Minecraft proxy/vpn setup

Question

I have a server which I want students at my university to be able to access. However for some reason the university network drops the connection and since this is an entertainment service, while not dissallowed the admins will not invest time in solving.

I have got it to work with hamachi and openvpn (in a secure manner with iptables so only the minecraft port is accessable and only the server ip gets routed through the vpn) however both require users to install additional software, and place additional load on my server encrypting everything...

So i am looking for an option that does not require additional software and ideally places minimal additional load on the server.

I can forward ports on the nat router for my linux server and can install software on the server. I want to ensure users have no access to my lan, and can only connect to a single port on the server. Id also like to prevent any connection from the server to a client.

I definately do not want my server to be a proxy for anything else, such as other minecraft servers, minecraft updates, etc.

Ive seen stuff about socks/ssh proxies, but these appear to try and tunnel everything a user does, and i see no way to firewall it on my server (e.g it diesnt create an interface like ham0 or tun0)

Answer 1

Users cannot avoid having to install an application on their pc's as clients to connect to the tunnel.

I know with FreeSSHd (on windows) you could control almost everything you want your users to have access to on your server, maybe you could add a windows server to be the man-in-the-middle on the network infrastructure you have right but I'm not sure how bad will this will impact your performance.

I don't know of any tool that lets you do that on linux yet, but I'm not more than an occasional linux user either.

Answer 2

Assuming that your service is outside the University network, the problem is that the Minecraft port is not open through the University firewalls.

You don't therefore need to mess with VPN's, as long as the University network doesn't block people by examining the actual packets and blocking gaming ones.

All you need to do is set up your router to NAT (strictly speaking, it's PAT, Port Address Translation). From the Internet side, you need to allow a well known port. 8080 may work, though on really strict networks you might only be allowed 80 and 443. On the local network side, you need to configure the PC's IP address and the Minecraft port. Now you have a link between your public IP address and chosen port and the private IP address and different port. The router takes care of everything.

Users on the university network need to configure Minecraft to connect to your public IP address with the public port, e.g.,

publicaddress:8080

Here I am passing the standard ports straight through, but you would want to change the first port number, the "External Port" to be 8080 or whatever you need.

UPDATE:

From your comments, you've clarified that university users CAN connect to your server, but then their sessions drop some while later. This doesn't happen when connected over a VPN. This would indicate that the university’s filtering service is tagging the traffic and doing something to the connections.

So a VPN is the best alternative. Check your router documentation to see if it will act as a VPN end point. If it supports something like PPTP, then you could set that up and give people instructions on setting up a PPTP VPN from their machines.

If your router cannot do this, you don't have many options. Either an external (probably paid for) VPN service or a machine on your local network that acts as a VPN server. @safjrz mentioned FreeSSHd, there is also WinSSHd that I've used a lot in the past for similar purposes. Users can run WinSSHd to make outgoing SSH based VPNs, they connect to an SSH server on your network which might also be from WinSSHd if you use a Windows PC or directly via SSH if using Linux.