I wanted somewhere to run a Minecraft server for five friends. That was the whole plan. What I did not expect was how many good questions one Minecraft server would raise about networks, and how much I would enjoy chasing each one down.
The container that started it
The Minecraft server still has its own container. In my Proxmox inventory it is LXC 207, its role is “Minecraft and WireGuard tunnels”, and it was running when I last recorded the lab. Crafty Controller manages it.
A container in Proxmox, an LXC, shares the host’s kernel instead of booting its own operating system the way a virtual machine does. For one service like a Minecraft server for my friends that keeps it light, and it lets the server sit beside everything else on the same laptop.
My home connection is behind carrier-grade NAT, so nothing on the internet can open a connection to it. The WireGuard tunnels in LXC 207 reach out to VPS hosts instead, and players connect to those. That one constraint, not being reachable, shaped the whole design: every service I added later had to answer “how does traffic get in, if anything can get in at all?”
How one server became a lab
Each answer led to the next question:
- Where does traffic enter, and what sits in front of it? That became Proxmox as the host and Sophos Firewall between the outside network and the inside, traced hop by hop in Follow a packet through my Proxmox lab.
- Who should reach the admin pages, and from where? That became Twingate and NetBird, compared in Who can reach what?
- Who is on the Windows machines, and what did they do? That became Active Directory, in Running Active Directory in my lab.
- Who may join the Minecraft server? That one came back round to Minecraft itself, when port scans showed up. Five friends, one Minecraft server covers the port, the whitelist and the SRV record.
The same environment is now where I work on my thesis.
What the Minecraft server taught me first
The most useful habit came from the very first service: before adding anything, write down how traffic reaches it and what decides who gets in. For the Minecraft server, the answer was a tunnel for the path and a whitelist for the decision. Every later service on the lab map has the same two answers written beside it.
Takeaway: a homelab grows one question at a time. Start with the service you actually want, and let its access path decide what you build next.
Skills used
- Working around carrier-grade NAT
- Planning services before building them
Tools in this entry
Minecraft Java Edition server In my lab
Official documentation for Minecraft Java Edition server- Crafty Controller In my lab
Official documentation for Crafty Controller 
WireGuard In my lab
Official documentation for WireGuard
Proxmox VE In my lab
Official documentation for Proxmox VE