is my minecraft server being attacked?

It's just trawlers, scripts that ping ip address ranges, and if they get a response, they try to login on port 22 with default passwords, and stuff like that, and run portscans to see what ports you have open, and they send standard requests to standard ports looking for access.

Essentially going around to everybody's house and knocking on the door, and see if they can be easily let inside. they keep knocking until you stop answering the door. There's stuff like fail2ban (I think) that blacklists any ip address that tries to login more than X amount of times

Unless somebody knows specifically what service you are running and what port is on, it is unlikely to be anything more sophisticated than that.

Pool some cash together and pay for a hosted server.

Don't take this the wrong way but any suggestion here is most likely going to go over your head unless you spend the time to learn how to do things properly. If you're just looking to play minecraft and learn nothing related to IT (which is fine), spend the money on a hosted server. If you want to learn to properly secure things, I would recommend starting with something simple like using Tailscale so your friends can "VPN" into your local network so nothing is exposed to the public.

Here is a great guide:

https://tailscale.com/kb/1137/minecraft/

Things you host on the public Internet should be kept inside a DMZ on your network. This simply means that you should create a network segment that can't reach any other machines so that if/when your server is compromised, the attack is limited to access on that server (attackers can't access other computer on your network). https://www.fortinet.com/resources/cyberglossary/what-is-dmz

​

Even after you create a DMZ and host your server inside it, you'll still need to worry about hackers compromising your server and using it to launch attacks against others from your home IP (usually as part of a botnet) or using it to distribute illegal content.

You probably should learn a bit more about networking and internet before self-hosting anything in the same network as your parent’s devices, at least until you know how to differentiate “wifi” from other network related things…

It seems as they are on a blacklist of your duck dns but not because they tried to hack you but because on those IPs where malware / phishing websites hosted. Likely somebody used those server now as Proxy / tor exit node. It's of course possible he had bad intentions but that's not the reason he was blocked. (at least the screenshot suggests that)

Concerning the attack on the wifi I'm not sure what you mean. Do you mean the wifi router / internet modem? Because to gain access to your wifi network from different countries seems very unlikely.

I don't know from what software you posted these screenshots, but most of these alerts are complete horseshit.

Very possible as something like Minecraft server is popular enough so if there's known vulnerabilities they might be trying to exploit them. Be sure you are hosting that on a separate vlan that is split from rest of your network.

If you want to be more safe only allow your friends' IPs through.

There are only four billion IPv4 addresses. A modest botnet containing only 1000 nodes, each scanning one IP a second, can scan the entire space every month and a half.

This is typical. I ran a betting pool (in minecraft) with my friends on which country the latest unauthorized connection attempt was from. Prior to 2022 the safe money was Russia.

It would appear that your router is already proactively denying requests from known-bad connections. That's good, but not sufficient.

If you expose SSH, use a public key or a strong (>128 bit strength) random password. Keep all port-forwarded software up to date to limit vulnerabilities. Use containers or virtual machines to limit the impact of a vulnerability.

For the love of the it security gods pls start putting your exposed shit into a dmz. At this point you are just asking for it.

Just rent one.

every firewall/router with a public IP address gets hammered with this garbage. it’s happening constantly.

Surely you should have the answers before exposing sensitive devices to the outside world?

Not trying to be mean but if you don’t understand what’s happening and why then how can you guard against it?

Everybody gets probed, that is normal. Make it difficult by taking basic precautions and they will move on to easier targets. There’s so many people that don’t do anything and leave themselves wide open. This is what they’re looking for in most cases. Exceptions do include people you might have upset and specifically want access to yours.

Do some homework, secure / segregate your stuff and move on :)

For simple peace of mind. Close the ports and use tailscale for him to connect. It's free and you can share the connection to only that one person (you can't really spoof your friend's connection with a bot). It basically makes the two computers look like they are on the same network. I use it with my brothers all the time.

If I had a dollar for every time someone attempted to “attack” one of my pubic facing servers I probly wouldn’t need a job. The moment you have 443 open on your network you get 100s of bots scanning you a day.

Oui

If you're unnecessarily worried about this stuff, you should really not be hosting something that is Internet facing.

Either pay for a hosting service, or at least set up a rev proxy.

If you want a little more security, use a firewall to whitelist your other players and block all other connections. It's another thing to maintain, but ISP IPs don't usually change very often.

Thanks for all the help everyone!

Without even looking, yes. If it is on the Internet, it is being attacked.

Harden the OS where Minecraft is hosted. https://dev.to/samerickson/how-to-create-a-minecraft-server-hardening-the-server-30ko

who attacks a minecraft server?

Welcome to the World Wild Web

It is not a solution but advice, and I am sorry if I offended you. I think you need to close your server. It is not worth it to protect your server. There's a possibility that your server is shared with other attackers. More attackers means a high probability that you get compromised. With one wrong setting, your whole network will be compromised. Maybe pay for service instead.

https://nginxproxymanager.com/

You're welcome.