Computers can perform a variety of tasks. Some are more productive than others. My recent blog post shows how to authenticate to any service, such as Grafana. Some people saw the idea of Tailscale being used to authenticate to any service as a cool fact. Others saw it as an opportunity to investigate new ways to use Tailscale authentication. Here's a story of one such instance. This is how you can make your Minecraft server join your tailnet, and then authenticate to it via Tailscale. One big question you may be asking is "Why do you want to do this?" MINECRAFT I would like to answer this with a different question: "Why not?" As a great man has stated, "Science isn't about 'why?' Games it's about 'why not?'" We take this concept seriously at Tailscale. Putting your Minecraft server into your tailnet with Tailscale to authenticate gives you these advantages: You can restrict access to your Minecraft server to just your tailnet to ensure that only those you know can access it. - You can use ACLs to limit access further (if you want to allow everyone but the known griefer to connect). - You can attribute Minecraft users to Tailscale users to allow you to keep a more accurate track of who is on the server. - You do not have to modify your Minecraft server with Forge, Bukkit, Paper or Spigot mods, this lets you use a fully vanilla setup with very little extra configuration. You can use Node Sharing to connect your friends, colleagues in blood, and even squadmates to your Minecraft server without having expose your server to the internet's scary whimsies. You can also share it with your hopefully less terrifying friends on your tailnet already. The Minecraft server will show up on your tailnet like any other computer. There are also plenty of disadvantages to this product: - This will not work with the Bedrock version of Minecraft (the one that runs on phones, consoles, and tablets). If you are unsure what version of Minecraft you have, check here to find out how you can tell the difference between the two. You must disable the Minecraft server's authentication stack. If your server is able to connect on the internet it allows anyone to join it. This is the opposite of what we're looking for here. - You may be able to overcome this issue by making server-side mods, but those are out of scope for this article as we're focusing on using unmodded Minecraft clients and servers. You can use a different email address to avoid this issue in the event of. This is done by creating an authentication proxy, much like the one we created previously with Grafana. The proxy will monitor traffic on your tailnet and then forward it to the Minecraft server, with one important exception. At the start of a Minecraft session the client will transmit to the server a packet containing the username of the user trying to log in. Normally the server is supposed to examine the contents of that packet and verify it against Mojang authentication servers to ensure that you are actually authenticating as the username in your Minecraft launcher. Based on the result, the server will allow or deny connection. Instead of relying upon Mojang for authentication , we could make use of Tailscale to rely on Tailscale as authentication. If we also used Mojang for authentication, the proxy will look up Tailscale identity information for that Minecraft session and replace the Minecraft username that the client provided you with the information about the user from Tailscale however Mojang's authentication servers would have no idea what to do with this. We just bypass them with offline mode in Minecraft, which does not require any authentication. After the authentication process The proxy will then forward Minecraft traffic just like any other proxy. Then you can create and mine to your heart's delight with people you trust. You'll be able chat with your coworkers and create great things together. Setup If you're planning to set up this on your tailnet, you'll have to use the patched version proxy infrared. Infrared is commonly used by Minecraft server networks to host huge Minecraft servers that can accommodate up to thousands of total players at once However, it's also general enough that it can be used to make a proxy connection to a vanilla Minecraft server. You can configure everything the same way you would with infrared. But, be sure you change the environment variable TS_AUTHKEY for an authkey that is new. If you have the key tagged to your account, your Minecraft server's node key will not expire, so it stays connected to your tailnet which allows you to craft and mine for the rest of your life! Something to keep in mind is that infrared will require you to connect with the full domain name of the Minecraft server. This is crucial. We will use the MagicDNS domain that every tailnet gets for free. Assuming your Minecraft server is on port 25565, copy the following into configs/tailscale.json: You can find this domain by visiting the DNS settings page and searching for the domain that ends in .beta.tailscale.net - it should be your account's domain followed by .beta.tailscale.net. Add minecraft-proxy. To get your full domain name, add minecraft-proxy at the end of this line. Make sure that you set server-ip to 127.0.0.1 and server-port to 25565 within your server.properties file to ensure that it doesn't listen on the internet for public access: You can reach us on Twitter @Tailscale if you have any other ideas or inventive ways to utilize computers. TJ Horner was the main contributor to the creation of this stunning creation. I hope this was enlightening.