Hosting a Minecraft Server Without Extra Hardware

I'd like to play Minecraft with my friends and I already have a server exposed to the internet. However, my server is severely underpowered and cannot run a Minecraft server instance. However I have a spare powerful laptop that can take the load. Port forwarding is not possible. Both the server as well as the laptop are connected to my Tailscale network. Could I somehow leverage all this to create a Minecraft server with an IP address that is public? The answer was yes-and I was surprised at how easy it was. Plus the server is playable and the latency was lower than experimenting with random "free hosting" services. minecraft blog

Tailscale: Halfway to Tailscale

I already have Tailscale on all my devices, so of course when I spin up an Minecraft server instance on one device, I can connect immediately to it from all my other devices. However my friends do not have Tailscale (yet! Node sharing isn't possible for my friends at the moment. However I can still take advantage of Tailscale by ensuring that my laptop will always have a static IP relative to the server, and the server will have a static IP to the public internet. The connection will be reliable, and I won't need to use dynamic shenanigans.

Let's try the theory.

Let's see to see if Minecraft can detect it if I add the Tailscale IP...

It's been an enormous success! It's just a matter of making it available online.

Iptables is here to save the day!

In essence, iptables lets you to set the rules of the Linux kernel firewall. It's a simple the concept. The user creates tables and when a packet comes in it is passed through a chain of rules within the tables and you can send the packet to any treatment you want. Java edition Minecraft servers utilize TCP port 25565.

NixOS configuration

It was simple to enable IP forwarding and add the number 25565 on my list of open TCP ports:

The rule of law

Now we can add the following commands into our firewall configuration. Let dest_ip be the Tailscale IP of the server. The first command adds a rule the PREROUTING chain, which is the place where packets arrive prior to being processed. The process basically forwards the packet to the laptop pointed to by the IP address specified by Tailscale. The second command basically lets the source IP of the packet remain the same, which means the server is merely acting as an intermediary.

Now we have the following setup:

Now, we rebuild the server configuration and test it again in Minecraft using the public IP. It all is working just as we expected!

Final touches Final touches: a DNS record

For the final touches *chef's kiss* adding an A record gave me a nice URL I could give people instead of an IP address.

Performance

It's very quick! The proxy server is on the East coast and even though the Minecraft server is located on the West coast, having played for hours today, my friends and I had no problems whatsoever. I pinged people through the connection and latency was not too bad (77 milliseconds for a player in New York).

Refer to

This post was inspired by Xe's article about Tailscale, NixOS, and Minecraft. However, my requirements were different. I did not want to require my friends to install Tailscale to play on my server, and wanted to leverage the existing hardware I had access to, essentially using my server as a poor router.