Documentation

A private Minecraft server with friends, no port forwarding

You set up a Minecraft server on your PC, and the first tutorial you find tells you to forward port 25565 on your router. There is another way: the server and your friends join the same private network, everyone connects by the machine's name, and nobody else on the Internet can even see the server exists. No port forwarding, no router configuration — at your place or theirs.

Why opening port 25565 is a bad idea

A Minecraft Java server listens on port 25565 by default. For friends to join from their homes, the classic method is to create a port forward on the router: tell it "whatever arrives on 25565, send it to my PC". That is exactly where the trouble starts.

An open port is a scanned port

A port opened to the Internet is an exposed service: it gets scanned constantly by bots, and 25565 is a well-known port. Every flaw in the software listening there becomes exploitable from anywhere — with your home network sitting behind it.

The configuration chore

The router's admin interface, a forwarding rule to create by hand, a public IP address that changes, CGNAT on 4G/5G and many recent fiber connections where there is simply no port to open: half of every "my friends can't connect" thread comes from here.

The rented host: a different trade-off

Renting a hosted server works, but it is a running subscription, and your world lives on someone else's machine. For a server among friends, running it at home and making it reachable privately is often the best of both worlds.

The private network approach: reachable by your friends, invisible to the rest

With VIGIL-MESH, the machine hosting the server and your friends' machines join the same workspace: a private, encrypted network that links your machines together, over the Internet. Each machine gets a stable address and a name, and only makes outbound connections — no inbound port is opened, at your place or theirs.

Your friends connect to the server by the machine's name (MagicDNS) or its stable address — the same one wherever it physically sits.
Traffic is encrypted end to end (QUIC/TLS 1.3) and takes a direct peer-to-peer path whenever one exists; until then, a blind relay bridges the gap, and the session migrates over without a cut.
Access policies are deny by default: only members of your workspace can reach the server. To the rest of the Internet, it does not exist.
Nothing to configure on the router — not yours, not your friends', not the student residence's or the 4G hotspot's.

In the game, nothing changes: everyone adds the server using the host machine's name instead of a public IP address, and connects to it like any other server. The name survives network changes — no new address to send around the group every time.

What about "Open to LAN"?

Minecraft can also share a single-player world without a dedicated server: the "Open to LAN" mode announces the game on the local network, and other players on the same network see it appear on its own. Through an ordinary VPN, that announcement gets lost — it relies on local broadcast, which routed VPNs drop.

Every VIGIL network is a real broadcast domain: the "Open to LAN" announcement crosses the encrypted mesh and reaches every member, as if everyone were plugged into the same switch. The game shows up in your friends' local games list, wherever they are.

Bring the server online — for your friends only

1
Create your workspaceOpen a VIGIL-MESH account — free for personal use. A workspace is created for you: it will be your server's private network.
2
Install the client on the server machineInstall the VIGIL-MESH client on the machine running the Minecraft server — Windows or Linux — then enroll it from the console: Networks page, Machines panel, "Add a machine". A single-use key handles the attachment.
3
Invite your friendsInvite the other players into your workspace. Each installs the client on their gaming machine and attaches it to the network — the same sequence, at their place, without touching their router.
4
Check connectivityIn the console, each machine shows up with its stable address and its name. A ping to the host machine's name confirms everyone can see each other.
5
Add the server in the gameEach player adds a multiplayer server using the host machine's MagicDNS name as the address, and connects — exactly as if the server were on their local network.

The server runs at your place, your friends reach it by its name, and port 25565 never leaves your private network.

Frequently asked questions

Does it add lag?

VIGIL-MESH establishes a direct peer-to-peer path between each player and the server whenever one exists: packets go from machine to machine with no detour through a central server. When the connection starts over the relay, the migration to the direct path happens without a cut — the game in progress notices nothing. No one can promise you a specific ping, but the path taken is the shortest one available.

Is it free?

Yes, VIGIL-MESH is free for personal use — and a Minecraft server with friends is exactly that. Direct peer-to-peer traffic is unlimited.

Does it work with a modded server (Forge, Fabric, plugins)?

Yes, same principle. To the network, a Minecraft Java server — vanilla, modded or with plugins — is still a service listening on TCP that clients reach by an address: nothing changes in how it is reached across the mesh. Mods remain a matter for the game itself, as usual.

Do I still need a whitelist?

On the mesh, only members of your workspace can reach the server: everything else is refused by default (deny by default), and the server is not exposed to the Internet — automated scans never see it. The in-game whitelist remains good practice, but it is no longer your only line of defense.

Can friends on 4G/5G or behind CGNAT join?

Yes. Each machine only makes outbound connections on 443 UDP — which a CGNAT lets through. The connection comes up immediately over the relay, then migrates without a cut to the direct path once NAT traversal succeeds. If direct is impossible, traffic stays relayed through the blind relay, encrypted end to end.