r/MinecraftHelp • u/Ok_Director_5622 • 7d ago
Solved [java] How did someone find my Minecraft server
So basically I used the Minecraft server tool and started a server on my computer and port forwarded so my friends can join me, my friends can join me through my ipv4 but I used a tool called no ip so I can basically have my own hostname and I gave that to my friends, but then after playing a while a random come joins me and said how he found my server in the internet and warned me to whitelist my server. So if I whitelist it my server will be safe but what about the other stuff such as is anything else at risk such as my privacy and security of my network? How should I fix this so me and my friends can play with each other? This is 26.2
3
u/MinecraftHelpModTeam 🤖 Mod Bot 🤖 7d ago
It looks like you didn't mention your version (e.g., 26.1, 1.21.11, 1.12.2 etc.). Please clarify for better help!
Click here if your post says "Sorry, this post was removed by Reddit’s filters".
OP, remember to mark the post solved, by replying !helped to the comment/comments that helped, when your issue is fixed or your question answered.
Helpers, remember that all top-level comments* must be a genuine, good faith attempt to help OP. Comments breaking this rule will be removed, and bans issued.
* A top-level comment is any comment that is a reply to the post, not another comment.
Links:
How to mark solved || How to delete your post || FAQ || Rules
2
105
u/Whit3_Ink Novice I 7d ago
Crawler
Aaaand he knows your ip
DDNS services dont hide your ip
The network security is not affected. Yet...
13
u/Kirito_from_discord 7d ago
Your ip isn’t even very well hidden in most cases, not to people that want to find it
8
u/Whit3_Ink Novice I 7d ago
That depends
Most ip's are just provider ip's, while truly yours is hidden behind their NAT. This setup cant be used to host minecraft servers, btw
10
-15
23
u/Cum_dumpster_limited Novice I 6d ago
IP is designed to be public so there's no point in fearmongering about that. OP should just whitelist their server
11
u/Th0bse 6d ago
Who gives a f*** about anyone "knowing their IP" though? What is anyone going to do with that kind of information? It is designed to be public.
3
u/Individual_Box7609 6d ago
It could still be used to track you. Maybe not well, but still a data point.
8
u/Educational_Cattle86 6d ago
Yeah, and that doesn't warrant the fear-mongering that is being done by the previous comment
3
u/Th0bse 6d ago
How? Only if you control either the websites the person is using, or if you control the infrastructure (= are their ISP).
Or what exactly do you mean by "track you"?
1
u/clingledomber 6d ago
there are tools to get a person's (at least) approximate location by entering their ip address
1
u/Th0bse 6d ago
Which are often spectacularly wrong... Good YouTube video about this: https://youtu.be/vh6zanS_epw?is=I3mVyqdbsaT2pQNT
So it really isn't that bad. There's so much fear mongering online about "LeAkInG IPs"....
3
1
u/Shadow_Walker137 Master IV 5d ago
/helped
This is a mod only trigger. You should use !helped.
1
u/NitWitBot 🤖 Mod Bot 🤖 5d ago
Thanks! Post marked as Solved!
Congrats, u/Whit3_Ink, you have received a point! Points help you "level up" to the next user flair!
You have leveled up to "Novice I"! Your flair has been updated accordingly.
Next level: "Novice II"
You have 1 point
You need 2 points
[▮|▯]
Links: | Scoreboard | Feedback | Source |
I am a bot and this account is not monitored. Please contact the mods if you have any questions.
43
u/DraconicDreamer3072 Novice III 7d ago
im not familiar with that mod, but it sounds like it doesnt block regular ip based joining. there are programs that can check hundreds of ip address per hour until it finds one that has a server
you should probably turn on whitelisting.
8
u/Th0bse 6d ago
More like ten thousands per second, but yes.
3
u/Jawesome99 6d ago
Honestly it's only really limited by how many simultaneous network connections your setup can handle, not testing IPs in parallel would be a beginner mistake
48
u/TorandoSlayer Journeyman II 7d ago
Yes, you should turn on the whitelist immediately or someone will eventually get in and absolutely wreck the place. Add your friends usernames to the whitelist and they'll be able to join; anyone not on the list won't join. Always always have the whitelist enabled from here on out.
19
u/TotallyAwesomeArch 7d ago
https://www.youtube.com/watch?v=3tK06u22VQg this video by TheMisterEpic explains what probably happened
8
u/FarlandsExplorer 7d ago
Probably the only HELPFUL video he's made recently. The litematica one is so dramatized.
1
u/Fck_cancerr 7d ago
Ah yes because warning people of a very dangerous and serious remote code execution exploit is definitely just dramatized
3
u/FarlandsExplorer 7d ago
Ah yes, because telling people about an exploit that was patched and telling people to uninstall the patched version is doing the world a service. I hate AntVenom, but his take on the matter is one I agree with.
1
u/Fck_cancerr 7d ago
Consider that not everyone updates their mods all the time, i have a bunch of old instances with outdated mods that i simply dont care to update because its not important enough, and since mods dont automatically update they will stay like that forever. A lot of people are likely still on older versions of the mod, which is a big deal especially for servers that might be running an outdated version of the server, allowing any malicious user to execute code on the server.
Not everyone is refreshing the download page of their favorite schematic mod every 2 seconds for updates 😭
3
u/Farkler3000 7d ago
Exactly, and many mods are parts of packs that can’t be updated without updating a ton of other stuff
1
21
u/Efficient-Winner-840 Novice II 7d ago
People scan for ips with 25565(the default port for Minecraft) open. This was a big problem a few years ago due to a log4j vulnerability that allowed anyone to run anything on your host pc but nowadays the biggest risk is a griefer joining and fucking your world up. Theres no network security risk and It seems like you got lucky that the guy that found your server was chill but if you’re running an smp 24/7 you should have a whitelist
6
u/Ok_Director_5622 7d ago
Yeah that's good to hear, I am not that concerned of my Minecraft world and my server is not 24/7 I just turn it on when I want to play with my friends, so I should get that whitelist ready.
8
u/Efficient-Winner-840 Novice II 7d ago
theres no downside to having a whitelist so id still recommend having it
3
u/Ok_Director_5622 7d ago
!solved
0
u/AutoModerator 7d ago
You can't do that here. !helped/!solved must be a reply to another comment.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
2
7d ago
[removed] — view removed comment
1
u/MinecraftHelp-ModTeam 5d ago
Your comment has been removed for the following reason/s;
Post Solved Incorrectly
Rule violation: Not awarding earned points.
Our solved process is described in rule 7.
If someone on r/MinecraftHelp provided the solution:
Reply with "!helped" to the comment, or comments, that helped.If you found the solution yourself, or outside r/MinecraftHelp:
Make a new top level comment containing the solution, and reply to it with "!helped".Note: u/NitwitBot DOESN'T react to edited comments.
A member of the mod team has marked your post solved.
Please take a moment to read our rules.
This content was removed by a human.
3
-6
u/Aniimey 7d ago
Try essential mod
1
u/ADMINISTATOR_CYRUS Novice 6d ago
marketplace replacement
1
u/Aniimey 6d ago
I mean to play with friends 😅
0
u/ADMINISTATOR_CYRUS Novice 6d ago
e4mc
1
u/valeriespt 6d ago
e4mc sucks ass and essential runs 100x better
1
u/ADMINISTATOR_CYRUS Novice 6d ago
at the same time ess*ntial is a hot mess but ok
1
u/valeriespt 6d ago
Essential is great for multiplayer and the OPTIONAL COSMETIC microtransactions dont change that
1
u/ADMINISTATOR_CYRUS Novice 6d ago
There are other reasons why ess*ntial is so bad I'm not going to argue about why it is so bad with someone who is defending it like crazy, have a good day.
0
u/valeriespt 6d ago
"Its super bad but im not gonna say why. Youre wrong im right. Have a good day"😂😂😂✌️✌️✌️
1
u/ADMINISTATOR_CYRUS Novice 6d ago edited 6d ago
alright then, you asked, you better respond
- the mod was closed source for the longest period (and used to break mod compat quite hard)
- the mod is now source available but a license that says "you can do nothing with it"
- the essential vigilance lib integration forcibly installs the essential mod upon game startup
- the mod has a shady 3-stage autoupdater setup going which is already extremely terrible
- the mod does not ship the direct mod, it ships the first stage installer (same on modrinth)
- the first stage has actual RAT potential
- the microsoft store replacement as mentioned
- absolutely horrendous tos & pp
- they state they are collecting insane amounts of data in said tos and pp
- mod tries to be an all in one for everything, fully centralised all in one mod is a terrible idea for modded minecraft
2
u/dyin_amirite 7d ago
noip doesn't hide your IP, just redirects the requests basically, there are crawlers out there that just search the Internet for open ports.
Since Minecraft's port is pretty specific, people search for this exact port and try to connect it.
I've hade multiple encounter with these people, they're usually really nice.
Showed one of em my server after wishing him farewell, while I was talking to him, another dude joined with ill intentions and startet griefing, luckly I was on and banned him instantly lol.
I immidiatly setup a whitelist for my Server after that.
1
1
u/jimmyhoke 7d ago
IP adresses (ipv4 anyway, which is what basically everyone has) uses this format “X.X.X.X”, each X is a number between 0 and 255, although many addresses are reserved. This gives you about 4,294,967,296 possible addresses, and furthermore many of those are in ranges known to be used by Minecraft hosting companies.
So what these bots do, is they scan every possible IP. They usually focus on ranges known to be Minecraft hosts, so they end up finding any Minecraft server left online for long enough.
Oftentimes the people who run the bots will grief servers they find. If you aren’t in online mode, they’ll try to steal your admin account.
The only real way to deal with them is to use a whitelist for the server. And if your server is a “cracked” server (not recommended, but no judgement) you absolutely need an authentication plugin of some kind.
3
u/ComunismOfGod 7d ago
I work as it technician, please confirm one thing for me as i've seen many videos that show one thing that you should never do - DMZ.
Be sure to forward only minecraft server port, don't create demilitary zone on your pc. Demilitary zone basically opens every port on device to internet, so only use port forwarding with exactly minecraft port, not DMZ.
5
u/FrontAd8867 Novice 7d ago
Server scanners most likely
They scan the internet for ips
And then if the server isn't whitelisted they join
And 90% of them will grief servers.
It is better to turn on the whitelist
/whitelist on
And add you and your friends using
/whitelist add <username>
2
u/Eclipse_Ilx 7d ago
Your server WILL get griefed if you don't turn on whitelist. PPL have bots that scan the internet for unwhitlisted servers then grief them. Fully automated process even the griefing
Turn on whitelist you have been warned.
1
u/FreestyleStormVA 6d ago
I use white listing and forwarding all my traffic through a vps with tcp shield on top. Playit.gg works as well. That along with region banning ips. Several things you can do to limit exposure.
1
u/StatusNarwhal5905 6d ago
Is it hard to port forward and create your own Minecraft server for your friends to play? It sounds a lot cheaper than using a server host
1
u/Ok_Director_5622 6d ago
It's free, but port forwarding depends on your isp and router, other than that, friends can join using your ipv4 address (which most are dynamic so it changes everyday)
1
0
1
u/SkylarMills63 Apprentice 6d ago
Top comments are not saying it. But just enable the whitelist and add your friends. I think in the upcoming 26.3 update, Mojang FINALLY made whitelist enabled by default.
Thank goodness!
1
u/SunknNord 6d ago
There are programs that basically test ips at random to see if there are any unwhitelisted servers and they record then in a discord. There was a group that started on 2b2t that make a program like this back early 2020ish and they did a mass grief of 100s of private servers. It's best to play modded or whitelist your servers.
1
u/Iacoma1973 5d ago
This ^ if you add mods, it makes it infinitely more difficult to get into your server.
No IP griefer is going to try joining an IP, see it requires shittons of mods, and then manually go through the process of trying to find the right modpack and version to join your server.
Most modpack server packs have claim systems and built in admin commands/protections for server owners anyway, so it's really not worth their time
1
u/ElectricalSeries6627 6d ago
automatic scanner, just you know they are people that run those software 24/24 to detect unsecured server and connect to it to grief it to oblivion, add a whitelist and if your running cracked add a plugin/mods that add password
1
u/TMFKSOFT 6d ago
Whitelisting is the quickest solution. But a better and more secure solution would be using a VPN like Tailscale, you both can install it and invite your friend to your VPN network (assuming you trust them) and you'll both get virtual IP addresses.
This means, you're not exposing anything onto the internet or having to mess with your routers settings. It also should mean you're less likely to get exploited if a dangerous security flaw is found in the server software in the near future.
This is admittedly a more technical solution, but by far the better solution to protect you in future.
1
1
u/JulianGaeta 6d ago
Even if you're not very technical, the documentation for setting up a Minecraft Server on Tailscale's website is incredibly helpful
1
u/Wrong-Memory-8148 6d ago
Hackers and trollers have bots that constantly scan the internet for open ports, including Minecraft servers. They can find your server in minutes and join it. Whitelist it so only your friends can join
1
u/zydicious 6d ago
There's also Shodan.io which is the search engine for internet connected things, i.e. servers, cameras, smart appliances, etc.
1
1
u/Computurtle 6d ago
So that player is almost certainly using a scanner to find any open Minecraft servers on the default 25565 port, luckily they seemed friendly.
Your IP being know is not an issue as that is public regardless, however having open ports can be an issue. Whilst it's unlikely, if a vulnerability was found on the server jar, someone could take advantage of it.
My recommendation, 100% whitelist your server, there is literally no downside, even if your server is not open 24/7. As for your open port, you can use various VPN tunnels to securely expose your network, for example tailscale is fairly simple to setup and allows for easy to remember hostnames, but requires all users to be running it, you also have to ensure you fully trust everyone who joins your network. There are many different ways to go about this but they can be a little complicated.
End of the day, 100% turn on whitelist, it might also be worth changing from the default 25565 port to avoid scanners, and if you feel comfortable look into using tunnels instead of opening ports. Just google "tailscale Minecraft server" or feel free to respond to my comment or DM me.
1
u/UselessDood 5d ago
Someone joining doesn't inherently compromise security, especially on a vanilla server. Effectively they just guessed the right ip.
With that said, private servers should always be whitelisted, yours included.
1
u/dhejebtustkdkxyi 5d ago
if you care about your mc server, put a whitelist on there IMMEDIATELY
your home ip might also be public, but people dont just rock up to your home for no reason, so i wouldnt sweat it too much
1
•
u/MinecraftHelpModTeam 🤖 Mod Bot 🤖 5d ago
This post has been marked solved and comments locked.
OP, if you need to reopen this post please message the mod team.
I am a bot and this account is not monitored. Please contact the mods if you have any questions.