TCPShield protects a Minecraft server by placing a TCPShield endpoint in front of your origin server. Players connect to your public hostname, TCPShield forwards approved traffic to the backend, and your firewall rejects direct connections that bypass the protected hostname. A reliable deployment has five parts: create a TCPShield network, add and verify the backend, point DNS to the destination shown in the panel, configure exactly one player-IP forwarding method, and restrict the origin firewall to TCPShield source ranges.
Prefer not to run the server on your own PC? Godlike.Host offers hosted Minecraft Java servers with free DDoS protection and up to three free backups a day.
Java Edition works on all TCPShield plans. Bedrock traffic requires the Premium Bedrock tunnel, a dedicated CNAME, and the UDP and Geyser settings described below. The setup is safe to test only through the public hostname; a correctly locked origin should not accept players connecting directly to its backend IP.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Minecraft | Java & Bedrock Deluxe Collection | Windows Digital Code | $39.99 | Buy on Amazon |
| 2 |
|
Minecraft | Java & Bedrock Ultimate Collection | Windows Digital Code | $49.99 | Buy on Amazon |
| 3 |
|
Minecraft | Standard Edition | XBOX Digital Code | $19.99 | Buy on Amazon |
| 4 |
|
Minecraft | $6.99 | Buy on Amazon |
| 5 |
|
Minecraft - Bedrock Edition PS4 | $42.98 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
How TCPShield changes your Minecraft network
Without a protection layer, the address published to players is usually the same address that hosts your Minecraft process. Anyone who discovers that address can attempt to connect directly, bypassing hostname-based controls and any filtering placed in front of the server. TCPShield gives players a different destination. The public hostname resolves to TCPShield, while TCPShield connects to the backend address you register in its panel.
This architecture hides the origin from normal player traffic and lets you close the origin to every source except TCPShield. It does not remove the need for correct firewall rules: an exposed backend IP remains a bypass route if the server accepts arbitrary Internet connections.
#1 Best Overall
- DELUXE COLLECTION — Includes Minecraft: Java & Bedrock Edition, three Bedrock add-ons, three exclusive Character Creator items, and 700 Minecoins.
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that’s unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world filled with surprises.
- SURVIVE THE ADVENTURE — Face mysterious foes, travel across exciting landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play cross-platform with friends in Bedrock Edition on console, mobile, and PC, or join community servers in Java Edition on PC, Mac, and Linux. Online console multiplayer requires a platform-specific subscription (sold separately).
TCPShield also has to preserve the connecting player’s address so bans, permissions, anti-bot rules, and logs continue to work. You select one of two forwarding methods:
- TCPShield plugin: a verified-proxy handshake used on a frontend machine such as BungeeCord or a front-facing Spigot/Paper server.
- Proxy Protocol v2: a broadly supported protocol configured in TCPShield and in your proxy or server software. It is the fallback when the plugin conflicts with anti-bot, anti-VPN, authentication, or other proxy software.
Never enable both methods for the same path. They add different connection metadata and combining them commonly produces failed handshakes or malformed addresses.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Prepare the server before opening the TCPShield panel
Gather these details first. Preparation prevents most setup errors because the panel must contain a reachable backend and the public DNS record must match the hostname players will enter.
- An administrator account for the TCPShield dashboard.
- The backend server’s public IP address and the exact Minecraft listening port. Record the port separately for Java TCP and Bedrock/Geyser UDP.
- Control of the DNS zone for the player-facing domain, such as
example.netor a subdomain you intend to use. - Firewall or security-group access on the machine hosting the backend.
- The proxy or server software where player-IP forwarding will be enabled: BungeeCord, Velocity, Paper, Spigot, or another supported frontend.
- For Bedrock, a Premium-eligible TCPShield account and a working Geyser installation. Confirm that Bedrock already works directly on its own IP and port before adding the tunnel.
Decide the player hostname before you create DNS records. A name such as play.example.net is easier to communicate than the backend address and leaves you free to change infrastructure later without asking players to update their saved server.
Set up a TCPShield network and backend
1. Create the account and network
- Sign up for TCPShield and open the network-management area.
- Create a new network. Give it a name that identifies this Minecraft deployment if you operate more than one.
- Open the network’s backend or backend-set section. A backend set is the group of origin endpoints TCPShield can use for the protected hostname.
Use a separate backend entry for each distinct origin address and port. Do not enter a private LAN address unless the TCPShield service can actually route to that network; the backend normally needs a publicly reachable address that your firewall then limits to TCPShield sources.
2. Add the origin backend
- Choose Add backend (the wording can vary slightly by dashboard version).
- Enter the public IP address of the Minecraft origin and its listening port.
- Save the backend and check that the panel reports the endpoint as valid or reachable.
Double-check every digit of the address and the port. A correct DNS record cannot repair a backend entry that points to the wrong machine or service.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- ULTIMATE COLLECTION — Includes Minecraft: Java & Bedrock Edition, five Bedrock add-ons, five exclusive Character Creator items, and 1000 Minecoins.
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that’s unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world filled with surprises.
- SURVIVE THE ADVENTURE — Face mysterious foes, travel across exciting landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play cross-platform with friends in Bedrock Edition on console, mobile, and PC, or join community servers in Java Edition on PC, Mac, and Linux. Online console multiplayer requires a platform-specific subscription (sold separately).
3. Verify ownership of the domain
TCPShield requires proof that you control the domain used for the player hostname. In the network or domain-verification screen, copy the TXT value supplied by the panel and publish it at the DNS provider that hosts your zone. Place the value exactly as shown; do not add quotation marks unless your DNS provider’s interface adds them automatically.
- Create the requested TXT record at the zone root or name specified by the panel.
- Save the record and wait until the DNS provider publishes it.
- Return to TCPShield and run the panel’s verification action.
If verification fails, inspect the record name first. DNS consoles often append the zone automatically, so entering the full domain in a field that expects only a host label can create a duplicated name. Also remove conflicting old TXT values only when you know they are obsolete; unrelated verification records for mail or other services may need to remain.
4. Choose the public hostname and destination
After verification, select the hostname players will use and copy the TCPShield destination shown for it. The destination is network-specific, so use the exact value displayed in your account rather than guessing a generic address.
TCPShield states that its domains are wildcarded. Consequently, a separate record is often unnecessary when your chosen name is a subdomain such as play.example.net; follow the panel’s instruction for your particular hostname.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- Open the DNS zone for the verified domain.
- Create or edit the record type and name requested by the TCPShield panel, normally a CNAME-style destination for a hostname.
- Paste the destination exactly as displayed and save it.
Do not leave an old A record pointing directly to the origin under the same player hostname. If both records exist, resolvers can receive inconsistent answers and some players may still reach the backend.
5. Allow DNS to propagate and test the hostname
Propagation is not instantaneous. TCPShield notes that it can take up to 24 hours in some cases, depending on resolver caches and the previous record’s time to live.
Rank #3
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that is unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world full of surprises.
- SURVIVAL ADVENTURES — Face mysterious foes, travel across varied landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play solo or join friends in local split-screen and cross-platform play across console, mobile, and PC. Online multiplayer supports up to 8 players.
- COMMUNITY PLAY — Connect with players on community servers, or subscribe to Realms Plus (sold separately) to play with up to 10 friends on a private server.
- Check the record with a DNS utility such as
nslookup play.example.netordig play.example.net. - Confirm that the response follows the TCPShield destination rather than the origin IP.
- Join Minecraft using the public hostname and the normal game port. Do not use the backend IP for this test.
Testing through the hostname exercises DNS, TCPShield routing, forwarding, and the origin firewall together. A direct-IP failure after lockdown is expected and is evidence that the bypass path is closed, not evidence that the protected service is broken.
Choose one player-IP forwarding method
| Criterion | TCPShield plugin | Proxy Protocol v2 |
|---|---|---|
| Where it runs | On a frontend machine such as BungeeCord or a front-facing Spigot/Paper server | In TCPShield and in the receiving proxy or server software |
| Player-address handling | Uses a TCPShield-verified proxy handshake | Passes connection metadata through the Proxy Protocol v2 header |
| Compatibility | May conflict with anti-bot, anti-VPN, authentication, or proxy plugins | Useful when those plugins conflict, provided every hop supports Proxy Protocol v2 |
| Origin-authentication strength | The handshake verifies the expected TCPShield proxy connection | Does not authenticate every source as strongly by itself; firewalling is essential |
| Java support | Available where the supported frontend software can load it | Available where the proxy or server supports Proxy Protocol v2 |
| Bedrock/Geyser | Use only the plugin’s documented Geyser path | Use the Bedrock tunnel’s documented Proxy Protocol path |
Option A: install the TCPShield plugin
Install the plugin only on the machine that first receives the protected connection. In a proxy network, that is normally BungeeCord or another frontend proxy. If a single front-facing Spigot or Paper server accepts the connection before forwarding it, that server is the frontend.
- Download the plugin version appropriate for the frontend software from the TCPShield panel or documentation.
- Copy the plugin file into the frontend machine’s
pluginsdirectory. - Restart that frontend and complete any configuration requested by the plugin.
- In the TCPShield settings, keep the production option that permits only verified proxy connections enabled.
- Connect through the public hostname and confirm that the real player address appears in the proxy or server logs.
Do not install the plugin on both the proxy and the game-mode server. The plugin should run on frontend machines, never on both layers. Installing it twice can cause the backend to interpret already-processed connection data as a second handshake.
If the plugin breaks an anti-bot, anti-VPN, authentication, or proxy component, remove it from the connection path rather than disabling security checks at random. Move to Proxy Protocol v2 as described next.
Option B: use Proxy Protocol v2
Proxy Protocol v2 is the compatibility route when a plugin cannot coexist with your stack. It requires a matching setting at both ends: TCPShield must send the protocol, and the receiving proxy or server must be configured to read it.
- Remove or disable the TCPShield plugin from the frontend path. Do not leave both methods active.
- In the TCPShield backend settings, enable Proxy Protocol for the relevant backend.
- Enable Proxy Protocol v2 in the software that receives the connection. Depending on your topology, this may be Paper, Velocity, BungeeCord, or another supported proxy.
- Restart the receiving software and test through the protected hostname.
- Verify that logs show the player’s address rather than the TCPShield relay address.
Only enable this setting when the port receives traffic from a Proxy Protocol-speaking source. A normal Minecraft client does not send a Proxy Protocol header; enabling a strict parser on an unproxied public port can make every connection fail.
Recommended Free Tools
Rank #4
- Skins! We have biome settlers, city folk, town folk, and more!
- The Nether and all its inhabitants. Fight Ghasts and make friends with Pigmen
- Cross platform play for up to five players between Pocket Edition and Windows 10
- Revamped touch controls, controller support, and a controller mapping screen
- Enhanced Weather effects! Accumulating snow and more
Lock the origin firewall so the IP cannot be bypassed
Firewalling is the step that turns a hidden address into an enforceable design. TCPShield recommends firewalling the backend so it accepts connections only from TCPShield sources.
- Open the TCPShield source-range list in the current dashboard or documentation.
- On the origin firewall, allow inbound traffic to the Java TCP port only from those published TCPShield ranges.
- For a Bedrock tunnel, allow the documented TCPShield source ranges and the required UDP port for Bedrock traffic.
- Keep administrative ports such as SSH or remote-console access restricted to your own management addresses; they should not be opened to TCPShield ranges unless your architecture specifically requires it.
- Add equivalent rules for IPv6 if the origin has IPv6 enabled. An IPv4-only rule does not protect an independently reachable IPv6 address.
- Place the allow rules before a final reject or drop rule for the Minecraft ports.
Use the exact ranges TCPShield publishes. Do not substitute a guessed cloud-provider range or the IP addresses returned by a single DNS lookup; relay infrastructure can change.
After applying the rules, test in two directions: join through the public hostname, then attempt a direct connection to the backend IP from a network that is not one of your administrative allowlists. The protected hostname should work, while the direct attempt should time out or be refused. If the direct attempt succeeds, inspect every firewall interface, security group, IPv6 rule, and alternate Minecraft port.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Configure Java networks with proxies
The correct placement depends on where the first Minecraft connection arrives. In a BungeeCord or Velocity topology, TCPShield terminates at the proxy and the proxy forwards to one or more game-mode servers. Put the plugin or Proxy Protocol receiver at that proxy, not on each backend. Then ensure the proxy-to-backend hop uses the forwarding format expected by your server software.
For a single Paper or Spigot server exposed directly behind TCPShield, that server is the frontend and can receive the plugin handshake or Proxy Protocol header. If you later add a proxy, move the TCPShield integration to the new first hop and remove it from the game-mode server.
Keep a written diagram of the path:
player → public hostname → TCPShield → frontend proxy or server → game-mode backend
Best Value
- Play and share with friends on console, mobile and Windows 10
- discover community creations in the new in-game store
- access new mini games and game modes through servers
For each arrow, record the port, protocol, and whether player-IP data is transformed. This makes it easier to identify a mismatch when the connection reaches the proxy but the backend rejects it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use Bedrock and Geyser with TCPShield
Java and Bedrock do not use identical connection behavior. TCPShield states that Java Edition is supported on all plans, while Bedrock support is Premium-only. Bedrock does not provide Java’s virtual-host routing behavior, so TCPShield provisions a dedicated Bedrock tunnel and CNAME rather than treating Bedrock as another Java hostname.
Bedrock preparation
- Confirm that Geyser and the Bedrock listener work directly on the server’s own IP and port before introducing TCPShield.
- Confirm that your TCPShield account has the Premium Bedrock feature available.
- In the panel, create the Bedrock backend or tunnel and enter the correct origin address and Bedrock port.
- Copy the dedicated Bedrock CNAME supplied by TCPShield and publish it exactly in DNS.
- Choose either the tunnel’s documented Proxy Protocol configuration or the plugin’s documented Geyser support. Do not enable both.
- Apply the TCPShield firewall rules for both the TCP and UDP traffic required by your setup.
Bedrock commonly uses UDP, so a firewall that allows only Java’s TCP port can produce a server that appears online to Java players but is unreachable from Bedrock. Check the tunnel’s required port and transport rather than assuming the Java port applies unchanged.
One address for Java and Bedrock
A shared player name can be possible, but it is not achieved by pointing one ordinary Java record at both services. Java and Bedrock may require different DNS behavior. The documented arrangement can involve a Java CNAME plus an SRV record and the dedicated Bedrock tunnel/CNAME. Follow the current Geyser and TCPShield instructions for the exact record names and ports shown in your panel.
Test each edition separately. Join from a Java client using the Java hostname and from a Bedrock client using the Bedrock entry. If you change the shared name, clear cached DNS on the client or test from a second network so an old answer does not hide the change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Verify the finished deployment
- Domain: the panel marks the domain as verified, and the DNS response follows the TCPShield destination.
- Backend: the registered IP and port match the actual origin listener.
- Forwarding: exactly one method is active, and logs preserve the player’s address.
- Firewall: TCPShield source ranges are allowed; unrelated Internet sources are rejected on Minecraft ports.
- Hostname test: Java and, where applicable, Bedrock clients connect through their public hostname.
- Bypass test: a direct origin-IP attempt does not reach the Minecraft service.
- Operations: the team knows which DNS record, backend entry, firewall rule, and forwarding setting must change together if the origin moves.
Troubleshoot the most common failures
| Symptom | Likely cause | Fix |
|---|---|---|
| TCPShield cannot verify the domain | TXT record name or value is wrong, or DNS has not propagated | Copy the panel’s TXT value exactly, check whether your DNS provider expects a host label or full name, wait for publication, and run verification again. |
| Hostname resolves but connection times out | Wrong backend port, origin firewall drop, or DNS still points to an old record | Compare the panel’s backend port with the listening service, inspect firewall and security-group logs, and query DNS from more than one resolver. |
| Players connect but all appear to share one relay address | Forwarding is not enabled or the receiver is reading the wrong format | Choose either the plugin or Proxy Protocol v2, configure the matching receiver, restart it, and verify logs again. |
| Every connection fails after enabling Proxy Protocol | Proxy Protocol is enabled on the wrong hop, or the plugin and protocol are both active | Disable the plugin, ensure TCPShield sends Proxy Protocol to the actual receiving service, and remove the setting from any port that receives ordinary clients directly. |
| Anti-bot or authentication software breaks after plugin installation | A plugin conflict on the frontend | Remove the TCPShield plugin and migrate to Proxy Protocol v2, then restrict the origin firewall to TCPShield sources. |
| Direct origin-IP access still works | An open firewall rule, a second public port, or an IPv6 path remains | Audit host firewall, cloud security groups, router forwarding, all Minecraft ports, and IPv6. Leave only TCPShield source ranges allowed. |
| Java works but Bedrock does not | No Premium tunnel, wrong Bedrock CNAME, missing UDP rule, or incomplete Geyser configuration | Check tunnel eligibility, copy the dedicated CNAME, match the documented Geyser settings, and allow the required UDP traffic. |
| Players intermittently see old DNS behavior | Resolver caching during propagation | Wait for the prior TTL to expire, verify the authoritative record, and test from a resolver that has not cached the old answer. |
Plan and compatibility decisions
For a Java-only server, plan eligibility is not the deciding constraint because TCPShield states that Java Edition is available on all plans. Choose the forwarding method based on your software stack: the plugin is convenient when its verified handshake is compatible, while Proxy Protocol v2 is the practical choice when existing frontend plugins conflict.
For Bedrock or a Java-and-Bedrock community, Premium eligibility is mandatory for the Bedrock tunnel. The tunnel, dedicated CNAME, Geyser configuration, and UDP firewall rules become part of the deployment rather than optional add-ons.
Commercial limits and plan details can change, so check the current TCPShield panel immediately before committing a production network. Public material does not establish a dated independent latency, uptime, mitigation-capacity, or player-capacity benchmark; select a plan for the features and limits it currently lists, not for an assumed performance number.
Quick Recap
Safe maintenance after launch
- Keep the origin IP private in public server listings, screenshots, error pages, and status dashboards.
- When moving the server, update the TCPShield backend and firewall rules as one change, then test the public hostname before decommissioning the old origin.
- Review the published TCPShield source ranges periodically and update firewall entries when TCPShield changes them.
- Document which machine is the frontend so a future administrator does not install the plugin on every backend.
- Retest Java and Bedrock separately after changing DNS, proxy software, Geyser, or firewall policy.
- Keep a rollback plan that restores the previous backend entry and DNS record without reopening the origin to the entire Internet.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
