---
title: "Hardening a Minecraft Server With a Firewall | ZCS"
description: "Harden a Minecraft server with a firewall: open only the ports you need, restrict admin access and protect backends behind a proxy."
url: "https://www.zcraftstudios.com/blog/minecraft-server-firewall-hardening"
updated: "2026-10-20T07:16:50.972429+00:00"
source: "ZCraft Studios"
---

> Site index for AI agents: https://www.zcraftstudios.com/llms.txt (full reference: https://www.zcraftstudios.com/llms-full.txt). Every page is available as Markdown by adding `.md` to its URL or sending `Accept: text/markdown`.

1. [Home](https://www.zcraftstudios.com/)
2. [Blog](https://www.zcraftstudios.com/blog)
3. Hardening a Minecraft Server With a Firewall

[ All posts](https://www.zcraftstudios.com/blog)

# Hardening a Minecraft Server With a Firewall

ZCraft StudiosOct 3, 2026Updated Oct 20, 2026

Harden a Minecraft server with a firewall: open only the ports you need, restrict admin access and protect backends behind a proxy.

## In this guide

- [Start With a Default-Deny Policy](#start-with-a-default-deny-policy)
- [Allow Only What's Actually Needed](#allow-only-whats-actually-needed)
- [Securing SSH Specifically](#securing-ssh-specifically)
- [Installing fail2ban](#installing-fail2ban)
- [Restricting Database Access](#restricting-database-access)
- [Checking What's Actually Listening](#checking-whats-actually-listening)
- [This Isn't a One-Time Setup](#this-isnt-a-one-time-setup)
- [Check exposed services before changing rules](#check-exposed-services-before-changing-rules)
- [Official documentation and links](#official-documentation-and-links)
- [Make the network diagram before changing rules](#make-the-network-diagram-before-changing-rules)

## Hardening a Minecraft Server With a Firewall

_Opening the game port is the easy part. What else is left open on the same machine is usually the actual risk._

Most setup guides stop at "open port 25565." A server exposed to the internet benefits from a firewall configured deliberately, allowing exactly what's needed and nothing else, rather than leaving every other port reachable by default.

## Start With a Default-Deny Policy

On Ubuntu/Debian with `ufw`:

```
sudo ufw default deny incoming
sudo ufw default allow outgoing
```

This blocks everything inbound by default. Every service that needs to be reachable gets explicitly allowed afterward, rather than everything being open until manually closed.

## Allow Only What's Actually Needed

```
sudo ufw allow 22/tcp      # SSH — see note below
sudo ufw allow 25565/tcp   # Minecraft Java
sudo ufw enable
```

Add additional rules only for ports actually in use, such as a Bedrock/Geyser port (`19132/udp`), a web map port (`8100/tcp`), or RCON (`25575/tcp`, and only if RCON is actually being used remotely), rather than opening a wide range speculatively.

## Securing SSH Specifically

SSH is the most commonly targeted port on any internet-facing server. A few hardening steps worth doing beyond just allowing the port:

```
sudo ufw limit 22/tcp
```

`limit` (instead of `allow`) rate-limits repeated connection attempts from the same IP, a basic defense against brute-force login attempts.

Changing SSH to a non-default port and disabling password authentication in favor of key-based login are both common additional steps, configured in `/etc/ssh/sshd_config`.

## Installing fail2ban

`fail2ban` monitors logs (SSH, and other services with a configured filter) and temporarily bans IPs showing repeated failed login attempts:

```
sudo apt install fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
```

Default settings cover SSH out of the box. Additional jails can be configured for other exposed services as needed.

## Restricting Database Access

If MySQL is running on the same machine for plugin data (see the MySQL cross-server guide), it generally shouldn't be reachable from the open internet at all:

```
sudo ufw deny 3306/tcp
```

unless it's specifically needed by another machine, in which case allowing it only from that machine's specific IP is safer than opening it broadly.

## Checking What's Actually Listening

```
sudo ss -tulnp
```

lists every port actually listening on the machine. It's a useful sanity check against what the firewall rules assume is running, since a forgotten test service or default install can leave something open that was never intentionally exposed.

## This Isn't a One-Time Setup

Firewall rules need revisiting whenever a new service, plugin, or port requirement gets added. A web map plugin, a new proxy, or a monitoring tool each potentially need their own explicit rule, and the default-deny approach means anything forgotten simply doesn't work rather than silently staying open.

## Check exposed services before changing rules

A Minecraft server may run more than the game process: a proxy, remote administration panel, database, map website or monitoring service can each expose network ports. List every service, who needs access, and whether it should be reachable from the public internet.

### Exposure audit

| Service | Typical approach |

| --- | --- |

| Public game endpoint | Expose only the port required for players |

| Backend behind a proxy | Restrict access to trusted proxy hosts |

| Database | Keep private unless a specific secured connection requires otherwise |

| Administration panel | Restrict access and enforce strong authentication |

| Monitoring endpoint | Bind privately or protect with authentication |

**Avoid locking yourself out.** Before modifying firewall rules on a remote server, ensure you have a working management-console recovery method and a documented way to revert changes.

After making a controlled change, test from an outside network rather than relying only on connections from the server itself. Review logs for unexpected listening services. Firewall rules complement software updates and access control; they are not a substitute for either.

## Official documentation and links

- [Velocity backend security documentation](https://docs.papermc.io/velocity/security/)
- [Velocity Proxy Setup: Connect Multiple Minecraft Servers](https://www.zcraftstudios.com/blog/velocity-proxy-network-setup)

## Make the network diagram before changing rules

Identify which services need public ingress: the game listener, a reverse-proxied web panel, and any separately documented application endpoint. Database services and internal backend ports generally should not be internet-facing. Keep administrative access restricted using supported provider controls and secure authentication.

When modifying firewall rules remotely, preserve your existing administrative connection and document a recovery method first. Test from a separate network after changes rather than trusting only local connectivity.

### Related troubleshooting

- [Why Minecraft port 25565 may be unreachable](https://www.zcraftstudios.com/blog/minecraft-server-port-25565-not-working): Port troubleshooting.

### More troubleshooting

- [RCON security and troubleshooting](https://www.zcraftstudios.com/blog/minecraft-server-rcon-security-guide)

## Continue reading

- [Minecraft Port 25565 Not Working: Router and Firewall](https://www.zcraftstudios.com/blog/minecraft-server-port-25565-not-working)

[ Previous guide Setting Up Automatic Restarts and Crash Recovery](https://www.zcraftstudios.com/blog/minecraft-server-auto-restart-crash-recovery)[ Next guide Setting Up a Custom MOTD and Server Icon](https://www.zcraftstudios.com/blog/minecraft-server-motd-icon-setup)