Point Players at Your Protected IP

Once your tunnel is up, players need to connect to your protected address instead of your server's own IP. This guide covers the three places that address has to go: your DNS records, your game's own settings, and the server lists that advertise your server.

Not set up yet? Start with How to Set Up Your GRE Tunnel With the Installer.

Find your protected address

Open Services, choose your service and go to the Network tab. Your protected addresses are listed under Assigned IPs, each with a copy button: an IPv4 address, plus an IPv6 address if you turned IPv6 on.

Origin IP, above them, is your server's own address. That is the one to keep private.

Give players a hostname, not an IP

Share a name like play.example.com instead of a bare IP. If you ever need to change the address, you change one DNS record instead of telling every player.

At your DNS provider:

• Add an A record for the name, pointing at your protected IPv4 address.
• If you have a protected IPv6 address, add an AAAA record pointing at it too.
• Delete or change any record that points at your server's own IP. One forgotten record is enough to give the address away.

Using Cloudflare for DNS? Set these records to DNS only (the grey cloud). Cloudflare's proxy only carries web traffic, so game connections through an orange-cloud record fail.

Minecraft Java on a custom port: add an SRV record

On the default port, 25565, the A record is all you need. On any other port, an SRV record lets players type just the name, without :port.

Create an SRV record with:

• Name: _minecraft._tcp.play (for play.example.com)
• Priority: 0
• Weight: 5
• Port: your server's port, for example 25566
• Target: a hostname with an A record pointing at your protected IP, for example mc.example.com. It must be a name, not an IP address.

Bedrock does not read SRV records, so Bedrock players enter the name and the port.

Make your game use the protected IP

This step is easy to miss, and it decides what the server lists show.

The tunnel carries traffic sent from your protected address. A game that listens on all addresses answers players correctly, because replies go out from the address the player connected to. But connections the game opens itself, like the heartbeat that puts it on the Steam or FiveM server list, leave from your server's own IP. The list then shows that IP, and players who join from the list skip your protection entirely.

The fix is to bind the game to the protected IP. The installer has already added that address to your server, so the game can use it:

• Rust: add +server.ip <protected IP> to the start command.
• Garry's Mod and Team Fortress 2: add +ip <protected IP> to the start command.
• ARK: add ?MultiHome=<protected IP> to the launch options.
• FiveM: in server.cfg, use endpoint_add_tcp "<protected IP>:30120" and endpoint_add_udp "<protected IP>:30120".
• Minecraft: set server-ip=<protected IP> in server.properties. Minecraft has no central server list, so this matters only if the server is bound to its own IP today; on listing sites, register your hostname.
• Other games: look for an IP, bind or multihome option in the server config or start command, and set it to the protected IP.

Restart the server after the change.

Check that it worked

Run these on your server:

curl --interface <protected IP> https://ifconfig.me

This should print your protected IP. If it does, traffic sent from that address is going out through Sterile.

ss -tulpn | grep <port>

Your game should be listening on the protected IP or on 0.0.0.0 (all addresses), not only on your server's own IP.

Then find your server in the game's own server browser and check the address it shows. Lists can take a few minutes to update after a restart.

Your server's own IP

Anyone who already knew your server's own IP can still send traffic straight to it, around the protection. Do not publish it again anywhere: not in Discord, not in old DNS records, not on a website hosted on the same server. If attacks keep reaching it directly, ask your host for a new IP and keep that one private. Origin IP protection explains the usual ways an address leaks.

Next steps

• Add a rule for each port players use, in How to Add a Service Rule for Your Game Server.
• Not sure which ports your game uses? See the game server ports reference.

Players still reaching the old address, or the server list showing the wrong IP? Create a ticket with your game and what the list shows, and we will take a look.