No public IP, no port forwarding, no router settings. Your machine connects out to our edge, and your friends join on a normal address ending in :25565. Your home IP stays hidden.
A classic home server works by forwarding port 25565 on your router to your PC. That only works if your router has its own public IPv4 address. More and more connections do not: with CGNAT (carrier-grade NAT) your provider puts many customers behind one shared address, and with DS-Lite you get a public IPv6 address but only a shared IPv4 one. Starlink and most mobile and 5G plans work the same way.
There is nothing on your router you could open. Connections from your friends end at your provider, not at your house.
Every connection can go out, even behind CGNAT. So your machine opens an encrypted tunnel outward to our edge, and players come back down that tunnel.
Nothing on your machine has to be reachable from the internet. A BYON node needs outbound UDP for its WireGuard tunnel, route-only only outbound TCP and HTTPS, and both keep working when you move the machine to another network.
Players connect to a domain on :25565, ours or your own. No port in the address, no SRV record, nothing to explain.
Players only ever see the edge. The edge reads the Minecraft handshake first and drops junk and connections for unknown addresses before they reach you.
Your PC or server runs the node agent, managed from our panel: modpacks, backups, console, users. Install Docker, run one docker compose up -d, done. It needs Linux on x86_64 for a server people play on; Windows is fine for trying it out.
How BYON works →Keep the server you already run, exactly as it is, and only take the address. One small container, no VPN, connects it to the edge.
How route only works →Not with port forwarding, because behind CGNAT your router has no public IPv4 address to forward from. With Dylaris your machine opens an outbound tunnel to our edge instead, so it needs no public IP and no open port, and players join on a normal address.
Look at the WAN or internet IPv4 address your router shows. If it differs from the address a "what is my IP" site reports, you are behind CGNAT. On DS-Lite your router has a public IPv6 address but shares its IPv4 address with other customers.
Yes. Both usually put you behind CGNAT, and the tunnel only needs outgoing connections: outbound UDP for a BYON node (WireGuard), and only outbound TCP and HTTPS for route-only.
No. Players connect to the edge, and the edge reaches your machine through the tunnel your machine opened. Your address never appears in the server list, in DNS or anywhere a player can read it.
No. The edge is a handshake-aware tunnel that sits in front of your server. It reads the Minecraft handshake to find your server and drop what is not Minecraft, then forwards the connection untouched. If you run Velocity or BungeeCord, keep it and put the edge in front of it.