I'd like to play Minecraft with my friends, and I already have a server exposed to the internet. My server isn't strong enough to run a Minecraft server instance. However I do have a spare, powerful laptop that can take the load. Port forwarding isn't possible. Both the server as well as the laptop are connected to my Tailscale network. Can I make use of this to create an Minecraft server with an IP public? Yes, and I was pleasantly surprised by how easy it was. The server is extremely user-friendly, and the latency was lower than other "free hosting" services.
Tailscale Halfway to Tailscale
Tailscale is already installed on all my devices. This means that if I create a Minecraft server instance on one device, I can connect immediately to it from the other devices. But my friends do not have Tailscale (yet! Node sharing isn't possible for my friends right now. However, I still have the advantage of Tailscale by ensuring that my laptop will always have a static IP relative to the server, and the server will always have a static IP relative to the public internet. Thus, the connection will be reliable and I won't need to resort to any dynamic shenanigans.
Let's try the theory.
Let's see if Minecraft recognizes it when I enter the Tailscale IP...
It has been an incredible success! We need to make it accessible online.
iptables to the rescue!
Iptables is essentially a way to set the rules of the Linux kernel firewall. In essence, it's very simple. The user creates tables, and packets are routed through the tables. Java edition Minecraft servers utilize TCP port 25565.
NixOS configuration
It was very straightforward to enable IP forwarding and add the number 25565 to the list of open TCP ports for my server:
The rule is created
We can now add the following commands to our firewall setup. Let dest_ip be the Tailscale IP of the server. The first command adds a rule the PREROUTING chain that is where packets arrive before being processed. We basically immediately forward the packet over to the laptop identified by the IP address given by Tailscale. The second command allows the IP address of the packet remain the same, so the server acts as an intermediary.
We have the following setups:
Now we are rebuilding the server configuration, and testing again in Minecraft, this time using the public server IP, it all works just as expected!
Final touches Final touches: A DNS record
For the final touches *chef's kiss* adding an A record to the list gave me a nice URL that I could offer people instead of an IP address.
Performance
It's quite quick! My friends and I had no issues playing on the proxy server that is located on the East coast. The Minecraft server is located on the West coast. I was able pin people through the connection, and the latency was acceptable (77 milliseconds for those who is from New York).
Refer to
This post was inspired by Xe's article about Tailscale, NixOS, and Minecraft. However, my requirements were different. I didn't want my friends to install Tailscale in order to play on my server. Best minecraft servers I wanted to use the hardware I already had, essentially using my server as an router.