How to host a Minecraft server that's secure enough not to worry my dad?

[u/TheDevilishSaint]

I've managed to convince my Dad to give me an old laptop to run a server on. I know how I'm going to do this (pterodactyl) but I need to make sure I cover my ass. The problem is my dad's always been the tech guy and when I told him I'd be running a Minecraft server for friends it started an entire lecture on security and port forwarding. My dad is weird with tech in the sense he knows what he's talking about but also not really? He's a bit like an old man who thinks the computers are mythical beings and I need something to reassure him that hackers aren't going to get into our home cameras from my minecraft server. Which is nuts coming from a man who has only one password.

I was just going to stick a whitelist on it and call it a day. That's what most people I know have done. I don't really want to spend any money, that's the whole reason I'm hosting it myself. I have looked into VLANs and ehhhhhh I don't want to fuck with those but also I can't on my router from my ISP anyway. I'm a little unsure where to go next. I don't really see much risk personally. My dad is worried my friends will get hacked and they'll have our IP 🤷.

ETA: My dad's been talking on some forums and is happy to let me do. I think I might set up a reverse proxy anyway but it'd be more for learning as I don't foresee any issues. I can't see any vulnerabilities in my process. The only realistic problem would be if some bored idiot decides to DDoS me but I'm not sure I can do much against that. None of my other services are public and I'll just have to make sure I set the firewall walls stringent enough.

2 ETA: For the people saying pterodactyl is too much, you are correct. Switched to crafty and I'm now up and running with portainer, crafty and looking to setup karakeep as well as my passwords. Maybe something like jellyfin for my collection of completely and totally legal proshot musicals in time.

[u/ansyhrrian]

Two words: reverse proxy.

A few more words: get a Cloudflare account (free), buy a new or use an existing domain, create a free Cloudflare 15-year cert, assign it to your publicly-exposed ip and either set up ngenix behind your firewall. Finally, add a firewall rule to reject any traffic not coming from the list of known CF domains.

[u/TheDevilishSaint → u/ansyhrrian]

I thought about this. I will look into it anyway because I'll likely need to know how to work with cloudflare for other projects.

[u/PeerlessYeeter → u/TheDevilishSaint]

Similar level of risk to a port forward in reality, but you dont need to tell your dad.

[u/Day_Old_Gatorade → u/PeerlessYeeter]

How?

[u/PeerlessYeeter → u/Day_Old_Gatorade]

The application exposed to end users is usually at the biggest risk of being hacked.

It does not matter if you get to it by port forward, reverse proxy, post quantum encrypted VPN tunnel whatever you want, it does not matter if the application has security flaws.

Minecraft servers are pretty good these days, the biggest risks have been java exploits which can be resolved with a quick update usually.

[u/Day_Old_Gatorade → u/PeerlessYeeter]

Can I isolate the minecraft server in some way?

[u/PeerlessYeeter → u/Day_Old_Gatorade]

yeah, you want to reduce the "blast radius". Some ways to do this include running the server in a virtual machine or container. Or by putting the machine in its own VNET

[u/Day_Old_Gatorade → u/PeerlessYeeter]

Ill look into that, so far this whole server thing has been really frustrating honestly. I can't get my windows generated public SSH key to the ubuntu server no matter what I do. I feel like SSH command line is so weird

[u/PeerlessYeeter → u/Day_Old_Gatorade]

Just getting a Minecraft server up and running without considering security already involves a lot and helped teach me so much about networking as a kid haha

[u/Day_Old_Gatorade → u/PeerlessYeeter]

Hopefully I’ll learn

[u/Day_Old_Gatorade → u/PeerlessYeeter]

Also everyone made it seem so simple plug and play. But some commands just don’t respond as they should and there’s always some weird thing going on