How do I ensure a local Minecraft server (with admin wrapper) is inaccessible to the outside?

Question

I'm running a Minecraft server on my local network for myself and my roommates. I would like to simplify some of the admin tasks by using an admin wrapper.

Unlike most of the questions, tutorials, and other things I could find, I want to make sure the server is not accessible outside my local network.

If I were to run Minecraft using an admin wrapper, what tools/techniques could I use to verify that the server is not accessible outside the network beyond trying to connect from a client outside the network?

Other potentially relevant information:

• Port-forwarding and related are turned off in the router's admin panel.
• I am running the latest JRE.
• I am using the latest official server JAR from Minecraft.net
• The "server" is an older Win10 Pro machine re-purposed for this and running Kodi on the main TV, and has all the patches/updates.

Side note: I'm planning on using Minecraft Server Dashboard, though for those that use other admin wrappers I'd appreciate more general purpose answers.

Answer 1

If the server is running on a LAN address per RFC 1918 and you are not using NAT RFC 2663, this shouldn't even be an issue. NAT is what does the port forwarding.

To increase the security you can simply block all externally incoming connections.

If you would like to verify, you can use nmap to scan from the public network.

Answer 2

I do not use minecraft(mc) so my answer is limited to the os and system layer enforcement.

The strategy for limiting network access should be on 2 levels server and border router.

• Host system (mc server), you can limit what IP address have access to the service by adding a firewall that limits port to an allowed subnet (https://www.cm3solutions.com/block-ip-address-ip-range-using-windows-firewall/)
  • Note that if you limit that you limit the application to a given local subnet the server will not be able to find updates. Your may want to whitelist the update server Ip as well.
  • I do not know if windows firewall is stateful (likely is) but if it is you can block incoming rules based on ip and not bother as much outgoing rules.

On the network Layer (router or dedicated firewall): - Most default firewall are block all incoming and allow outgoing. So by default nothing should be able arbitrarily contact your server.

• Check your firewall option on the router. Setting you should be looking for are:

  • Deny all on incoming
  • This server Should not be in the DMZ
  • Allow outgoing.

• If paranoid you can deny the server the right to communicate out to internet explicitly base on port or host entirely (will cause other issues like)

  • Some firewall can detect a the application and take action for you.
  • If you application is using a non standard port, you should block explicitly

• Universal Plug and Play can allow servers to advertise themselves on the web without you knowing and the UPNP exception may not show in the router. You can likely turn UPNP of but there is a chance it can break other things. (https://www.howtogeek.com/122487/htg-explains-is-upnp-a-security-risk/)

• "Port-forwarding and related" is a bit broad, but it may not be needed to entirely disable these items. If related is firewall, that should immediately be turned back on!!

Clear failure in my answer

• You should determine what application controls exist.

  • Does the admin panel have a login page to enable? (link to the admin wapper in use and I will try update my answer)
  • Does minecraft server have user login controls or allow access on certain networks only?

• Your server runs Kodi, I did not take this into account with my answer.

Answer 3

"Port-forwarding and related are turned off in the router's admin panel."

Unless one of your friends associates your server's IP on the LAN with an onion service, you should be fine. It would be a painful thing for someone to connect that way because of the ping though.