r/ComputerSecurity • u/yes__300 • 2d ago
I port-forwarded my minecraft server and an unrecognised account joined.
If they joined the server, that must mean they had my IP, and now I'm afraid my IP got leaked. Before this, I sent the IP to my brother on Discord, but neither of our accounts got hacked. Is this something i need to be worried about or just ignore it?
5
u/Workadis 2d ago
Port forwards are always risky. Millions of scans from probes go out at all times of the day. If you are sharing with friends use something to protect yourself or create a white list
4
u/maxwell321 2d ago
No need to worry, just add a whitelist to your server and/or change the default port from 25565 to something else. There are bots running scripts online that crawls the entirety of the internet and tries every single ip address combination and attempts to find minecraft severs running. No biggie
2
2
u/Chownio 1d ago
Just going to be direct here. You shouldn't host services from your home without understanding the implications and protecting your network accordingly. This event may not be anything to worry about (a bot scanned IP ranges, found yours with an open port, and then someone used that info to connect to your server, or you accidentally posted your IP somewhere public and aren't aware of it), but without security hardening the next person that finds it might not be in a gaming mood and might have an exploit for your hosted service. Are you aware of what account the Minecraft server is running as? What access would that account have to your network if it were compromised? What files?
Look into Minecraft server hardening to see what others do and also look into getting a next gen firewall set up. Opnsense and Sophos Home are both good options.
2
u/dariusbiggs 1d ago
The port forward you created opened a port on the public side of your Internet connection directly to your Minecraft server.
You have now experienced something most normal users of the Internet never see or realize. At any given point in time there is some malicious traffic to every IP on the Internet, scanning for common insecure, vulnerable, or just open ports. This is not, one or two request per hour or day, this can easily be closer to 50+ attempts per second depending on various criteria (that's what I see coming daily to the low use systems I maintain around the world for various reasons).
Opening an insecure port to Minecraft, that's what's going to happen. Always set a password on the server and client connections if it is supported. If you can, restrict the inbound traffic to the port forward to the public IP address of the others you want to connect (or the network range of their Internet provider).
1
1
u/xenophod 1d ago
get a free account from playit.gg and create a tunnel to your Minecraft server. That way you don't have to punch holes in your router with port forwarding.
1
1
u/MistrMizer 1d ago
You should worry about it, enable your whitelist, and then promptly stop worrying about it
1
u/the_swanny 21h ago
There are hundreds of bots that are constantly scanning every IP for common open ports (80, 443, 22, 21, 25565 etc). Your IP cannot leak, because everyone knows it already exists. Someone simply saw the port was open, and attempted to connect.
1
u/InteractionSoft14 33m ago
Port forwarding is no longer considered good practice for many use cases. If you decide to open a port you need to secure it. Alternatively you can setup tailscale so your friends can connect without the need for port forwarding and ensuring your server is only accessible by the people you want
21
u/plump-lamp 2d ago
Someone just scans public facing IP addresses and did a port scan. It's not rocket science. Anytime you leave something public it'll be found (and eventually hacked)