Dynamic DNS Domain

[Psittac]

So I recently set up a domain for an upcoming minecraft server but I've been a little worried about what this all means for my safety, it's basically the opposite of a vpn.  I don't have it updating my IP currently but will be.  I'm completely new to this world so sorry if I'm not asking the right questions or giving the right info.

[Electronics Wizardy]

Having a domain pointed to your ip address won't really do anything. Opening up your minecraft server can be a issue if there is a vulnerability in the server. So its best to put it on a dmz or limit the minecraft server from access the rest of your network.

 

The other threat is a ddos, but that dependson who you invite. Random people don't normally ddos you.

[Psittac]

Just now, Electronics Wizardy said:

Having a domain pointed to your ip address won't really do anything. Opening up your minecraft server can be a issue if there is a vulnerability in the server. So its best to put it on a dmz or limit the minecraft server from access the rest of your network.

 

The other threat is a ddos, but that dependson who you invite. Random people don't normally ddos you.

ok thank you

[Psittac]

3 minutes ago, Electronics Wizardy said:

Having a domain pointed to your ip address won't really do anything. Opening up your minecraft server can be a issue if there is a vulnerability in the server. So its best to put it on a dmz or limit the minecraft server from access the rest of your network.

 

The other threat is a ddos, but that dependson who you invite. Random people don't normally ddos you.

oh, I'm cutting down to one machine now, a DMZ requires a physical machine not a VM?

 

*edit: couldn't I do a VM and assign it's own IP and put that in a DMZ?

[Electronics Wizardy]

4 minutes ago, Psittac said:

oh, I'm cutting down to one machine now, a DMZ requires a physical machine not a VM?

 

*edit: couldn't I do a VM and assign it's own IP and put that in a DMZ?

You can do a dmz in a vm. Just setup  multiple virtual networks.

[Psittac]

3 minutes ago, Electronics Wizardy said:

You can do a dmz in a vm. Just setup  multiple virtual networks.

ok thanks, I'll just have to learn more about networking.  I've got a layer something switch that can do all kinds of stuff but I'm not smart enough to do it, networking has a very steep learning curve

[Paroxy]

Wouldn't it be better to put that server behind the firewall and forward only the minimum number of ports required to it?  Putting the server in the DMZ doesn't make the other computers on the network safer, it just makes the server a more accessible target.  I believe to achieve isolation from the other computers on the network you would need to put the server on it's own subnet or VLAN.

[Electronics Wizardy]

47 minutes ago, Psittac said:

ok thanks, I'll just have to learn more about networking.  I've got a layer something switch that can do all kinds of stuff but I'm not smart enough to do it, networking has a very steep learning curve

Its probalby not really needed, but it would be best practice.

 

39 minutes ago, Paroxy said:

Wouldn't it be better to put that server behind the firewall and forward only the minimum number of ports required to it?  Putting the server in the DMZ doesn't make the other computers on the network safer, it just makes the server a more accessible target.  I believe to achieve isolation from the other computers on the network you would need to put the server on it's own subnet or VLAN.

Yea, you only port forward needed ports, but putting it in a dmz would make it so that if it did get comprismised, the attacked would only have access to the minecraft server, not all the other systems on the network. This would make it much harder for the attacker to move horizontally in OPs network.

[beersykins]

10 hours ago, Paroxy said:

the server in the DMZ doesn't make the other computers on the network safer, it just makes the server a more accessible target.

You might be confusing 'consumer DMZ feature' with 'actual DMZ concept'.

 

Realistically he should be able to firewall into another zone at the edge and not permit new connections inbound from the DMZ to inside.  Port forwards would be contained to the DMZ.  That might take some logistical planning based on the equipment he has and the features available.