How to Set Up TCPShield for Your Minecraft Server

What Is TCPShield?

TCPShield is a reverse proxy service built specifically for Minecraft. It sits between your players and your server, filtering malicious traffic before it reaches you. Unlike generic DDoS protection services, tcpshield minecraft server integration understands the Minecraft protocol and can filter attacks at the application layer without breaking gameplay.

When players connect, their traffic flows through TCPShield's network first. Clean traffic is forwarded to your actual server, and the player's real IP is preserved using the PROXY protocol or a plugin.

Setting Up TCPShield

Step 1: Create an Account and Add Your Domain

Sign up at TCPShield's website and add a new network. Point your domain's DNS records to TCPShield's provided CNAME. For example, if your domain is play.example.com, create a CNAME record pointing to the address TCPShield gives you.

Step 2: Configure the Backend

In the TCPShield dashboard, add a backend set with your server's real IP and port. TCPShield will route traffic to this address. If you run multiple servers behind a proxy like Velocity, point TCPShield at your proxy's IP.

Step 3: Install the TCPShield Plugin

Without the plugin, your server sees TCPShield's IPs instead of players' real IPs. Download the official TCPShield plugin for your server type (Spigot, Paper, BungeeCord, or Velocity) and place it in the plugins folder. Restart the server. The plugin automatically handles IP restoration for a tcpshield minecraft server setup.

Step 4: Restrict Direct Access

If players can still connect directly to your server IP, they bypass TCPShield entirely. Use firewall rules to only allow traffic from TCPShield's IP ranges. TCPShield publishes their IP list in their documentation. On Linux:

# Allow TCPShield IPs
ufw allow from 205.185.208.0/22 to any port 25565
# Deny all other access
ufw deny 25565

Check TCPShield's documentation for the current IP ranges, as they may change.

DNS Configuration

Replace your A record with the CNAME provided by TCPShield. If you previously used an SRV record, you will need to update it to point at the new CNAME instead of your direct IP. Propagation can take up to 48 hours, though it typically completes within a few minutes.

Testing Your Setup

• Connect through your domain. You should join normally.
• Check the server console for your real IP (not a TCPShield IP) in the login message.
• Try connecting directly to your server's IP. It should be blocked by your firewall.

Using tcpshield minecraft server protection alongside other DDoS mitigation strategies gives your network strong resilience against attacks. For home-hosted servers, also consider protecting your home IP.

TCPShield is one of the most popular choices for tcpshield minecraft server protection because it requires minimal configuration and supports the full Minecraft protocol out of the box.

See a polished network in action: Astroworld MC, IP play.astroworldmc.com, Java + Bedrock.