-modern gaming PC, it does). But VirtualBox (fuck Oracle tho) is probably easier to use for a beginner than Hyper-V is. ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-03 16:31 >I understand it poses a security risk, so without over-complicating things, how do I secure my setup? Your risk is minimal if you have it running only when you play. And only danger is that your world will gets griefed. >buy domain ok, dunno why people are trying to talk you out of it, domains are cheap and ease stuff and teach stuff >Use domain's DDNS option and point it to my WAN IP Err not really, or you used the terms bit wrongly. 1. you create new DNS A record that points your domain to your public IP 2. if your ip is not static, you setup DDNS service like ddclient that will be regularly checking your public ip, and if it changes then it has credentials to change that A record to your new IP address. Ideally you move managment of nameservers for your domain to cloudflare to get this done. >Setup a reverse-proxy service on my PC Reverse proxy is 99% of the time for web site traffic. So minecraft dont need it. But considering there are fucking great map plugins - bluemap and dynmap.. which are websites showing your minecraft world map... well for that you might want to setup one. [I love caddy](https://github.com/DoTheEvo/selfhosted-apps- docker/tree/master/caddy_v2) and [here](https://github.com/DoTheEvo/selfhosted-apps- docker/tree/master/minecraft) is also minecraft docker demployment >port forward 80/443 on my router Only if planning to use that reverse proxy ---------------------------------------------------------------------- SempronSixFour · 2023-11-03 16:32 I have a dedicated server you can share. I run on either Pterodactyl or GameAMP for managing the servers. I have these servers to play with friends... but none of my friends play games :( ---------------------------------------------------------------------- LeAudiophile · 2023-11-03 16:45 +1 for Pterodactyl. Surprised I had to scroll so far to see it. ---------------------------------------------------------------------- DyingLoneliness · 2023-11-03 17:22 About the security. Let's put it this way, there are no free meals. If your intention is 'simplicity' and 'security'. I don't think it's any more simple than renting a $4-8/mo Minecraft gameserver or on-demand cloud service, take a snapshot, and re-deploy a server from the snapshot as needed. Keeping a backup of such a snapshot would probably cost less than 30 cents per month. There isn't a direct, cost-free way to protect game servers in home infrastructure with a simple click. I would personally say that the most reasonable option is a VPS or an on-demand paid cloud service where you pay only for usage. Consumer infrastructure is generally not built for hosting servers. You can also protect your server with 3rd party services such as Cosmic Guard and TCPShield which basically forwards traffic via their protected network to you without huge configurations. I believe that not many of us really cares about your open Minecraft port tho especially if you run it X amount of hours some days. Just to be realistic. There might be free services temporary, because people do not realize that every free service turns into paid one when their load grows and marketing starts to be successful enough. ---------------------------------------------------------------------- acid_etched · 2023-11-03 17:43 That’s how we did it for years and it works fine as long as the minecraft server doesn’t end up with a vulnerability. A reverse proxy would work great (that’s how I do it now) but it would take a little longer to get running than just launching the server. ---------------------------------------------------------------------- coldblade2000 · 2023-11-03 18:41 > The whole "OMG someone knows my IP" thing is widely overblown. It isn't rare for Minecraft servers to get DDoS'd by some kid that's angry they got banned for being a dick. In the worst cases, they'll cripple your home network until they get tired. It absolutely should be a consideration to have in mind when self-hosting. Personally I wouldn't host *and advertise* a public minecraft server without a DDoS shield or proxying. ---------------------------------------------------------------------- Comprehensive_Shame8 · 2023-11-03 19:05 This is the way ---------------------------------------------------------------------- thekrautboy · 2023-11-03 19:57 Yeah sure but there are things you can do about that to mitigate it. CrowdSec, fail2ban etc. ---------------------------------------------------------------------- coldblade2000 · 2023-11-03 20:22 Definitely, I didn't say you shouldn't host a public MC server, I said you do have to keep "sOmeOnE knOwS mY iP" in mind and take a few protective measures. Using CrowdSec or fail2ban is exactly the kind of actions I had in mind. ---------------------------------------------------------------------- thekrautboy · 2023-11-03 21:03 Yes absolutely :) ---------------------------------------------------------------------- XDanielCOL · 2023-11-03 22:36 http://gamocosm.com it runs everything for you on your Digital Ocean account ---------------------------------------------------------------------- Ivrapwn- · 2023-11-03 22:48 Get an Amazon server for free, Get free domain, Setup Amazon server to host Minecraft server. Access Mine craft server by dns name assigned by free dns. Here is a write up on it. https://medium.com/@cedric.lemercierlaos/start-your-minecraft-server- on-amazon-web-services-aws-d35f846a2d7c It won’t require you to open any ports on your end to allow access. Unless for some reason you router doesn’t allow outbound ssh which is unlikely. ---------------------------------------------------------------------- Yankas · 2023-11-04 00:31 You seem to over-complicate things quite a bit. The reverse proxy step is unnecessary, just leave Minecraft on the default port. It saves a lot of work and your players won't have to add the port when typing in the server address. If you really must have (you don't) added insulation against port scanners, at least use a port that is not commonly used and not HTTP/HTTPS of all things, that's really just combining the disadvantages of all the options. It's also going to fuck you over if you want to actually host anything that uses port 80/443 by default, though that might not matter to you. You can also save money by using some kind of subdomain service instead of a top level domain, but that's up to you. ---------------------------------------------------------------------- Guilraw · 2023-11-04 00:46 Well yeah if your IP changes every day it's another story. From where I'm from and with my provider, the IP doesn't change as long as the router is not hard reset. It makes things easier for a simple minecraft server. ---------------------------------------------------------------------- thekrautboy · 2023-11-04 00:55 Yeah thats much simpler then. But even with that, i dont want to imagine tell all my friends my IP constantly, even if its almost static, they just cant remember xD A fixed hostname is just simpler for everyone. ---------------------------------------------------------------------- Lucky-Pie9875 · 2023-11-04 06:20 [LinuxGSM](https://linuxgsm.com/servers/mcserver/) makes it SUPER easy to host your own Minecraft server. I’ve been using it for years to host a server for my friends. Simply install and you’re good to go. Takes the guess work out of it and they have many game servers you can choose from for games and they all work the same so once you do one you can do it for whatever game you want! Highly recommend! ---------------------------------------------------------------------- Rajcri22 · 2023-11-04 06:21 Ill give you the most simple solution. Setup cloudflare zero trust. ---------------------------------------------------------------------- Rajcri22 · 2023-11-04 06:22 I think ops problem isnt the setting up part but more of the how to keep his ports open but secure ---------------------------------------------------------------------- Tim7Prime · 2023-11-04 06:30 Piggy backing off this question. Is there any simple/free solutions for being behind a Cgnat? Since I don't have a public ip but do have the processing power, it's a little annoying coordinating tailscale with everyone. Aka getting access to a public ip while the server is behind a Cgnat. ---------------------------------------------------------------------- alex2003super · 2023-11-04 09:56 You can still use TCPShield when selfhosting Minecraft. Just point your SRV record to TCPShield instead of your IP, and point TCPShield to your IP or dynamic DNS A record. ---------------------------------------------------------------------- rjames24000 · 2023-11-04 10:53 thank you for the great explanation! ---------------------------------------------------------------------- yuri0r · 2023-11-04 16:46 its just your maschine. its like opening you singleplayer world to lan, they take care of networking to make it available trough internet ---------------------------------------------------------------------- thekrautboy · 2023-11-04 17:15 ... ---------------------------------------------------------------------- RoeikiB · 2023-11-04 22:07 Just use radmin Puts u and ur friends in a private lan without port forwarding ---------------------------------------------------------------------- falcorns_balls · 2023-11-05 05:29 At the simplest you can just host a vanilla Minecraft server on a machine, and configure your firewall to forward the port (25565tcp for java or 19132tcp/udp i think for bedrock?) and they can connect to you by public IP which might not even change depending on your ISP. There isn’t much to secure necessarily other than maybe configuring the whitelist for your buddies. Port 80/443 is if you are using some type of webUI management like pterodactyl or mcmyadmin/AMP. But you would likely want to keep access to that local only. If you need to access that remotely use a VPN. If VPN isn’t an option but you need remote access, then use Nginx Proxy Manager and set up a certificate ---------------------------------------------------------------------- a_dsmith · 2023-11-05 15:41 Hey, I and a few others have spent the last 8 months or so documenting the essentials for Minecraft hosting both at home and "in the cloud". I'll recommend you to start here: [https://setup.md/h/self/](https://www.setup.md/h/self/). You are perfectly fine to expose 25565 directly if you don't already host a Minecraft server, if you do already have an internal one for family consider looking into a dedicated Minecraft reverse proxy such as [https://github.com/haveachin/infrared](https://github.com/haveachi n/infrared) ---------------------------------------------------------------------- yuri0r · 2023-11-05 19:11 what? given what op said its the perfect solution... ---------------------------------------------------------------------- thekrautboy · 2023-11-05 19:18 I asked you how it works, how exactly it is selfhosted, you replied with that it does, not explaining anything at all. > they take care of networking to make it available trough internet That is meaningless info.