Selfhosted

A port is not secure or insecure. The thing that can lead to security risks is the service that answers that port.

Use strong authentication and encryption on those services and keep them up to date.

I would use something like wireguard, or another VPN service you can host yourself if your router supports it natively.

From the looks of it Minecraft servers seem to have dogshit authentication, so using some form of private network setup is going to be your best move.

as long you are only forwarding Minecraft's 25565 port from your router to your server machine, it should be fine. Just make sure to keep Online mode on, use the whitelist, and get your plugins from trusted sources. Otherwise I wouldn't worry too much.

I see others recommending VPN solutions like zerotier for your friends to connect to; I don't personally feel like this is necessary, and (in my experience), making your friends do more technical setup than just connecting to the server is often a big turn-off.

Bonus: If you ever take a peek at your server logs while it's running (and exposed to the Internet, if you avoid said VPN solutions), you might notice a lot of weird connections from IPs and usernames you don't recognize. These are server scanners and threat scanners that look for vulnerable servers to connect to and exploit. This is normal and you'll be fine as long as you keep that whitelist and stay up-to-date on developments in the server admin space.

Why is port 22 open? Is this on your router as well or just the server?

This is SSH, which you should pretty much never have open (to the internet! Local is fine) MC is by default 25565. You will have every bot on the internet probing that port.

IP white lists and firewall exceptions will help, but exposing ports on your home router is almost always a bad idea, especially for something as trivial as a game server.

I would highly recommend Tailscale. It's free for up to 3 users, and if you have more friends than that, I would have them all sign up with free accounts and then share your laptop device with their tailnets.

It's very easy to setup and use, costs nothing, and will be far more secure than opening ports and trying to set up IP white lists, protocol limitations, etc.

Tailscale creates something called an "overlay network" it's basically a virtual LAN that exists on top of your real network and can be extended to other people and devices over the internet. It's fully encrypted, fast, and like I said, very easy to set up.

More effort than I would consider. I'd just allow all traffic incoming on that port. I'd only consider whitelist if someone was giving me grief. Even then that would be after blacklisting an IP wasn't solving my problem.

if I were you, I would do IP whitelisting at the firewall instead of or besides the Minecraft server

are you sharing a server solely to play with friends?

You could consider using something like zerotier to create a private network

The simplest way to do this, is to put the server on a private vpn (I use Tailscale, there are others) and expose ports only to the vpn. Then you share access to the vpn with your friends.

With Tailscale, this is as simple as sending them a share link for the host. They will need to have an account at Tailscale, and have the client running, but they will then be able to access the host with a static ip address.

As a general rule of thumb, nothing should be exposed to the public internet unless you want that service to be public access and then you need to keep it up to date. If a vulnerability doesn’t currently exist for the service, one will sooner rather than later. SSH, especially password only ssh, can be broken into fairly easily. If you must expose ssh to the public internet for whatever reason, you need to be using IP white lists, password protected keys, change the default port, and turn off service advertisements and ping responses. I’m probably missing something. When someone scans your server randomly, they should see nothing. And if they fail login they should be ip blocked.

assuming they are not behind a CGN whitelisting your mates place should be OK. But I would also move SSH away from a well known port. In the event something happens to the whitelist, crawlers will not jump on you straight away.

More or less. The biggest issue is if your or their IP address changes, it'll stop working.

I don't know what Minecraft's track record is on security, but I assume it's not great. Ideally, you'd also put public facing services in a DMZ, so that if they do get compromised, they can't reach anything else.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

7 acronyms in this thread; the most compressed thread commented on today has 11 acronyms.

[Thread #959 for this sub, first seen 8th Sep 2024, 20:35] [FAQ] [Full list] [Contact] [Source code]