Unwanted players joining your Minecraft server can quickly destroy your hard work before you have a chance to kick them out. The good news is since you’re using ngrok, you can restrict access to your Minecraft server by only letting in a specific set of IP addresses.
This example is focused on securing your Minecraft server using Traffic Policy. For more general instructions on using ngrok with Minecraft, including limitations of our free plan and troubleshooting common issues, see our using ngrok with Minecraft guide.

​
1. Create a Traffic Policy file

On the system where your Minecraft server runs, create a file named minecraft.yaml and paste in the policy below, replacing $YOUR_IP and $FRIEND_IP with public IPs. If you or your friends don’t know theirs, ngrok has a simple helper page that returns your public IP address. 
on_tcp_connect:
  - actions:
      - type: restrict-ips
        config:
          enforce: true
          allow:
            - $YOUR_IP/32
            - $ANOTHER_FRIEND_IP/32
What’s happening here? This policy checks whether every TCP connection originates from an IP address matching one on the allow list. If they match, the policy allows them connect to your ngrok agent and your Minecraft server, but if they don’t, ngrok denies the request.

​
2. Start your Minecraft endpoint

On the same system where Minecraft runs, start your ngrok agent on port 25565, which is the default for Minecraft, and include the minecraft.yaml file you just created. 
ngrok tcp 25565 --traffic-policy-file minecraft.yaml
Once the agent starts, take note of the random public TCP address assigned to your Minecraft server, like tcp://8.tcp.us-cal-1.ngrok.io:10891.

​
4. Try out your Minecraft endpoint

You and others can now connect to your Minecraft server at the public TCP address. As long as your IPs match those in the allow list, you’ll be able to connect.

​
Optional: Get a permanent TCP address

With a production pay-as-you-go account, you can reserve a permanent TCP address for your Minecraft server, which means you and others won’t need to change the URL after restartng the server or its host machine. Navigate to the Domains section of the ngrok dashboard and click New + to reserve the TCP address. Next, restart your agent, replacing tcp://1.tcp.ngrok.io:12345 with the TCP address you reserved. 
ngrok tcp 25565 --url tcp://1.tcp.ngrok.io:12345 --traffic-policy-file minecraft.yaml

​
What’s next?

  • Read our Minecraft guide for details on free plan limitations and troubleshooting.
  • View your Minecraft traffic in Traffic Inspector to verify that your IP restrictions are working.
  • Track your monthly bandwidth and Traffic Policy executions on your usage page to stay aware of any limitations you might reach, particularly on ngrok’s free plan.
  • Read more about Traffic Policy, core concepts, and actions you might want to implement next.