Tunnel In

How to allow Minecraft through firewall [3 easy steps]

vahan — Wed, 05 Aug 2020 00:14:11 +0000

Minecraft is one of the most popular video games in the world. It is written in Java programming language and has been released in 2011. Currently, it is ported to various platforms, sold around 200 million copies, and has 126 million active users as of 2020.

In this article, we are going to setup the Minecraft server and discuss the question – “how to allow minecraft through firewall?” by forwarding traffic through a secure tunnel and as a result bypass a firewall or double NAT problems.

We all love to play Minecraft with friends and create crazy worlds together. To achieve this we should have a Minecraft server, but wait should we buy one in the cloud and spend a 100$ per year for this? We definitely have an old laptop or PC which can serve as great hardware for the Minecraft server. First of all, we are going to install the Minecraft server in our hardware, and then we are going to expose our server to our friends?

1. Setup Minecraft server
2. How to allow Minecraft through firewall?
3. Tunnel security options

Setup Minecraft server

Setting up a multiplayer Minecraft server is quite an easy task. By following https://www.minecraft.net/en-us/download/server link you can find the latest version of the Minecraft server and download it to your computer. Before starting the server you should have Java installed on your computer. Nowadays Java comes with all operating systems by default, however, for Windows, you may be required to play with the PATH environmental variable – It is required to make sure that you can use java from the command line.

To start Minecraft server you should run the following command:

 java -Xmx1024M -Xms1024M -jar server.jar nogui

The first run may seem exits with some warnings and errors:

[12:33:18] [main/ERROR]: Failed to load properties from file: server.properties
[12:33:18] [main/WARN]: Failed to load eula.txt
[12:33:18] [main/INFO]: You need to agree to the EULA in order to run the server. Go to eula.txt for more info.

However, it is ok! It justs created default configuration file for a server called “server.properties”, another file for end-user license agreement called “eula.txt” and informs us about accepting the license. To accept the license we should open “eula.txt” file and replace “eula=false” statement in the last row with “eula=true” then save the file and close.

Now is the time to run following command again:

 java -Xmx1024M -Xms1024M -jar server.jar nogui

In case if you want to start the server with a user interface you can omit “nogui” argument from the command above. The user interface is not showing much, however, you can see memory usage status, players, logs, and chat.

That’s it! We have a functioning Minecraft server installed, now let’s go to the part where we are going to answer the question of “how to allow Minecraft through firewall?”.

How to allow Minecraft through firewall?

By default, the Minecraft server is listening to 25565 port, however it can be verified or changed in the “server.properties” file (see the row “server-port=25565”). To allow our friends to join we should somehow expose this port to the internet to allow incoming TCP connections. We have many options to achieve this such as:

1. Tunneling
2. Port forwarding
3. VPN

Each of these options has their pros and cons. Here you can find a detailed comparison of different methods for exposing a local server. In this article, we are going to use tunneling for exposing the Minecraft server to the internet, since Tunnel In is aimed to create and manage network tunnels. This method is secure and with our platform it is easy to use and elegant way for exposing any local network service to the internet.

First of all, you need to create a free account and set up an agent to your computer. Here is a link on how to install Tunnel In on Windows PC.

That is all you should do in your computer, the rest you should do from Tunnel In’s web portal i.e. it means after installing an agent all configuration can be done remotely.

Now lets create a tunnel and expose local server to the internet. For that just go to the Tunnels tab and click on “+” button in the bottom right corner. Name the tunnel, select your device, select CUSTOM type for the tunnel, and enter the port number (by default it is 25565). Remove two checkboxes from Security Options (see picture below) and click on the “ADD” button.

The system will create and start the tunnel automatically. In the “Connection properties” column, you can see the URL pointing to your local Minecraft server. By clicking on the URL system will copy it to your clipboard. You can use this URL for connecting to your server from anywhere in the world. Send it to your friends and enjoy playing together!

Now when we know how to allow Minecraft through firewall lets speak a little about how to secure our server.

Tunnel security options

While you can use the Minecraft server with your friends it is time to speak about the security options of the tunnel. In the tunnel creation process, we saw the “Security Options” panel which provides a way to limit the connections to tunnel by IP address, time and connections count.

Here are a short descriptions of each option:

1. Connection rate limiting – At most 6 connections are allowed in any 30 seconds window. This is great to stop DDOS attacks on your server
2. Initialization time limiting – After starting the tunnel system gives 180 seconds to establish a connection to the tunnel, once that time expires the system will not accept new connections, however, the connections established within the first 180 seconds will keep working.
3. Automatically close tunnel when not in use – this is self-explanatory. This option will help you to automatically decrease the attack surface on your server. BTW this is one of the reasons we are against port forwarding.
4. Allow Connections From – this option supports 3 different things by now – Allow connections from anywhere, list of IP addresses to allow connection from and the last one is dynamically detecting IP address when you are starting tunnel and allow connection only from your IP address.

ssh into raspberry pi from anywhere in the world [3 easy steps]

vahan — Fri, 26 Jun 2020 23:48:30 +0000

In 3 easy steps, this article describes how to ssh into raspberry pi.

SSH (Secure Shell) is a network protocol which allows to securely operate network services over an unsecured network. SSH provides a secure channel and has client-server architecture i.e. one can connect to the SSH server using an SSH client application. By default Raspberry Pi OS (previously called Raspbian) comes with OpenSSH server preinstalled which can handle user authentication, terminal connections, encryption, file transfers, and tunneling, however, to use it we need to enable the service. Here are 3 easy steps to do that:

1. enable ssh on raspberry pi
2. ssh into raspberry pi
3. setup Tunnel In for ssh into raspberry pi from outside of your local network

1. enable ssh on raspberry pi

First of all, do not forget to change the default password of Pi when enabling SSH service, this is required safety measures.

There are a couple of ways to enable ssh service in raspberry pi.

Desktop – If your raspberry pi is running the desktop version of Raspberry Pi OS the most convenient way to enable ssh service is from the menu choose Preferences then Raspberry Pi Configuration then in the opened window click on Interfaces tab which will show following content:

Here we just need to choose the Enabled option in the second row and click on the OK button to save the configuration.

Console – If your raspberry running Raspberry Pi OS without a desktop or you want to enable ssh from a terminal you can run sudo raspi-config command in terminal which will open following configuration tool:

From this menu please select Interfacing Options and hit Enter. As a result, we will see the following options:

Now we need to navigate to and select the SSH option, then choose Yes, Ok, and Finish.

Console alternative way – In case we are not want to use any specific configuration tool for enabling ssh we can do it via systemctl command (which is a tool to control services). We just need to run these 2 commands in terminal for enabling and starting ssh service: sudo systemctl enable ssh and sudo systemctl start ssh.

Headless – All previous methods require a monitor and keyboard attached to our raspberry pi. What if we don’t have them connected to raspberry? There is still a way to enable ssh service and connect remotely to the device.

When we flashing a Raspberry Pi OS onto a blank micro SD card, it will create two partitions. The smallest one is labeled as a boot. To enable SSH we just need to create a file in the root of the boot partition called “ssh” (without any extension). The content of the file does not matter, moreover the file will be deleted on the first launch of the device. All these actions can be done on another computer, that is why this method called headlessly and does not require the monitor and keyboard connected to the raspberry pi.

2. ssh into raspberry pi

Once we enabled ssh service in raspberry, it is ready to accept ssh connections and we are ready to ssh into raspberry pi from our local network. To connect to raspberry we need to know the IP address or hostname of our device so we will make a proper connection.

By default, our raspberry should have raspberrypi.local hostname, but let’s dig more and find out the IP address of our device.

First of all, if you have a monitor and keyboard connected to your device we can run ifconfig command in terminal and find out the IP address.

Alternatively, if we have access to the router’s configuration page, we can find out the IP address from the router’s connections list.

However, the most reliable way to do this is to use a network scanning tool like Angry IP Scanner, which is an open-source, cross-platform, and very intuitive tool. This method does not require access to the router or raspberry pi directly.

Now we know the IP address of our device and ready to ssh into raspberry pi.

Now we need to choose a proper ssh client depending on which OS we want to ssh into raspberry pi. For macOS and Linux we can use terminal which comes preinstalled on every distribution. We just need to run ssh @ command to start a remote connection, where the default username of raspberry is pi. So for our specific case, the command would be ssh pi@192.168.1.7. After running a command it will ask a password and then after the authentication, you can interactively control your device.

For windows the most convenient ssh client is putty, which is an open-source project and has a very intuitive interface:

3. setup Tunnel In agent

Previous two sections covered a question of how to ssh into raspberry pi, so one can ask what is Tunnel In and why we need it?

Tunnel In is a platform that can allow to easily create secure tunnels and extend different services from being used only from the local network to be used everywhere around the globe. In other words, Tunnel In will allow you to ssh into raspberry pi even if you are not in the same network with your device, instead, you can ssh into raspberry pi remotely (from anywhere in the world).

To start using Tunnel In you just need to create an account of Tunnel In, setup the agent of Tunnel In (it supports Windows, Mac and Linux, for raspberry pi you should select Linux Console option) then you can monitor and manage your device remotely in our web platform:

Then you have two options – Try in the browser which allows to ssh into raspberry pi without installing any ssh client and use a browser as an ssh client or See configurations and by using the configurations, which system assigns to your tunnel, connect to the raspberry pi using the ssh client you like most.

Tunnel In can also create https tunnels to securely expose your local running webserver to the world. This may be useful if you are running OctoPrint for managing your 3D printers, Home Assistant, or openHAB for controlling smart home or any other web applications.

Tunnel In also can create proxy tunnels and make you able to use your remote device’s internet as well as VNC tunnels to allow you remotely access to your device’s desktop and many more (theoretically Tunnel In can forward and network services you are running locally on your devices and allow you to consume these services remotely).

By the way, you can play with Tunnel In functionality in our Demo account before registering an account.

Simple steps to install Tunnel In on windows in 3 minutes

vahan — Wed, 03 Jun 2020 23:02:36 +0000

We can install Tunnel In on windows, linux, and mac operating systems. However, in this article, we will focus on installing tunnel in on windows machines.

1. Account Creation

First of all, you need to register an account in Tunnel In platform, so when you’ll install an agent on your machine tunnel in will ask your credentials (email and password) to assign that device to your account, so you can monitor and manage your device remotely from web. It is pretty straight forward with this page:

2. Downloading of Agent

Now when we have an account we can add devices to our account. After logging in, click on + button in the bottom right corner of the screen. It will show a popup window where we can select which version we want to download. Click on the Windows tab and then click on the download button.

3. Install Tunnel In on Windows

After a short time, you’ll have an executable file downloaded on your Windows running PC. Just double click on that file to run it and follow the instructions. It will ask you your email, password, and device name – just fill the same email and password you’ve used to register in Tunnel In portal. For the device name, you are free to type whichever you want – it will be used to register the device with that name in the web portal.

What is Next?

After the above steps, you can refresh the Tunnel In web page and will see a new card representing your new windows machine. On this card, you can see the device status indicator which turns green, yellow, and red depending on your device on/off status and when your device last time answered to the heartbeat of Tunnel In service.

Now you can start to monitor your device through our web portal or even control it.

Once you have configured Remote Desktop Service on your device you can connect to your device remotely from everywhere in the world, despite the fact that RDP works when your device directly accessible. Just you need to click on the RDP button and connect to your device desktop directly from the browser or you can use RDP native client to connect to your device and get full performance and features from the native client.

You can also use your device internet and forward your traffic through your device using Tunnel In’s Proxy feature.

As well as you can expose your local web server and share URL with your colleagues.

Setup Tunnel In on Windows machine

3 different ways to expose local web server

vahan — Wed, 20 May 2020 07:08:20 +0000

In this article, I will write about techniques of how to expose local web server to the world and access it through the internet. Small spoiler – of course, there are many possible ways to achieve this goal will be discussed in this article, however, I will focus on mainly Tunnel In’s approach, since this method is easy, secure & flexible!

Whether you are a developer who is coding the next successful web platform, or you are a smart home enthusiast who automated home using great products such as Home Assistant, OpenHab or Node-RED, you’ll definitely like to present or control these applications over the internet. Let’s go and dig into more details:

Port Forwarding

This method is widely spread among beginners. It is all about configuring the router to forward the external IP address port to your local machine’s IP address and web server’s port. Sometimes some people event configuring DMZ (demilitarized zone) and putting the server in this zone to be able to access it from outside of the local network. What is wrong with this method?

First of all, it is problematic to describe and write “how-to” on this topic, since every router has its own UI where you should configure the port forwarding, however, in most cases, it is pretty easy to achieve it.

Nowadays all Internet Service Providers rotating residential IP addresses. So you are not guaranteed that after an hour you left the home and try to open your IP address from somewhere else it will be your router’s external IP address. Yes this situation also has a solution – you can start some script or program which will periodically send your IP address to some service (Dynamic DNS) where you can learn your IP address or for convenience, such services provide you a URL which points/resolves to your IP address.

The problem with this URL is DNS record caching – when you open your URL for a first-time, browser asks OS, OS asks DNS resolver and so on until every node in this chain knows about your IP address. The issue is they are caching this information and the situation when your IP address has been changed however your URL pointing to your previous IP address may occur. Sometimes even some ISPs are violating the rules and are caching records for 24 hours or more without taking into account TTL (time to live) value of the record.

The situation is getting worse in the case when your ISP does not assign your router a real IP address – so-called Double NAT scenario. It makes it impossible to host services!

Another sort of issue is arising when you want to configure port forwarding when you are outside of your local network.

We can continue this list very long, however, I think it is enough. The last thing I want to add to this list is the lack of a firewall, so you should implement additional mechanisms to protect your resource.

VPN

Virtual Private Networks is another monster technology that allows “exposing” your local web server. To be correct it is not exposing anything, instead, it is creating a virtual network and placing 2 or more computers into that network. Thus these computers can access “directly” one to each other. This method is secure (yes there are some versions that are deprecated and not recommended to be used, even operation systems dropping the support and refusing to connect to such networks).

Despite solid security, VPNs provide it is quite complicated to setup and not convenient to maintain. Imagine a situation you want to share your local development with your colleagues, so you have to have a VPN server somewhere in a cloud than you should setup some client which will make your computer to be “always online” on VPN network i.e. it should automatically reconnect to VPN once connection dropped, etc. Even this is not a full story, you should ask your colleague to configure and connect to the same network to be able to access your machine – which is really complicated. Moreover, it is hard to allow someone to connect to your network and meantime restrict access to only one IP address and port of your machine i.e. you should really trust a person to welcome this person on your private network. Even if you choose this complicated path to share your local web server with someone you are not solving the problem completely – you don’t have a single URL to expose your local web server. What if you want to share your test version to the whole globe?

Tunnel In method to expose local web server

Tunnel In combined best from both worlds and even more. As a result with a single click Tunnel In will provide a mechanism to on-demand start a tunnel that exposes your local web server meantime, your web server is directly not accessible and protected by a firewall.

The great thing about Tunnel In – it is not required to have technical skills to setup and configure your tunnels, moreover out of the box you are getting security and flexibility.

It is very easy to setup and use Tunnel In:

1. Create a FREE Account

2. Setup Tunnel In agent on your machine

3. Get access to your machine from Tunnel In’s web portal

4. Configure tunnel to expose local web server

5. Start and stop the tunnel whenever you want via a single click

Beside exposing local web server with Tunnel In you can expose almost all web services running on your machine such as RDP, VNC, SSH even you can expose your database, IP camera stream, proxy, etc.

In terms of security Tunnel In has a military class of security i.e. it uses end-to-end encrypted tunnels to forward your traffic as well as it has an easily configurable firewall, so you can list IP addresses to whom you want to allow to see your services. In addition, Tunnel In’s firewall support dynamic mechanism to detect your IP address, so you can be guaranteed that every time you start a tunnel it allows only you to see this traffic. As well as you can configure the firewall of Tunnel In to limit connection initialization time and limit connection count i.e. it will drop allow maximum 6 connection in every 30 seconds interval.

For enterprise use Tunnel In suggesting its package delivery mechanism to your machines and ability to perform real-time actions on your machines remotely. It provides an API to integrate with your services, so you can omit the development of a big portion of the product and rely on Tunnel In’s capabilities. It can monitor your devices, can update your software periodically, can schedule and perform actions remotely, and many more.