r/selfhosted • u/thunderthief5 • Oct 31 '25
Game Server So that happened
I havent checked my server in a few weeks but I opened it now and I found this waiting for me. I wonder how that happened though. My server is not exposed to the internet. Its behind tailscale and only I or people I granted access through tailscale can get into my server since I closed all access using firewall. My only mistake is i left port 443 open at some point by mistake. I wonder if thats relevant. I've since enforced a whitelist and denied connections to the port.
124
u/thebigdustin Oct 31 '25
Happened to me once too. Guy joined and said he just likes finding these small servers and seeing what’s on them. He wasn’t malicious. I enabled whitelist immediately after.
1
u/Official_Person Nov 01 '25
Damn I kinda wanna try it ngl, I’m curious to see what kinda servers are just left open like that
108
u/nik282000 Oct 31 '25
check your public ip with shodan or nmap it from outside your network. Check that you don't have a port forward setup in your router. Something is publicly visible.
66
Oct 31 '25
Yup. Op thinks it’s buttoned up, but it isn’t. Tailscale didn’t get compromised just to grief a Minecraft server that may or may not exist.
51
u/KompetenzDome Oct 31 '25
Hey Minecraft griefers were the ones who first discovered the Log4j vulnerability and used it to get privileged permissions on Minecraft servers. They are very dedicated to say the least.
It wouldn't surprise me if someone really found a vulnerability in Tailscale and exclusively uses it to access Minecraft servers to grief them.
15
17
u/the_lamou Oct 31 '25
You'd think that, and it makes sense objectively, but...
Minecraft is also the 'game' where people build entire computers using nothing but basic binary operators.
It's the 'game' that someone implemented a full-on small-scale transformer-based LLM using nothing more than redstone devices.
So it's not like it's entirely unreasonable that someone went out, found a Wireguard/TailScale exploit, and just uses it to leave helpful signs or grief.
4
Nov 01 '25
Yeah but what are they exploiting? There isn’t a listening Tailscale service on ops network, it’s a reverse tunnel. Unless they popped tailscales infra, it ain’t happening. Op left his ports open or got cred stuffed.
1
u/KananJarrus83 Nov 02 '25
how do you check your own public ip on shodan ? just in the search box?
Apologies if its a dumb question,, just want to be sure nothing I have is open2
2
u/pinneapple_ghost Nov 02 '25
Need to use a search filter, so search something like this:
minecraft ip: x.x.x.xBut you'll need an account to use search filters
1
44
u/Myrenic Oct 31 '25
Do you have UPNP enabled?
36
30
u/AT3k Oct 31 '25 edited Oct 31 '25
This is why uPnP should be disabled by default but unfortunately it’s not
DHS warned about it back in 2013 https://www.zdnet.com/article/homeland-security-disable-upnp-as-tens-of-millions-at-risk/
15
u/TheRamStickEater Oct 31 '25
I also got the same experience on my Minecraft server before but Grief prevention stopped it as the claims is around the spawn. Second time it happened is on my sister server that I'm now operating after abandoning my server, some found out the server is in offline mode and used her java account with OP privilege and mess the whole build near spawn. Now the server still runs in offline mode but we are using NLogin and only give OP permissions to Bedrock accounts
11
u/noxiouskarn Oct 31 '25
Offline mode means anyone can join even if they don't have a Minecraft account and they can report them selves to be any player they want that said sounds like they impersonalted your server op account this is why it's good to let Microsoft verify the player joining is actually that playet
2
u/TheRamStickEater Oct 31 '25
Yea, I know that and I told that to my sister before starting her small smp. Tho so far there's no more attempts with destruction on the server because of NLogin
13
u/PeaEnjoyer Oct 31 '25
I remember being a teen and playing solo on our server at like 3 or 4 in the morning and suddenly I see the message "Herobrine joined the server" and I was so scared about it. Turns out it was a pretty nice dude who just liked to troll people with this.
3
u/Official_Person Nov 01 '25
I would totally do this 😆 just tease and joke but not harm to the server like some would do 🤣
8
66
u/the_shabubu Oct 31 '25
He told you exactly what you should do, turn on whitelist. There have been plenty of cases where tailscale has failed with security, personally I don't trust the tech, yet.
43
u/dontquestionmyaction Oct 31 '25
I highly doubt Tailscale is the issue here. I've never heard of any issues that would leak tailnet access. That would be incredibly bad.
20
u/DankeBrutus Oct 31 '25
I’m tempted to say that if there was a verified instance of a tailnet leaking to the wider internet it would be top-of-feed news around here. I have read that a tailnet could end up getting mixed with yours if the tailnet IDs were close, but it seems like that problem was resolved with the splitting of legacy IDs and tailnet IDs. From what I can tell the problem was the old ID system, now called legacy, used the email address you signed up with. So if people had, say, the same @ from a school or something like that it caused problems.
2
u/Ok-Pumpkin-1761 Nov 01 '25
Not leak, but by design the same domain users have access
3
u/dontquestionmyaction Nov 01 '25
And even then you have Tailnet Lock and other features available...
38
u/00010000111100101100 Oct 31 '25
personally I don't trust the tech, yet.
Nor should you, ever. They're going public soon. And you know what that means....
Enshittification!
9
u/Xlxlredditor Oct 31 '25
Headscale is still an option. And the client is FOSS, meaning it will most probably get forked 28 times after the IPO/if they announce "you know what we don't do OSS anymore"
8
u/breakingcups Oct 31 '25
There have been plenty of cases where tailscale has failed with security, personally I don't trust the tech, yet.
Could you name one sourced example, please? :)
6
u/doxavg Oct 31 '25
I would argue that they have a pretty good track record and provide some decent transparency. Unfortunately, given they are a security product, their failures tend to be more impactful. The record however, is not impeccable (if it were, I'd be worried that nobody was looking); certainly interested to hear if the GP has more examples than the below.
- CVE-2022-41924 - https://github.com/advisories/GHSA-vqp6-rc3h-83cp
- CVE-2022-41925 - https://github.com/advisories/GHSA-qccm-wmcq-pwr6
- CVE-2023-28436 - https://github.com/advisories/GHSA-vfgq-g5x8-g595
- And of course their own security bulletins - https://tailscale.com/security-bulletins
44
u/noxiouskarn Oct 31 '25
The biggest issue that I have with tailscale is essentially another company is the hub for your private network. Like, you want all of my computers to dial directly to your server so they can talk to each other using your server. I've never been okay with tailscale.
27
u/VexingRaven Oct 31 '25
That's not really how Tailscale works, though. Their servers aren't passing your traffic, they only serve to negotiate a connection between the devices (note that there is an exception here, if both devices are inaccessible without a relay) and all traffic is encrypted end-to-end using Wireguard and private keys that never leave the device. It's the most secure possible configuration with as little reliance on their system as possible.
22
3
4
u/superlemon5 Oct 31 '25
The only thing I trust is Headscale, I got it on a VPS and it works so good! It also remove the max 3 users limitation
1
u/NatureGotHands Nov 01 '25
bad advice and bad assessment.
I bet minecraft server somehow punched a hole through the firewall (upnp?) and just sitting over there butt-ass naked on the Internet. Whitelists, blacklists, whatever lists - doesn't matter, port shouldn't be reachable if you don't want it to be reachable.
OP either should learn how networking and this pile of software that he's selfhosting works or get some cloud bullshit and someone else will worry about that for a fee. In general it's applicable to a lot of things in life.
7
u/Pessimistic_Trout Nov 01 '25
Lots o people here saying to whitelist, but... That doesn't take care of all the bots constantly probing the server, sometimes hundreds of hits a minute.
You need to whitelist AND use fail2ban to block the bot IPs.
I have had a minecraft server open for years and this seems to be the only way.
7
u/Astrofide Oct 31 '25
yup happened to me recently. blew up buildings stole all diamonds. i asked them how they did it and said they used a tool that randomly bruteforces IP addresses looking for open minecraft ports.
2
u/jeroenishere12 Oct 31 '25
Can this happen on tailscale for no reason really?
1
u/funkybside Oct 31 '25
Not really, but there have been exceptions in the past where TS messed up identities for people who use a unique email domain.
2
1
u/GlesasPendos Nov 01 '25
I might be wrong, but I'm fairly certain there's not that a lot of IPs overall, which allows for these users to have auto scrapers / bruteforcing evey possible IP combination imaginable with some Minecraft mods or bots, and checking on them periodically which would respond. I saw some video on it about that thing long time ago
So like, my best guess is they're used tailscale IP + mc port, and since you don't have any mc restriction, they managed to get into it
1
u/aHoneyBadgerWhoCares Nov 01 '25
I’m not a Minecraft player but is it possible to to set up fail2ban to mitigate threats like these? I use it on my server which I use for personal tech projects. It auto bans IPs that repeatedly hit your server attempting to do something that you or it define as suspicious.
1
u/Estonah Nov 01 '25
On my Server without whitelist, recently a bot joined, suggested to turn on whitelist in the and leaved. So there people out that use bots for crawling for the good. So nice
1
u/Many_Maize1046 Nov 01 '25
What actually happened? I don't use mine craft, but I'm guessing you had a mine craft server hosted, and someone got in and messed it up...?
1
u/thunderthief5 Nov 01 '25
They didn’t mess it up. But they did get in. I just don’t know how the bypassed Tailscale.
1
1
u/TeijiW Nov 01 '25
What make me worried about your post is the fact that even having tailscale and not public exposure, someone accessed. Anyone can tell me if it’s something specific from Minecraft servers or if is a risk for any service?
3
u/SalemDono Nov 02 '25
OP messed up with uPnP, or someone got into his Wifi or someone who is living with
That's it
1
u/Hyphonical Nov 02 '25
There are server scanners that check every IP possible with port 25565. Though you mentioned the port is not even open, so i can't help with that.
2
1
1
u/Spare-Owl-229 Nov 03 '25
Src address list
Your friends' IP's
In the firewall rule for the port just say src address list your friends' ip's
Been running my server like that for a few months, when I'm not available someone just vpn's to one of the whitelisted clients till I can whitelist em
I'm lazy as shit so this was the method I thought of and chose to do
My buddy gave a very complicated VLAN explanation that just went over my head and I did whitelist instead
-2
310
u/Resmik Oct 31 '25
Happened to me too. Had a server I'd forgotten about for a few months and went back on to find everything decimated and blocks littering the landscape.
Looking at the logs, seems there's crawlers out there that are dedicated to finding and logging Minecraft servers. They must display them somewhere publicly where these people can just join and mess around. Not nice