What the managed edge and the kits do not do today, in one place, so you find out here rather than after you have moved a server.

Every player arrives from one address

Behind the gateway - bring your own node and route only alike - your Minecraft server sees every player connect from one address: the link's. On route-only that is usually 127.0.0.1. There is no PROXY protocol support yet, so the player's real IP never reaches the server.

What that breaks:

IP bans and /ban-ip - banning one player's address bans everyone
Anti-bot and anti-VPN plugins - they see one address for all players
Per-IP limits - every player shares one budget

Ban by name or UUID instead. PROXY protocol support is planned.

No Bedrock, no UDP

The edge carries Minecraft Java Edition over TCP and nothing else. Bedrock players, Geyser, Simple Voice Chat and any other plugin that needs UDP do not work through it. Bedrock is under evaluation, with no date. The roadmap shows where each of these stands.

Where the kits run

The bring your own node kit starts warp (the WireGuard client), node, link and watchtower with one docker compose up -d. It needs:

Linux on x86_64 - the images are amd64 only, so no ARM, no Raspberry Pi
Or Windows through Docker Desktop with WSL2; macOS is not offered
A kernel with WireGuard
Outbound UDP for the tunnel (25599 by default) and outbound HTTPS
The Docker socket mounted, NET_ADMIN for warp and SYS_ADMIN for the node

The node is host-networked and binds 25520-25523. Nothing needs to be reachable from the internet, but on a machine with a public IP, firewall those ports.

The route-only kit is the link plus watchtower. It needs outbound HTTPS and TCP to the edges. If your server is not on the same machine as the link, list its host in LINK_ALLOWED_TARGETS.

Automatic updates

Both kits include watchtower, which keeps them on the current version without you doing anything. On route-only it updates the link nightly at 04:00, in the time zone set in your kit (TZ). When a new version is pulled, players are briefly disconnected once.

Custom domains

Up to 50 of your own domains per account
Add a CNAME to the address the panel shows, plus a TXT record at _dylaris-verify.<your-domain>
Verify within 4 hours; pressing "check" never counts against you
Five 4-hour windows without the TXT record block that domain for your account; publishing the record and checking again lifts the block

See Networking and ports.

One of each

One BYON node and one route-only location per account.

If a payment fails

You have 5 days to settle it.
Then the account is suspended.
48 hours later your servers stop and routing is withdrawn.
3 weeks after the suspension, backups in our storage are deleted.

World files on your own machine are never touched, and backups in your own S3 bucket are never deleted. The terms have the binding version.

Backups and traffic

Each BYON node includes 50 GB of backup storage in our object storage; route-only includes none. More storage, and traffic beyond your allowance plus a 10% fair-use buffer, are opt-in in the panel. Current prices are on the pricing page.

Known limits