How To Protect A Minecraft Server

Minecraft servers are public by design. Anyone can find your address, and some players enjoy trying to take servers down. The good news is that most attacks on Minecraft servers fall into a few types, and you can defend against each of them. This guide covers network attacks, bot floods and everyday security.

The Attacks Minecraft Servers Face

• Volumetric DDoS. A flood of traffic that fills the network link to your server.
• Connection And Bot Floods. Thousands of fake players try to join at the same time, which overloads the login process. This is common on Minecraft.
• Exploits And Crashes. Bugs in plugins or in the server itself that can crash it, which is why updates matter.
• Account And Server Takeover. Weak admin passwords, open ports or leaked keys.

For the basics of how these attacks work, see What Is A DDoS Attack?

Step 1: Choose Protected Hosting

A big flood cannot be stopped on your own machine, because the traffic has filled your connection before it arrives. You need filtering in the network in front of the server, where attack traffic is dropped and clean traffic is passed on. Ask your host:

• Is DDoS protection included and always on?
• Does it filter in the provider's own network?
• Can I control my firewall rules and ports?

Linceris.com virtual private servers run behind DataForest.net DDoS protection. See How DDoS Protection Works for what to expect.

Step 2: Hide Your Real Server With A Proxy

If you run a network of several servers, put a proxy such as Velocity or BungeeCord in front of them. Players connect to the proxy, and your game servers only accept connections from the proxy's address. Players and attackers never see the addresses of the back-end servers.

• Set your firewall so the back-end servers accept traffic only from the proxy machine.
• Use the proxy's forwarding secret so that back-end servers trust only the proxy. Do not turn online mode off on a back-end server without this protection, because it lets anyone pretend to be any player.

Step 3: Close The Ports You Do Not Need

Minecraft Java uses port 25565 over TCP by default. Open that, SSH, and nothing else unless you know why.

sudo ufw allow OpenSSH
sudo ufw allow 25565/tcp
sudo ufw enable

Never open your database, RCON or query port to the whole internet. Allow them only from your own IP address if you need them.

Step 4: Protect Against Bot Floods

• Keep Online Mode On. In server.properties, online-mode=true makes the server check each player's account, which stops many fake logins.
• Use A Whitelist for private servers.
• Limit Fast Reconnects. Paper and Bukkit have connection throttling settings, and there are anti-bot plugins that check new joiners. Review the current options for your server software.
• Use Layer 7 Filtering. If your host offers filtering for Minecraft traffic, turn it on.

Step 5: Keep Everything Updated

Many crashes and exploits use bugs that were already fixed. Update your server software, your proxy, your plugins and Java. Use plugins from trusted sources only, and avoid cracked or leaked ones, because they often contain backdoors. Read the update notes before you apply updates, and test on a copy first.

Step 6: Secure The Machine

1. Use SSH keys and turn off password logins.
2. Run the server as a normal user, not root.
3. Add fail2ban for repeated login attempts.
4. Use strong, unique passwords for panels and databases.

Step-by-step commands are in How To Secure A Linux VPS For Your Game Server.

Step 7: Back Up And Prepare

• Back up your worlds, plugin data and configuration regularly, and store a copy away from the server.
• Test restoring a backup once.
• Write down who to contact at your host in an emergency.
• Prepare a short message for your Discord to explain outages.

Signs Of An Attack

• All players time out together, not one at a time.
• The server appears offline in the server list while the process still runs.
• The console fills with login attempts from unknown names.
• Your network graph shows a sudden jump in traffic.

Check first that the problem is not simply lag. See Minecraft Server Requirements And Optimization Tips.

Just Starting Out?

Build the server first with How To Create A Minecraft Server, then use this guide to protect it. See our VPS packages for protected hosting in Frankfurt am Main, Germany.