Configuring Reverse Proxy with IP Address on Google Cloud Platform for Hidden Minecraft Server

Configure a Google Cloud HTTP(S) Load Balancer to act as a reverse proxy for your Minecraft server. This setup routes client traffic through the load balancer’s external IP, masking your Compute Engine instance’s private and public addresses while providing DDoS protection and SSL termination.

Architecture Overview

To hide the real IP address of your Minecraft server, you must decouple the public-facing entry point from the backend application server. In this architecture, the Google Cloud Platform (GCP) HTTP(S) Load Balancer serves as the single point of entry. It receives incoming connections on port 25565 (or your custom port) and forwards them to your Minecraft server running on a Compute Engine VM. The load balancer handles the SSL/TLS handshake if you enable HTTPS, though standard Minecraft Java Edition uses TCP, so we will focus on TCP proxying or HTTP forwarding depending on your needs. For pure Minecraft Java Edition, a TCP Proxy Load Balancer is often more appropriate than an HTTP Load Balancer because it preserves the raw TCP stream without modifying headers. However, if you are using Bedrock Edition or need advanced routing, an HTTP(S) Load Balancer with a backend service can work. The key benefit is that clients connect to the static IP address of the load balancer, not the dynamic or ephemeral IP of your VM. If the VM restarts, its IP might change, but the load balancer’s IP remains constant, ensuring your server address stays stable for players.

Choosing the Right Load Balancer Type

Minecraft Java Edition relies on a persistent TCP connection. Therefore, the most robust solution is the TCP Proxy Load Balancer. It operates at Layer 4 (Transport Layer), meaning it simply forwards packets between the client and the backend without inspecting the content. This avoids issues with packet fragmentation or protocol incompatibilities that sometimes arise with Layer 7 (HTTP) proxies. If you require SSL termination or header manipulation, you might consider an HTTP(S) Load Balancer, but you would need to ensure your Minecraft server supports HTTP/1.1 upgrade mechanisms or use a specialized gateway like BungeeCord or Velocity in front of the backend. For simplicity and direct IP hiding, the TCP Proxy is recommended. Note that configuring a reverse proxy for Minecraft requires careful attention to NAT reflection and firewall rules to ensure traffic flows correctly from the internet to the GCP internal network.

Step-by-Step Configuration

First, create a Compute Engine instance to host your Minecraft server. Ensure the instance is in a VPC network with a subnet that allows internal communication. Install the Minecraft server software and configure it to listen on all interfaces (0.0.0.0) on port 25565. Next, create a firewall rule to allow ingress traffic from the load balancer’s health check ranges to your VM. GCP health checks come from specific IP ranges (130.211.0.0/22 and 35.191.0.0/16). Create a firewall rule allowing TCP port 25565 from these sources. Then, create a backend service. For a TCP proxy, create a backend service with the protocol set to TCP. Add your Compute Engine instance as a backend. Set the health check to monitor port 25565. You can use a simple TCP health check that attempts to establish a connection. If the connection succeeds, the backend is healthy. Finally, create the global TCP proxy load balancer. Reserve a static external IP address for the frontend. Configure the frontend to listen on port 25565. Associate the backend service with the load balancer. Update your domain’s DNS records to point to this static IP address. Players can now connect using your domain name or the IP address, and their requests will be routed to your hidden VM.

Verifying the Setup

After configuration, verify that the load balancer is healthy. Check the backend service status in the GCP Console. All backends should show as "Healthy." Test the connection by attempting to join your Minecraft server using the load balancer’s IP address. Monitor the logs on your Compute Engine instance to ensure traffic is arriving. You can also check the network traffic flow using VPC Flow Logs to confirm that packets are being forwarded correctly. If you encounter connection timeouts, review your firewall rules to ensure that the load balancer’s health check IPs are permitted. Additionally, ensure that your Minecraft server’s server.properties file has online-mode=true if you want authentication, or false for offline mode. Remember that hiding the IP does not protect against DDoS attacks targeting the load balancer itself, but GCP’s infrastructure provides significant mitigation capabilities.

Security and Maintenance Considerations

While this setup hides your server’s IP, it is essential to maintain security best practices. Regularly update your Minecraft server software to patch vulnerabilities. Keep your Compute Engine instance’s operating system updated. Use SSH keys instead of passwords for accessing your VM. Enable Cloud Armor for additional DDoS protection at the edge. Monitor resource usage to prevent performance bottlenecks. If you experience high latency, consider moving your VM and load balancer to a region closer to your player base. Also, be aware that some Minecraft plugins may rely on the client’s IP address for whitelisting or logging. With a load balancer, the source IP seen by the server is the load balancer’s IP, not the player’s. To preserve the original client IP, you may need to configure X-Forwarded-For headers if using an HTTP proxy, or use specialized plugins that support proxy protocols. For TCP proxies, preserving the client IP is more challenging, and you might need to implement a proxy protocol handler in your Minecraft server or use a tool like HAProxy in front of the VM if advanced features are required. Deploying a Static Website on Google Cloud Storage with GCP Load Balancer provides insights into general load balancer configurations that can inform your understanding of backend services and health checks used in this Minecraft setup.

Frequently Asked Questions

Can I use an HTTP Load Balancer for Minecraft Java Edition?

Yes, but it is complex because Minecraft Java Edition uses a proprietary binary protocol over TCP, not HTTP. You would need to use an HTTP/2 or HTTP/1.1 compatible proxy like BungeeCord or Velocity in front of your backend servers. Direct TCP forwarding via a TCP Proxy Load Balancer is simpler and more reliable for vanilla Minecraft servers.

How do I handle player IP tracking with a load balancer?

Standard TCP proxies mask the client’s IP address from the backend server. To track real IPs, you must use a proxy protocol-aware server or middleware. Some Minecraft proxy platforms support the PROXY protocol, which sends the original client IP in the connection header. Ensure your server software and any intermediate proxies are configured to read and respect this header.

What happens if my Minecraft server crashes?

If your Compute Engine instance crashes, the health check on the backend service will mark it as unhealthy. The load balancer will stop sending traffic to that instance. You can set up auto-healing or managed instance groups to automatically restart or replace the VM. During the downtime, players will see connection errors until the new instance is healthy and added to the backend pool.

Does this setup protect against DDoS attacks?

Google Cloud Load Balancers provide built-in DDoS mitigation at the network edge. They absorb large volumetric attacks before they reach your backend instances. However, application-layer attacks (like excessive login attempts) may still hit your server. Combine this setup with Cloud Armor policies to block malicious IPs based on reputation lists or rate limiting rules for enhanced protection.

Can I run multiple Minecraft servers behind one load balancer?

Yes, you can create multiple backend services and route traffic based on different criteria. For example, you can use an HTTP Load Balancer to route traffic to different servers based on the hostname or path. For TCP proxies, you can only have one backend service per frontend port unless you use separate IP addresses or ports for each server. Using a proxy platform like BungeeCord allows you to manage multiple backend servers under a single IP address effectively.