How to use Tailscale to play Minecraft without opening ports

Setting up a Minecraft server from home has become quite complicated for many people due to CGNAT connections, restricted routers, or ISP policies that prevent opening ports. Tailscale has become a very convenient way to bypass all that NAT and port forwarding hassle.allowing you and your friends to play as if you were on the same local network, but each of you is at home or even using your mobile phone.

In this article we will look at, calmly and without strange technical jargon, How to use Tailscale to play Minecraft onlineThis covers both dedicated servers (Linux, NixOS, cloud VPS) and home computers with Windows and iOS/Android mobiles, as well as reviewing the typical problems that prevent your friends from seeing the server and how to solve them step by step.

What is Tailscale and why is it so useful for Minecraft?

Tailscale is a mesh VPN that creates a virtual private network between your devicesUnlike classic VPNs with a single central server, each device (PC, mobile, NAS, etc.) connects directly to the others using the WireGuard protocol, encrypting the traffic and making it appear as if they were all on the same LAN.

This has a huge advantage for games: You don't need to open ports on your router or hire external hosting for your Minecraft serverThe server and players simply need to be connected to the same Tailscale network (your “tailnet”) and use the Tailscale internal IP (from the 100.xyz range) to enter the world.

Furthermore, Tailscale works on virtually any current platform: Windows, macOS, Linux, NixOS, iOS, Android, Raspberry Pi, and many cloud providersThis allows you to set up anything from a small Bedrock environment on your home PC to a dedicated Java server on a VPS that is only accessible to your family or colleagues.

Another key point is security: Your Minecraft server is not exposed to the entire internet, only to the devices that are part of your tailnet.This way you avoid port scans, random attacks, and unwanted visits from strangers to your world.

Setting up a Minecraft Bedrock server on Linux with Tailscale

A very common option is to install bedrock_server on a Linux server (e.g., Ubuntu or Debian), behind a home firewall, or in the cloud, and then use Tailscale to ensure everyone connects securely to the server's IP address 100.xxx.

First you need an active Linux machine with internet access. It doesn't matter if you're behind a router that doesn't let you open ports.Because communication between players and the server will travel through Tailscale. If you're using a VPS with a cloud provider, it's advisable to block almost all external traffic in the firewall and allow only what's absolutely necessary.

To better manage the Bedrock server, many administrators create a specific user, for example MinecraftThey also install some basic system packages (such as tmux, git, etc.). This way you can keep the server organized, without mixing it with your main user account, and have tools to manage it in the background.

The official Bedrock binary for Linux can be downloaded from the Minecraft website. It is recommended to download it directly using the user created for the server.Extract it to a directory like /opt/minecraft or similar, and give it the appropriate permissions. The binary is updated frequently, and whenever the game version on the client is updated, the server usually needs the same version to allow the connection.

To facilitate future updates, a very useful practice is save the server files to a git repositoryThis allows you to log every update to the bedrock_server binary and, most importantly, control critical files like permissions.json and server.properties, which are often overwritten during updates. With Git, you can revert to a previous version if an update breaks something or if you lose a setting.

Once you have the binary in place and the configuration files reviewed (EULA, server properties, player list, etc.), it's time to automate the startup. With systemd you can make the server start automatically when the machine is turned on. and that you can control it with systemctl.

The usual thing is to create a service unit, for example /etc/systemd/system/minecraft.serviceThis should point to a startup script, such as `/opt/minecraft/start.sh`, and a shutdown script, such as `/opt/minecraft/stop.sh`. These scripts are responsible for launching and safely shutting down the bedrock server (often within tmux). Don't forget to make them executable with `chmod +x` so that systemd can use them.

After reloading the systemd configuration, you can Start the service with systemctl start minecraftIf everything goes well, the Bedrock server will be running as a service. To access the interactive console, you'll typically use tmux: connect to the minecraft user session, run bedrock_server there, and then disconnect using Ctrl+B followed by "d", leaving the server in the background.

Install and use Tailscale on Linux to expose the server

With the Bedrock server up and running, the next step is Add it to your Tailscale private networkTailscale has packages for virtually any modern Linux distribution; the specific steps change slightly between Ubuntu, Debian, Fedora, etc., but the basic idea is the same: install the package, enable the service, and authenticate the machine on your tailnet.

After installation, the service is started (usually with systemctl enable –now tailscaled) and the login command (tailscale up) is executed. At that point, the system will display a URL or open your browser for you to log in with your Tailscale account. (Google, Microsoft, GitHub, etc.). Once you accept, the machine will be registered in your tailnet.

Once the server is active within Tailscale, receives an internal IP address from the 100.xxx rangeThat's the address your other Tailscale devices will use to reach the Minecraft server. You can see the IP address in the Tailscale dashboard, with the `tailscale ip` command, or from the graphical app, depending on your platform.

From that moment on, any client connected to the same Tailscale account or tailnet can contact the IP address 100.xxx of that server using the port corresponding to Minecraft. There's no need to touch anything on the router or do port forwardingbecause the connection travels encrypted through the Tailscale tunnel.

If you have mobile devices, such as iPhone or Android, you will also need to install the Tailscale app from the App Store or Play Store, log in with the same account as on the server, and verify that all the computers appear in the machine list of the app or web panel. Only then will you be able to use the server's IP address 100.xxx to connect from the Minecraft client.

Connect to the Bedrock server from mobile devices using Tailscale

On iOS and Android devices, the process is very similar. First, you install Tailscale, log in, and verify that the mobile device is on your tailnet.Once it appears alongside the other machines, you can open Minecraft.

In Minecraft Bedrock for mobile, you have to enter Play and then on the Servers tabYou'll usually see a list of official promoted servers, but what matters to us is the option at the bottom: Add server (or equivalent depending on the language).

There you will need to enter any name to identify the server and, in the address, the Tailscale's internal IP address of the machine hosting the world (100.xxx, not your home IP address or your local IP address 192.168.xx). The port, unless you've changed it in server.properties, will be the one Bedrock uses by default.

Before you can log in, the Bedrock client usually asks you to log in with an Xbox Live account (live.com)If you have Minecraft login problemsDiscover how to resolve these issues by clicking the link above. Tailscale does not see or manage these credentials; it only handles the network.

Once the data has been added, you should be able to see the server in the list and log in just like any other. If it doesn't connect, check that Tailscale's IP address hasn't changed. (if you have restarted the server, you may receive a different address) and that both the mobile and the server are online within the Tailscale network.

Minecraft server on NixOS and DigitalOcean, fully isolated behind Tailscale

Another very powerful way to use Tailscale with Minecraft is Set up a dedicated server on NixOS on a cloud VPSFor example, in DigitalOcean, and configure the entire system (Tailscale, firewall and Minecraft) from a single Nix configuration file.

NixOS is based on the principle that The complete system configuration is described using a declarative language.Instead of editing several separate files, you define the entire machine in one file (e.g., host.nix) and then the system is built from that description.

For this scenario, host.nix is ​​typically created with Tailscale enabled. A typical line in the configuration would be to enable the Tailscale service and add it to the system's package list. This ensures that Tailscale always starts when the server boots up. and you don't depend on manual scripts.

However, the authentication step is missing. To have the VPS automatically connect to your tailnet upon startup, you can create one in the Tailscale admin panel. a one-time authentication key (auth key)This key is inserted into a oneshot systemd unit within the NixOS configuration, so that upon booting it executes a tailscale up using that key.

You must replace the marker of the type by the real key generated in the Tailscale panel. Without that authentication key, the VPS will not be able to automatically join your networkAnd you would have to log in manually each time, which is impractical for a cloud server.

The next important step for a server exposed to the internet is the firewall. In NixOS, the firewall is also defined in the configuration file. The idea is to activate the firewall, mark the Tailscale interface (tailscale0) as trusted, and limit all other traffic as much as possible..

In practice, this usually translates to: activating the firewall, indicating tailscale0 as a trusted interface, allowing the UDP port that Tailscale uses to build tunnels from any IP address (don't worry, if they are not part of your tailnet they will be rejected) and allowing the SSH port for administration (from the Internet and, of course, by Tailscale). Everything else can be blocked from the public networkso that only your authorized devices actually have access to the Minecraft server.

From there, NixOS offers specific options for managing a Minecraft server. You can choose game mode, difficulty, world settings, etc., always respecting the fact that you must accept the Minecraft EULA Setting the corresponding value (without this, the software cannot be used). Since it is a closed program, NixOS explicitly requires you to authorize the use of non-free software.

With all these pieces (Tailscale, firewall, Minecraft server) defined in host.nix, you have the machine practically ready. The beauty of it is that when rebuilding the system, NixOS applies all the changes at once., keeping previous versions in case you want to revert if something goes wrong.

Deploy the NixOS server on DigitalOcean with automatic configuration

At the time the procedure was described, DigitalOcean did not provide an official image of NixOSThe usual solution is to initially create a droplet with Ubuntu 20.04 and "transform" it into NixOS using a tool like nixos-infect.

To automate it, a file is used cloud-init (user-data.yaml) This file is provided when the machine is created. It includes the commands to install NixOS on top of Ubuntu and also copies the entire contents of host.nix into a write_files block. It is very important to respect the indentation (usually four spaces) for the YAML structure to be valid.

When that user-data.yaml is ready, the droplet is created: you select Ubuntu 20.04 as the initial image, choose a plan with at least 4 GB of RAM (Minecraft is quite resource-intensive), enable IPv6 and check the option to use user data, where you will paste your cloud-config. You also choose a data center close to the players and add the SSH key you'll use to manage the server.

After clicking the create button, the provider takes a few minutes to prepare the machine, run the cloud-init script, install NixOS, and apply the configuration defined in host.nix. This process can take up to ten minutes. When everything is finished, the server should automatically appear in your Tailscale network.because the systemd unit with the auth key will have logged in upon startup.

With the VPS now inside your tailnet, you can start the Minecraft client from your PC or mobile device, select the appropriate version (sometimes it is necessary to use a slightly older version if the server has not yet been updated) and connect using the Tailscale IP address of the droplet. The firewall will only allow traffic from Tailscale and permitted ports..

To manage the server at the console level (for example, sending commands to the game, changing the time, teleporting players), it is common to install the package mcrcon On NixOS, add it to the system configuration alongside tailscale. With mcrcon, you can connect using the password configured for RCON and execute commands without physically logging into the server. If you change that password in the Minecraft configuration, remember to also update the command you use to call mcrcon.

If you later want to modify the world, add backups, install other services, or change system parameters, simply edit /etc/nixos/host.nix Use your favorite editor (nano, vim, etc.) to rebuild the system. NixOS has extensive documentation and modules for integrating tools like BorgBackup or other services you might need with your Minecraft server.

Invite friends with node sharing and troubleshoot common problems

One of the most interesting features of Tailscale is the node sharingThis allows you to share a machine on your tailnet with others without them fully joining your private network. This is very useful when Do you want specific friends to join your Minecraft server without giving them access to all your devices?.

The flow is usually like this: you generate a shareable link for your server from the Tailscale panel, you send it to your friend, and they create their account and accept the invitation (see How to accept friend requests in Minecraft) and appears in the Users section. If everything goes well, after installing Tailscale on your device, it should also appear in the Machines tab and receive its own Tailscale IP address.

A very common problem is that the friend is on the user list but None of your machines appear in the device listIn that case, no matter how much you try to connect to your Tailscale IP from Minecraft, the connection won't go through because your device isn't actually on the network.

To fix this, you need to verify that It's actually running on my friend Tailscale's computer, and he's logged in with the same account that accepted the link.Simply disabling the system firewall will not help if Tailscale is not even running or has not authenticated correctly.

On Windows computers, for example, it is advisable to open the Tailscale icon in the system tray and check that the status is "Connected" and that an IP address of the type 100.xxx is associated with that PC. If it doesn't appear, you may need to press the login button or reinstall the app.Only when the device is listed in the Machines tab of the Tailscale panel will it be able to reach the server.

Another typical case is that of users who open the Minecraft world on LAN and ask friends to connect with the Tailscale host IP address plus the default port 25565But it doesn't work for them. Although it may seem counterintuitive, if the game is configured to listen only on the local network or another interface, it might not accept connections arriving through the Tailscale interface. Checking the server configuration and ensuring it's listening on all interfaces (0.0.0.0) is often crucial.

In Windows, the firewall may also block connections from Tailscale to Minecraft by default. Even if you open the port manually, sometimes the rules only apply to the local interface or to networks classified as public/private.Using the option to allow the Minecraft application in the firewall for all network profiles (including the Tailscale virtual one) is usually more effective than manually opening ports.

Connect from iPhone to a Bedrock server on Windows with Tailscale

Another recurring situation is having a Bedrock server running on Windows 10 and want to join from an iPhone when you're away from home. The user usually sees both devices in Tailscale, views their internal IPs, but when entering the host IP in Minecraft for iOS, they can't connect.

In these cases, several points need to be checked. First, make sure that The Bedrock server on Windows is actually listening for connections and not limited to the local LAN. Next, verify that Tailscale is active on both devices and that you are using the 100.xxx IP address of the Windows PC, not the local WiFi IP address or the home's public IP address.

It is also essential Check the Windows firewallThe first time you run a Minecraft server, a window will usually appear asking for permission to access private and public networks. If one of these permissions was denied, the connection from the Tailscale virtual interface might be blocked. Allowing traffic for Java/Minecraft in all profiles or creating a rule that authorizes incoming connections from the Tailscale interface can resolve this issue.

Another thing that can cause problems is the resolution of names. If you try to use a hostname instead of the Tailscale IP address, the client may not resolve it correctly.especially on mobile devices. To rule out problems, it's more reliable to directly use the IP address 100.xxx and the appropriate port.

If it still doesn't work, it's recommended to do a basic test: from another Tailscale device (for example, a laptop), try opening a known port on the server, or even ping the IP address 100.xxx of the Windows PC. If there's no response even at the network level, the problem is with Tailscale or the system firewall, not Minecraft.Addressing basic connectivity first greatly simplifies the diagnosis.

Other uses of Tailscale: remote desktop access and VNC

Although this article focuses on Minecraft, Tailscale It is also very useful for remote desktop access When other solutions don't work well, programs like Screens Connect offer a simple way to expose a Mac or PC to the outside world, but in environments where that's not feasible or there are network limitations, Tailscale can replace them quite effectively.

The idea is similar: on the computer you want to access (Mac, PC, Linux, even Raspberry Pi) you activate remote administration or the corresponding VNC serverThen you install Tailscale. Once the machine gets its IP address 100.xxx and appears in your tailnet, you can log in from another device using Screens or another VNC client with that IP address.

On macOS, after installing Tailscale following the official instructions, you can see the Tailscale IP address in the system menu iconOn Windows, the IP address is displayed in the notification area. On Linux and Raspberry Pi, it is obtained using the terminal command. tailscale ip -4That's the IP address you'll need to enter into the remote desktop app.

However, it is essential that Tailscale is active at both ends of the connectionThe Mac or PC that shares its desktop and the device you're connecting from (for example, an iPhone with Screens). As long as both are connected to your tailnet, you can access it as if you were on the same local network, without exposing your desktop to the entire internet.

Ultimately, whether for Minecraft or remote access, Tailscale provides a secure and very easy-to-use private network, even if you have no idea about networks or routers. With a little initial configuration on the server and checking that all devices are properly authenticated on the tailnetYou can forget about CGNAT, port forwarding and other headaches, enjoying your Minecraft worlds and remote machines as if everything were in your living room.