Isolated Tailscale Access for a Minecraft Server on Unraid Without Port Forwarding
Hi everyone, I’m hosting a Minecraft server with Crafty 4 on my Unraid server. My Unraid server and the rest of my home network are connected through Tailscale. I would like to allow a few friends to access the Minecraft server without opening or forwarding…
Hi everyone, I’m hosting a Minecraft server with Crafty 4 on my Unraid server. My Unraid server and the rest of my home network are connected through Tailscale. I would like to allow a few friends to access the Minecraft server without opening or forwarding any ports on my router. However, I do not want them to have access to my Unraid server, the Crafty web interface, network shares, other devices, or the rest of my home network. Is there a secure way to give my friends access only to the Minecraft server through Tailscale while keeping everything else isolated? Thank you for your help!
已收录讨论
Expand the replies to this comment to learn how AI was used in this post/project.
Tailscale now has grants, which have a friendly UI editor and can combine rules for network layer and app layer.
Thanks for the detailed description! My use is a bit different but I think your suggested route will work for me also 👍
Thank you so much for your detailed help!
Yeah, Playit is probably the easiest option if you just want friends to connect without installing anything
Add their devices to your tailnet. Tag their devices (eg. "tag:minecraft-player") Either tag the server device (eg. "tag:minecraft-server") or define a host alias for it under Access Control > Definitions > Hosts (no idea why they won't let you use the name of the device directly). Add an access policy that says that source "tag:minecraft-player" can access "tag:minecraft-server" and list the TCP and UDP ports that are needed by your Minecraft Version. Please note that for this to work properly you MUST remove the default access policy (the one that says that all users and devices can access anything on the tailnet). And ofc you need to add a rule that grants access to something so things will still work. For example you can tag your personal devices (eg. "tag:owner-boss") and add a rule that says that tag can connect to anything. Don't make the mistake of making a rule that says your user can connect to anything; because all the devices that you approve into the tailnet are associated with your user. You can ofc ask people to make their own tailnets and interconnect them to yours but it's MUCH simpler (for them) to just pass you the approve link when they first try to enable tailscale, and you approve it on your tailnet as if it were your devices, then just use tags. Hot tip: you can define tests under Access controls > Tests that say what should or shouldn't be possible, and if you try to write a rule that contradicts a test you'll be told about it. For example you can add a test that says tag:minecraft-server can't access port 445 (network shares). These tests don't have to cover everything, just enough to give you a warning in case you ever make a mistake.
This is the exact purpose of Tailscale ACLs
For additional help with running a Minecraft server, please consider crossposting in r/admincraft (following their rules). I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
If you want to give them access without a client, you’re going to need to use something other than Tailscale. I’ve used Pangolin and Cloudflare as they allow for client less connections. Playit.gg is also a good solution. Even their free tier works well.
I use playit.gg as a tunnel service to give my friends access without portforwarding or sharing tailscale access
I use ZeroTier instead Might take a look
Make a different tailnet for your friends. Share only the minecraft server in it.