Rhaven’t used spectrum before, but is there a way to route traffic thru spectrum on port 19132 too via subdomain1?
Rhttps://www.cloudflare.com/application-services/products/cloudflare-spectrum/
i see, looks like only enterprise plan can specify ports :bruh:
i see, looks like only enterprise plan can specify ports :bruh:
Cloudflare has been named a "Leader" in the Forrester Wave for DDoS Mitigation. Protect your TCP and UDP-based applications against DDoS attacks.
FSpectrum seems ridiculously limited if it’s only 2 application options are SSH and Minecraft…and then restricting it to Java port 25565.
So much conflicting info on this product.
Website says geyser isn’t supported.
Why would you run a Java server and not have geyser, may as well cut out 80% of the minecraft players on consoles and mobile.
So much conflicting info on this product.
Website says geyser isn’t supported.
Why would you run a Java server and not have geyser, may as well cut out 80% of the minecraft players on consoles and mobile.
DIf local firewall is an option, only way I can think of is to block incoming conections directed towards subdomain2:25565
FI had thought of this but the point of DDOS protection is to block it before it hits my network. Otherwise I’m just being DDOSed at my security appliance which will crash my internet and sever anyways.
DThat's fair
FAppreciate the response though.
DSure. Sorry i couldn't help further. Does seem like a conundrum
FIm not sure if this resolves it but i added the following to the geyser config.yml
*Replace subdomain1 with your subdomain address
java:
address: subdomain1
port: 25565
What should happen is if a player uses a java client to connect to subdomain2 it should still push it through subdomain1 and use spectrum.
*Replace subdomain1 with your subdomain address
java:
address: subdomain1
port: 25565
What should happen is if a player uses a java client to connect to subdomain2 it should still push it through subdomain1 and use spectrum.
CSpectrum non-enterprise is more of a trial/teaser of the product, espec at its pricing. MC uses a lot of data quick, can be pretty expensive with Spectrum
CThe easy answer here though is just a firewall like ufw https://github.com/Paul-Reed/cloudflare-ufw and allow all CF IPs to 25565 and nothing else, and then open up Geyser on port 19132 to the world
Modifying that script to something like:
Then allow any to 19132 and default deny incoming. Be careful you allowlist through any other services you run, and/or adapt to this to your current firewall
This isn't possible with anything in Cloudflare/Cloudflare firewall as the traffic to your unproxied geyser domain literally isn't going through CF.
Having an unproxied geyser domain throws away most of your protections anyway, people still know your origin's real IP and could just ddos it that way. Silly attackers may not pay enough attention to notice that but if anyone actually cared enough to look at your setup first, they'd realize you have a huge security hole
Modifying that script to something like:
Then allow any to 19132 and default deny incoming. Be careful you allowlist through any other services you run, and/or adapt to this to your current firewall
This isn't possible with anything in Cloudflare/Cloudflare firewall as the traffic to your unproxied geyser domain literally isn't going through CF.
Having an unproxied geyser domain throws away most of your protections anyway, people still know your origin's real IP and could just ddos it that way. Silly attackers may not pay enough attention to notice that but if anyone actually cared enough to look at your setup first, they'd realize you have a huge security hole
DWould a reverse proxy with firewall help in this regard?
FThankyou for sending me down the rabbit hole.
I now have a working solution which i want to share here for others wanting to protect their linux Minecraft server with Spectrum.
All connects through bedrock.subdomain.com is allowed on bedrock client as its pushed through geyser on 19132 only.
The trick here is linux looks at rules in order of number, you need to get this right.
I set deny to 25565 on bedrock.subdomain.com as rule 2 and then after that allowed all cloudflare ips. Then after that i denied 25565 to anywhere.
To add all the cloudflare ips to the firewall you can use a script like this
for cfip in $(curl -s https://www.cloudflare.com/ips-v4 https://www.cloudflare.com/ips-v6); do
sudo ufw allow proto tcp from $cfip to any port 25565 comment 'Cloudflare IP';
done
Im sure if you're doing this, you have enough knowledge to work out the firewall rules yourself and test it.
I also had to ping java.subdomain.com in cmd and then find the IP cloudflare was giving it and add it to the cloudlfare IPs as allow in the firewall.
Once i completed all this i found in the java client the server i added under java.subdomain.com was available but the server under bedrock.subdomain.com i added was not.
I could also connect to the server through bedrock without issue on bedrock.subdomain.com. java.subdomain.com wont work on default as geyser uses 19132.
Their isn't much information out there on this so i hope this guide helps you out.
I now have a working solution which i want to share here for others wanting to protect their linux Minecraft server with Spectrum.
- Add your DNS to Cloudflare
- Create 2 subdomains, for the example i will have java.subdomain.com and bedrock.subdomain.com
- Added java.subdomain.com to spectrum
- Create an A record for bedrock.subdomain.com to the servers Public IP
- Create a SVR, it would be something like _minecraft._udp.bedrock.subdomain.com pointing to bedrock.subdomain.com on 19132. Priority 0 and Weight 5
- Setup your linux firewall to allow allow in port 25565 on TCP for all the cloudflare IPs as people will connect through cloudflare spectrum. Deny everywhere else on 25565. Deny 25565 for subdomain bedrock.subdomain.com and allow all for your bedrock port 19132
All connects through bedrock.subdomain.com is allowed on bedrock client as its pushed through geyser on 19132 only.
The trick here is linux looks at rules in order of number, you need to get this right.
I set deny to 25565 on bedrock.subdomain.com as rule 2 and then after that allowed all cloudflare ips. Then after that i denied 25565 to anywhere.
To add all the cloudflare ips to the firewall you can use a script like this
for cfip in $(curl -s https://www.cloudflare.com/ips-v4 https://www.cloudflare.com/ips-v6); do
sudo ufw allow proto tcp from $cfip to any port 25565 comment 'Cloudflare IP';
done
Im sure if you're doing this, you have enough knowledge to work out the firewall rules yourself and test it.
I also had to ping java.subdomain.com in cmd and then find the IP cloudflare was giving it and add it to the cloudlfare IPs as allow in the firewall.
Once i completed all this i found in the java client the server i added under java.subdomain.com was available but the server under bedrock.subdomain.com i added was not.
I could also connect to the server through bedrock without issue on bedrock.subdomain.com. java.subdomain.com wont work on default as geyser uses 19132.
Their isn't much information out there on this so i hope this guide helps you out.
DThanks for the writeup
Fbedrock.subdomain.com will still be exposed. People can lookup bedrock.subdomain.com and see your server IP and DDOS it but im told that can be fixed with CDN
FI can see some people are trying to message me directly for help with firewall rules.
Im not apart of cloudflare support.
I used copilot to help me with this part and then tested in game by adding 2 servers in java under both domains and seeing how they behaved after changing firewall settings.
I would also advice disabling and enabling your linux firewall after you make changes before testing.
Im not apart of cloudflare support.
I used copilot to help me with this part and then tested in game by adding 2 servers in java under both domains and seeing how they behaved after changing firewall settings.
I would also advice disabling and enabling your linux firewall after you make changes before testing.
DYea. I'm also thinking if you set up a reverse proxy, then people can still ddos, but they'd just be ddossing a proxy rather than your actual server.
FThat’s a great idea.
I’m going to build a reverse proxy using Nginx on Linux and then replace the a record for a cname record.
I’m going to build a reverse proxy using Nginx on Linux and then replace the a record for a cname record.
