How to host a Minecraft server without exposing your IP

What your address actually reveals, the risk that is real rather than imagined, and how to run a server without handing it out.

Two things are true at once. An IP address reveals less about you than people fear, and exposing one still carries a real risk worth avoiding.

#What your IP actually reveals

A public IPv4 address maps to your ISP and, through geolocation databases, to an approximate area. In practice that means a city or a region, and it is frequently wrong by a considerable distance. Geolocation infers position from registration records and routing rather than measuring it.

It does not reveal your street address, your name, or anything inside your home network. Somebody holding your IP cannot look up where you live. Only your ISP holds that mapping, and it is disclosed under legal process rather than to a player annoyed about a griefing incident.

Screenshots showing an IP next to a pin on a map are displaying a geolocation guess, often the centroid of a city or even of a country.

#The risk that is real

Denial of service. Somebody with your home address can direct more traffic at it than your connection can absorb, and while that is happening nothing in the house works. Not the game, not other people's devices, not a video call.

This needs no skill and no information beyond the address, which is what makes it the risk that matters. The secondary concern is that anything else you run at home becomes a target for scanning, which is a good argument against exposing services casually.

#Who can see your server's address

Anyone who joins, because they typed it in. Beyond that:

• Anyone they pass it to
• Server list sites, if you list your server
• Anyone scanning the address space, which happens continuously and automatically

Treat a home address given out for a Minecraft server as public from the moment the first stranger connects.

#How to run a server without exposing it

Every method works the same way: put another address in front of yours.

A tunnel service. Players connect to a relay address, and your address never appears in their client or their logs because they never connect to it. Lowest friction, and players install nothing.

A mesh VPN. Nothing is exposed publicly at all, which is the strongest position available. The cost is that every player installs a client.

Hosted elsewhere. The server is not at your house, so your address is not in the picture at all. This also removes your connection as a bottleneck.

A VPN on the server machine. This is the one people reach for that usually does not work. Consumer VPNs do not accept inbound connections on arbitrary ports, so players cannot reach the server through one. Some providers sell port forwarding as an add-on, which does work, but you are then trusting that provider with your traffic and paying for something a tunnel does more cleanly.

#What to do if it is already public

Assume it stays public, and change it.

1. Establish whether your address is dynamic. Most residential connections are.
2. Release the lease. Power the router off long enough for the DHCP lease to expire so you are issued a different address. How long varies by ISP, and a few minutes is often not enough. Overnight is more reliable.
3. Ask the ISP. Many will change it on request, particularly if you explain you are being targeted. Faster and more certain than the power-cycle approach.
4. Stop exposing the new one. Changing the address achieves nothing if the same server goes straight back up the same way, because the new address is public within one session.

If you are behind CGNAT your address is already shared with many other customers, which incidentally makes you a poor target. How to tell whether you are.

#Does DDoS protection help on a home connection?

Generally not. Protection works by filtering traffic upstream of the target, and on a residential line the congestion happens on the last hop into your house, which is the part you do not control. By the time traffic reaches your router the link is already saturated.

This is a real advantage of tunnelling or hosting: the relay or the host sits behind filtering capacity a home connection cannot have.

#Where Self Hostd fits

We build a tunnel, so factor that in. With Self Hostd players connect to an address that points at our relay, and traffic reaches your machine over the outbound connection the launcher already holds open. Your home address is not published and does not reach players.

It does not protect anything else you expose at home, and if your address is already circulating, the steps above still apply.

Written and maintained by the Hostd engineering team. Last updated 2026-08-11. Notice a mistake? Tell us.