← Back to Forum
1
Setup & Configuration
LocaltoNet Minecraft tunnel 24/7, best security and performance habits
I haven't opened this up yet because I'd rather get the boring parts right first. The plan is a small vanilla server at home through LocaltoNet, mostly for a fixed group, and I'm trying to think through hardening, who can actually join, and what adds avoidable latency before I make it a 24/7 thing.
If you've done this, what would be on your checklist? I'm especially wondering about basics like whitelist only vs anything else, rate limits or IP filtering on the tunnel side, DNS choices if I want a nice hostname, whether putting other self hosted stuff on the same box is asking for trouble, and any obvious LocaltoNet settings that are worth changing from default.
Comments (7)
Turn on the Minecraft whitelist and leave online-mode enabled, that's the one thing I'd treat as non-negotiable before worrying about tunnel tweaks. For a small friends-only server, that cuts out most of the dumb stuff right away, and I'd trust that more than trying to get fancy with extra layers on the same little box.
Yeah, whitelist plus keeping auth checks on is absolutely the baseline I was planning around, so that helps. My main follow-up is whether you'd also bother using LocaltoNet's IP allowlist for a small fixed group, or if that just turns into annoying breakage when friends' home IPs change, because I'd love the extra lock-down if it's not a constant maintenance mess.
Skip the LocaltoNet IP allowlist unless every person joining has a stable address, in my experience it turns into random lockouts fast and you end up doing admin work for no real gain on a small friends server. I'd put that effort into making the tunnel point only at the Minecraft port and keeping anything else off that same machine if you can, that was the bigger win for my own setup.
Yeah, same here, the allowlist sounds nice until one friend’s ISP rotates their address and suddenly you’re doing support from your phone. If you keep other stuff off the host, would you also split it at the network level with a separate VLAN or even just a dumb second box, or did just keeping the tunnel mapped to one port feel like enough?
I wouldnt bother with a VLAN just for a small friends server unless you already have the gear set up. Separate box is nice if you've got random other services running, but if it's just Minecraft on that host I'd spend the time on OS updates, a basic firewall, and making sure the tunnel service isn't running with more access than it needs.
I think that's the right priority order. One little thing I'd add is watch backups and logs too, because with kids hopping on and off our server the boring stuff that saved me most was having automatic backups, enough disk space, and some way to notice if the box starts pegging CPU or memory before it turns into mystery lag.
Yep, and I'd add egress too, not just inbound. If that box is exposed all the time, I want the tunnel service and the game process as locked down as practical, dedicated user, minimal permissions, and outbound rules tight enough that a compromise can't freely talk to everything else on the LAN.
Please log in to post a comment.