Skip to content
Documentation

Route only

You already run a Minecraft server and you are happy with it. You do not want to migrate, adopt a panel, or change how anything works. You just want a protected address in front of it.

That is this.

Before you start

Your store account and your panel account have to be joined first, or the link you are about to create has no allowance behind it. See Connecting your account.

Setup, in about ten minutes

You run two small containers next to your server. That is the whole install.

  1. In the panel, create a link under Protected Addresses. You get its credentials once, on screen.

  2. Paste them into the route-only compose file and start it:

    shell
    docker compose -f docker-compose.route-only.yml up -d
    • warp joins our overlay over an outbound WireGuard tunnel.
    • link opens an outbound tunnel to the edges and dials your server on its local address.

    Both use host networking and publish no ports at all. Every connection is made outward, from your machine.

  3. Create a route, pointing it at your server as host:port - the address the link sees locally, so 127.0.0.1:25565 or a LAN address is normal here.

  4. Take the subdomain we give you, or point your own domain at us with a CNAME.

Players connect to that domain on :25565. Nothing else changes: your server, its world, its plugins and how you administer it all stay exactly as they are.

What you did not have to do: no SRV record, no port forwarding, no router config, no static IP, no firewall hole. There is nothing inbound to allow, because nothing comes inbound.

Requirements: Docker, and a Linux host. The tunnel uses kernel WireGuard, which needs host networking and NET_ADMIN - so bare metal or a Linux VM, not Docker Desktop.

Your home address stays yours

For a home server behind NAT this is the point of the whole thing. Players resolve a domain that leads to our edge, the edge reaches your machine down a tunnel your machine opened, and at no stage does anyone on the other end learn your connection's address. There is no public address to find, because you never published one.

If your server has a public IP, close it

If the machine is a VPS or a dedicated box reachable directly, the tunnel alone is not enough: the old address still answers. Firewall it to accept Minecraft connections only from the edge addresses.

Skip that and the protection is decorative. Someone who finds the real address connects to it and walks straight past everything you just set up. A tidy domain does not hide a host that still picks up the phone.

What you do not get

Route-only is deliberately narrow. You keep your setup, so you keep its limits:

  • No panel management of that server - it is not a Dylaris server
  • No in-panel console, files, backups or scheduling for it
  • No modpack builder for it

If you want those, that is Bring your own node, which keeps the same hardware and adds the panel on top.

When route-only is the right answer

  • A community server with a working setup you do not want to touch
  • A server someone else administers
  • Trying the protected address before committing to anything