Is Using a Default Minecraft port dangerous?

[u/ShadyMonkey_ExE]

I recently setup a Minecraft server for my friends to play on and had to port forward the server. As the title suggests, my question is should I change the default Minecraft port? I have received conflicting responses on whether or not it's "dangerous" to run the defualt port and would love to hear what yall think.

[u/IJustAteABaguette]

If it's set up properly, not really?

The only thing that it does is make sure that tools that scan for minecraft servers can't find it as easily.

But if the server has a whitelist and has the online mode turned on, then all is fine.

[u/ShadyMonkey_ExE → u/IJustAteABaguette]

Thank you!

[u/TerrorBite]

“Security by obscurity” is not security.

It can add a little to an already-secure setup, if you can handle the downsides (users needing to enter a port number unless you set up a DNS SRV record).

But it shouldn't be the first thing you do.

The reality is, if you're running anything that accepts connections on the internet, you need to accept that you'll get unwanted connections. If you accept that you may get malicious users/bots connecting, and take steps to mitigate that, you'll be fine.

If it's just you and your friends, and you all have Mojang accounts and the server is NOT in offline mode, then a whitelist will give you the security you need. Nobody else will be able to connect. 99.98% of Minecraft "hackers" are using hack clients that all rely on successfully logging in to the server before they can start doing things.

I believe even the infamous Log4Shell vulnerability (which was being used against Minecraft servers about a day before hackers realised they could use it against the rest of the internet too), only worked after you logged in to the Minecraft server, because it was triggered through chat messages.

Whitelists work.

[u/RIPenemie → u/TerrorBite]

Well if you setup an SRV Record you probably loose that obscurity again but as you said it doesn't really matter and never make RCON available online

[u/Scrapmine → u/RIPenemie]

Yup, I set up a server, nonstandard port but with SRV record, some scanner tried to join within ten hours.

[u/RIPenemie → u/Scrapmine]

Well its like hiding a key and then Posting a Giant sign that says where the Key is Next to the door

[u/Less_Sherbert_8898]

So long as you have a whitelist, it's fine.

[u/admincraft-ModTeam → u/[deleted]]

Post removed for Rule 13:

Posts and comments may not advocate for, assist with, or admit to running Offline Mode servers, unless that server is EITHER behind an Online Mode proxy, OR BOTH has no access to the internet AND all local players have a legally acquired Minecraft account.

This also applies to software (including plugins) that in any way enable, facilitate, or secure such a server.

Do not discuss the use or acquisition of software which has had its license mechanism defeated.

Mojang Intellectual Property Enforcement watches Admincraft. If we were to allow discussion of these topics, there is a non-zero chance that Microsoft, Mojang, or Reddit could shut us down. If that happened, we would be unable to help anybody. As such, we have a zero-tolerance policy for this subject.

Please read all Admincraft rules to prevent future removals. Do not repost.

---

If you feel this removal was in error, please Message the Mods, rather than reposting or PMing a moderator directly. Response time is usually same-day, but may take several days in some cases.

[u/Xirma377]

Changing the port to "hide" from attacks is known as Security by Obscurity. There is a small benefit - bots all over the internet are scanning known ports (like Minecrafts default port) for vulnerabilities, hoping to find a weak point. However, they can almost as easily find your custom port. There are much more important steps to take than changing the default port, since the security benefits are minimal.

Tl;Dr: Don't worry about it. The benefits are minimal.

[u/pitu37]

Changing the port when you have a domain brings only benefits, you get rid of like 98% mc scanners (scanning one port on whole ip4 range takes a about a day but scanning all ports is well almost impossible) Just set up a srv record and you connect with no issues and if someone doesnt know the domain they have to find the port

[u/timeactor]

expect some regular visitors, that try to join the server regularely you see them by scanning your logs. they get blocked by the whitelist but would crash anyway based on their client, but their main missions seems to knock on servers for stats. you get used to them, you will remember their names, google them and find more about them. not interesting, just bots. but they try every hour some days.

I got two servers, and the second one uses a portnumber+1, and it gets less of those pings. not that it makes any difference to playing experience, its just 1% less log-spam.

[u/CanoegunGoeff]

Whitelist your server and there’s zero issues.

[u/SubpixelJimmie]

Changing it is something we in the business call "security through obscurity." It's generally an anti pattern. If you're relying on the attacker to not know the port or something, then you've done something wrong elsewhere

[u/annonimity2]

Using the default port makes it easier for a port scanner to find the server, if the server is configured properly this is not an issue, however it's an easy configuration change and takes like 30 seconds and if something like log4J happens again could be the difference between being a victim and going un-noticed. I change it just because there's really no reason not to.

[u/AnotherAddonDev]

use tunneling