How to Setup a Minecraft Server Securely: A Step-by-Step Guide

Minecraft’s allure is undeniable, captivating players of all ages with its boundless creativity and collaborative gameplay. For many, the ultimate Minecraft experience involves hosting their own server, a private digital sandbox to share with friends. Imagine crafting intricate worlds, embarking on collaborative adventures, and building magnificent structures together. However, the path to Minecraft server ownership can quickly lead to concerns about online security and network vulnerabilities.

Like the son of the original article’s author discovered, the desire to share a Minecraft server with friends outside of a local network can inadvertently expose your home network to potential risks. Opening ports or using traditional VPN methods to grant access can create pathways for unauthorized access to your broader network.

This guide will walk you through setting up a Minecraft server with a robust focus on security, leveraging a zero trust overlay network. This method, using OpenZiti, ensures that only authorized individuals gain access to your Minecraft server, without compromising the security of your entire home network. Let’s dive into creating your secure Minecraft world!

Understanding the Security Challenge of Minecraft Servers

When you typically set up a Minecraft server to be accessible to friends outside your home, you’re faced with a common networking hurdle: your home network is designed to keep external traffic out. To allow your friends to connect to your Minecraft server, you need to create an exception, often by opening a port on your router’s firewall.

This approach, while seemingly straightforward, introduces potential security vulnerabilities:

Port Exposure: Opening ports makes your network visible and potentially vulnerable to anyone scanning the internet for open ports. Malicious actors could exploit these openings to attempt unauthorized access.
VPN Complexities and Risks: While VPNs offer a layer of security, traditional VPN setups can be complex to configure correctly and might still grant broader network access than intended. Mistakes in VPN configuration can lead to unintended security gaps.
Broad Network Access: Typical methods might grant users access to more than just the Minecraft server, potentially exposing other devices and services on your home network.

The key concern is minimizing the attack surface. We want to grant access only to the Minecraft server and only to authorized players, without weakening the overall security posture of our home network.

Alt Text: A meme image depicting surprise and disbelief, labeled “You did what now?”, representing the author’s reaction to his son’s insecure server setup.

Introducing Zero Trust Networking with OpenZiti for Minecraft

Zero trust networking offers a fundamentally more secure approach. Instead of assuming trust within a network, zero trust operates on the principle of “never trust, always verify.” This means every user and device, regardless of location (inside or outside your home network), must be authenticated and authorized before gaining access to any resource.

OpenZiti is an open-source, zero trust networking platform that enables us to implement this security model for our Minecraft server. Here’s how OpenZiti enhances security:

Micro-segmentation: OpenZiti allows us to create highly granular access control. We can specifically authorize access to only the Minecraft server service, preventing lateral movement to other parts of your network.
Identity-Based Access: Access is granted based on verified identities, not just network location. This means even if someone gains access to your network, they cannot access the Minecraft server without proper OpenZiti credentials.
Outbound Connections: OpenZiti primarily uses outbound connections from your home network, reducing the need to open inbound ports on your firewall and minimizing exposure.
Simplified Security: OpenZiti simplifies secure access management. You can easily add or revoke access for players without complex network reconfigurations.

By using OpenZiti, we create a secure overlay network specifically for our Minecraft server. This overlay network operates independently of your underlying home network, providing a secure tunnel for authorized players to connect while keeping unauthorized traffic out.

Alt Text: Diagram illustrating a Minecraft server setup without OpenZiti, showing Mr. Enderman (a Minecraft character) being blocked by a firewall, representing blocked external access to a typical home network server.

Prerequisites for Setting Up Your Secure Minecraft Server

Before we begin, ensure you have the following:

A Virtual Private Server (VPS): We’ll use a VPS to host the OpenZiti network controller. This acts as the central brain of our zero trust network and facilitates connections. Oracle Cloud offers a free tier suitable for this purpose (as mentioned in the original article and linked below).
- Setting up Oracle Cloud to host OpenZiti
A Computer to Host Your Minecraft Server: This will be the machine running your Minecraft server software. It can be a desktop, laptop, or dedicated server in your home.
Minecraft Server Software: You should have already downloaded and configured your Minecraft server software (e.g., from Minecraft.net).
OpenZiti Desktop Edge Application: You’ll need to download and install the OpenZiti Desktop Edge application on both your server host machine and any client machines (your friends’ computers). Download the appropriate version for your operating system:
- Ziti Desktop Edge for Windows (ZDEW)
- Ziti Desktop Edge for Mac
- For Linux hosts, refer to the Ziti Tunneler SDK (setup is slightly different and beyond the scope of this guide but detailed documentation is available).

Step-by-Step Guide: Configuring Your Secure Minecraft Server with OpenZiti

Let’s walk through the configuration process. We’ll use command-line tools to interact with your OpenZiti network hosted on the VPS.

Step 1: Initial Setup and Naming Conventions

To simplify the process, we’ll define some environment variables. Open your terminal or command prompt and set the following variables. Remember to replace the example values with your own!

export DEVICE_NAME="my.minecraft.server"
export MY_NAME="my.name.here"
export PORT=25565

DEVICE_NAME: A unique identifier for your Minecraft server. This will be used in commands and as part of your server address. (e.g., minecraft.home.server)
MY_NAME: Your personal identifier within the OpenZiti network. (e.g., john.doe)
PORT: The port your Minecraft server uses. The default Minecraft port is 25565.

These variables will make copying and pasting commands easier throughout the setup.

Alt Text: Screenshot of command line interface showing example values assigned to environment variables DEVICE_NAME, MY_NAME, and PORT using export commands.

Step 2: Create Identities

Identities represent users and devices in the OpenZiti network. We need to create identities for:

The Minecraft Server Host Device: This identity will be associated with the machine running your Minecraft server.
Your User Identity: This identity represents you as the server administrator and a player.

Create an Identity for the Host Device:

Run the following command in your terminal. This command creates a “device” identity for your server host.

ziti edge create identity device ${DEVICE_NAME} -o ${DEVICE_NAME}.jwt -a "${DEVICE_NAME}.hosts"

ziti edge create identity device: This is the command to create a device identity.
${DEVICE_NAME}: Uses the DEVICE_NAME variable you defined earlier.
-o ${DEVICE_NAME}.jwt: Specifies that the enrollment token (a .jwt file) should be saved as my.minecraft.server.jwt (or whatever you named your device). This token is crucial for enrolling the host device into the network.
-a "${DEVICE_NAME}.hosts": Assigns the attribute ${DEVICE_NAME}.hosts to this identity. Attributes are used for policy-based access control.

Create an Identity for Yourself (User):

Run this command to create a “user” identity for yourself.

ziti edge create identity user ${MY_NAME} -o ${MY_NAME}.jwt -a "${DEVICE_NAME}.clients"

ziti edge create identity user: This command creates a user identity.
${MY_NAME}: Uses the MY_NAME variable.
-o ${MY_NAME}.jwt: Saves the enrollment token as my.name.here.jwt (or your chosen name).
-a "${DEVICE_NAME}.clients": Assigns the attribute ${DEVICE_NAME}.clients. This attribute will be used to grant client access to the Minecraft server.

Verify Identities:

You can list the created identities using:

ziti edge list identities

Alt Text: Screenshot of command line output before creating new identities, showing an initial list of identities in the OpenZiti network.

Alt Text: Screenshot of command line output after creating new identities for the device and user, showing the updated list with the newly created identities.

You should also see two new .jwt files in your current directory, named according to your DEVICE_NAME and MY_NAME. Keep these files secure! They are your enrollment tokens.

Alt Text: Screenshot showing file explorer displaying two new JWT files created after running the identity creation commands.

Step 3: Create a Service and Configurations

In OpenZiti, a “service” represents the application or resource you want to secure – in our case, the Minecraft server. We need to define configurations that tell OpenZiti how to connect to our Minecraft server and how clients can access it.

Service Configurations:

Run these commands to create the necessary configurations:

ziti edge create config ${DEVICE_NAME}.hostv1 host.v1 '{"protocol":"tcp", "address":"localhost","port":'${PORT}'}'
ziti edge create config ${DEVICE_NAME}.interceptv1 intercept.v1 '{"protocols":["tcp"],"addresses":["'${DEVICE_NAME}'.ziti"], "portRanges":[{"low":'${PORT}', "high":'${PORT}'}]}'

ziti edge create config ${DEVICE_NAME}.hostv1 host.v1 ...: Creates a “host” configuration. This tells OpenZiti how to connect to the actual Minecraft server running on your host machine.
- host.v1: Specifies the configuration type as “host version 1”.
- '{"protocol":"tcp", "address":"localhost","port":'${PORT}'}': Defines the connection details: TCP protocol, localhost address (because the Minecraft server is running on the same machine as the OpenZiti host agent), and the port (using your PORT variable).
ziti edge create config ${DEVICE_NAME}.interceptv1 intercept.v1 ...: Creates an “intercept” configuration. This defines how clients will connect to the Minecraft service through the OpenZiti overlay network.
- intercept.v1: Specifies the configuration type as “intercept version 1”.
- '{"protocols":["tcp"],"addresses":["'${DEVICE_NAME}'.ziti"], "portRanges":[{"low":'${PORT}', "high":'${PORT}'}]}': Defines the intercept details: TCP protocol, the address clients will use to connect (my.minecraft.server.ziti – using your DEVICE_NAME), and the port range (your PORT).

Create the Service:

Now, create the service itself, linking the configurations we just created:

ziti edge create service ${DEVICE_NAME} --configs "${DEVICE_NAME}.hostv1,${DEVICE_NAME}.interceptv1"

ziti edge create service ${DEVICE_NAME}: Creates a service with the name from your DEVICE_NAME variable.
--configs "${DEVICE_NAME}.hostv1,${DEVICE_NAME}.interceptv1": Associates the “host” and “intercept” configurations with this service.

Verify Services and Configurations:

You can list services and configurations using:

ziti edge list services
ziti edge list configs

Alt Text: Screenshot of command line output showing the successful creation of a new service, listing the service details including configurations.

Step 4: Create Service Policies

Service policies control who has access to the service. We need to create two policies:

Bind Policy: Allows the host device (your Minecraft server machine) to host or “bind” to the service.
Dial Policy: Allows authorized users (clients) to connect or “dial” to the service.

Create Bind Service Policy:

ziti edge create service-policy "${DEVICE_NAME}.bind" Bind --service-roles "@${DEVICE_NAME}" --identity-roles "#${DEVICE_NAME}.hosts"

ziti edge create service-policy "${DEVICE_NAME}.bind" Bind: Creates a service policy named ${DEVICE_NAME}.bind with the action “Bind”.
--service-roles "@${DEVICE_NAME}": Applies this policy to the service we created earlier (${DEVICE_NAME}). The @ symbol indicates a service role.
--identity-roles "#${DEVICE_NAME}.hosts": Grants “bind” permission to identities with the attribute ${DEVICE_NAME}.hosts (which we assigned to our server host device identity). The # symbol indicates an identity role.

Create Dial Service Policy:

ziti edge create service-policy "${DEVICE_NAME}.dial" Dial --service-roles "@${DEVICE_NAME}" --identity-roles "#${DEVICE_NAME}.clients"

ziti edge create service-policy "${DEVICE_NAME}.dial" Dial: Creates a service policy named ${DEVICE_NAME}.dial with the action “Dial”.
--service-roles "@${DEVICE_NAME}": Applies to the Minecraft service.
--identity-roles "#${DEVICE_NAME}.clients": Grants “dial” permission to identities with the attribute ${DEVICE_NAME}.clients (assigned to your user identity and any friends you want to authorize).

Verify Service Policies:

You can list service policies using:

ziti edge list service-policies

Alt Text: Screenshot of command line output showing the successful creation of bind and dial service policies, listing the policies and their configurations.

Step 5: Enroll Identities using Ziti Desktop Edge

Now we need to enroll our identities using the .jwt tokens we created.

Enroll the Host Device:

Copy the DEVICE_NAME.jwt file to the machine that will host your Minecraft server.
Install Ziti Desktop Edge on the host machine if you haven’t already.
Open Ziti Desktop Edge.
Click the “+” button (“Add Identity”).
Navigate to and select the DEVICE_NAME.jwt file.
Click the “Enroll” button next to the newly added identity in the Ziti Desktop Edge application.

Enroll Your User Identity (and for Friends):

Copy the MY_NAME.jwt file to your computer (and provide friend’s JWT files to them).
Install Ziti Desktop Edge on your computer (and your friends’ computers).
Repeat steps 3-6 from the Host Device enrollment process, using the MY_NAME.jwt file (or your friends’ respective JWT files).

Step 6: Testing Your Secure Minecraft Server

With everything configured and identities enrolled, it’s time to test!

Start your Minecraft server on the host machine.
Ensure Ziti Desktop Edge is running on both the host machine and your client machine (and your friends’ machines). Ziti Desktop Edge needs to be running in the background to establish the secure connection.
In your Minecraft client, select “Multiplayer”.
Click “Add Server”.
Enter the Server Address: Use the DEVICE_NAME you defined, followed by .ziti. For example, if your DEVICE_NAME was my.minecraft.server, the server address is my.minecraft.server.ziti.
Click “Done”.

You should now see your server listed in the multiplayer server list. It might initially show as “locating server” and then appear online.

Alt Text: Screenshot of Minecraft’s “Add Server” screen, showing the server name and the server address field filled with “berlhome.mc.server.ziti” as an example.

Alt Text: Screenshot of Minecraft’s multiplayer server list, showing the newly added server “berlhome.mc.server.ziti” listed as online and available to join.

Join Your Server! Select your server and click “Join Server”. You should be able to connect and play on your securely hosted Minecraft server.

Alt Text: In-game screenshot from Minecraft, showing the player character in a Minecraft world, confirming successful connection to the server.

Alt Text: Another in-game screenshot from Minecraft, showing the player interacting with the game world, further confirming successful server connection and gameplay.

Alt Text: Diagram illustrating a Minecraft server setup with OpenZiti, showing Mr. Enderman successfully connecting to the Minecraft server through the OpenZiti overlay network, bypassing the firewall restrictions.

Inviting Friends Securely

To invite friends, you need to create user identities for them (similar to how you created your own user identity in Step 2) and ensure those identities have the ${DEVICE_NAME}.clients attribute. Then, provide them with their .jwt enrollment tokens and guide them through the Ziti Desktop Edge enrollment process.

You can manage access by creating new tokens for friends or revoking access by deleting their identities or modifying service policies through the OpenZiti command-line interface. This provides a flexible and secure way to control who can access your Minecraft server.

Conclusion: Secure Minecraft Server Hosting Made Easy

Setting up a secure Minecraft server might seem daunting, but with OpenZiti, it becomes a manageable process. By following these steps, you’ve created a zero trust network that protects your home network while allowing authorized friends to enjoy your Minecraft server. You’ve moved beyond basic port forwarding and VPN complexities to embrace a more secure and controlled approach. Now you can confidently invite your friends to join your private Minecraft world, knowing your network is protected by the principles of zero trust. Enjoy building and exploring together, securely!