1

I am trying to connect to a Minecraft server but get a connection Timeout when tryping to connect although the Server is showing up as online

Minecraft Multiplayer screen

This question meight seem out of place, but wait.

The minecraft server is running on an Proxmox Container. The Proxmox container is running on a Home-Server. The Home-Server connects to an Wireguard Server running on Linode.

So I route the Trafic comming to the public Linode Server to the Homeserver over wireguard and on the Homeserver, I route the trafic again, to the Minecraft server and Back.

Routing

For the Routing part I used nftable nat rules on both the linode Server and the proxmox server. Here is an example from the Linode server.

table ip nat {
        chain prerouting {
                type nat hook prerouting priority dstnat; policy accept;
                tcp dport 25565 dnat to 192.168.0.46
                udp dport 25565 dnat to 192.168.0.46
        }

        chain postrouting {
                type nat hook postrouting priority srcnat; policy accept;
                masquerade
        }
}

As the basic comunication to the server seems to work, I am really confused why I can't connect.

Maybe somebody can help me decipher the Wireshark log from the Minecraft client.

Minecraft client Wireshark log

Any help, suggestions or questions are more than welcome, as I have sunken more hours into this, than I am willing to admit.

Cheers Leo

PS.: I have no clue if the title is even remotely correct, so please correct me. :)

leonard georg
  • 21
  • 4
  • Not needed now but `nft monitor` and using a `meta set nftrace 1` rule in your firewall rules greatly assists in debugging your firewall packet flow (how it jumps around one chain to another and the ultimate verdict it gets). – Matthew Ife Aug 23 '23 at 09:31
  • thank you, I will take a look at it :) Wasn't the first time debugging, won't be the last ^^ – leonard georg Aug 23 '23 at 11:31

1 Answers1

1

Found it! It was caused by the wireguard config. The default MTU was too big for my configuration. I lowered it to 1392 (I think) and it works like a charm.

For anyone wondering. Wireguard doesn't account for IPv4 through IPv6 tunneling, used by many ISP's these days to save on IPv4 addresses. This increases the header of the tcp packets and everything falls apart.

leonard georg
  • 21
  • 4