Can't connect from internet. Server immediately resets the connection.

[dutsnekcirf]

I setup a Nukkit server (CentOS 7 VM in VMware ESXi server. nukkit-1.0-SNAPSHOT.jar) about two weeks ago and it all went very well. My daughter has been playing on it for a while now and I gave her OP privileges. For the last 4 or 5 days; though, no one else has been able to connect to the server from the internet.

Internal access to the server appears to work fine which causes one to think that the port forwarding is incorrectly configured. To support that statement; portcheckers.com reports that port 19132 is closed as well. However, using tcpdump on the server I can see that a SYN packet comes in from portcheckers.com and then the server immediately responds with a RST ACK packet. The server is immediately resetting the connection and no TCP connection is established. The fact that I see the SYN packet come into the VM tells me that my port forwarding is configured correctly on my router (pfsense) and that the server itself is denying the connection for some reason.

Here is a snippet of my tcpdump output:

[root@browncraft ~]# tcpdump -i ens33 -nntl port 19132
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes
IP 104.238.162.245.44768 > 192.168.2.3.19132: Flags [S], seq 2547224028, win 29200, options [mss 1460,sackOK,TS val 2089737352 ecr 0,nop,wscale 7], length 0
IP 192.168.2.3.19132 > 104.238.162.245.44768: Flags [R.], seq 0, ack 2547224029, win 0, length 0
IP 104.238.162.245.44770 > 192.168.2.3.19132: Flags [S], seq 2930313019, win 29200, options [mss 1460,sackOK,TS val 2089737355 ecr 0,nop,wscale 7], length 0
IP 192.168.2.3.19132 > 104.238.162.245.44770: Flags [R.], seq 0, ack 2930313020, win 0, length 0

Clearly 104.238.162.245 is the IP of portcheckers.com and 192.168.2.3 is the IP of my server.

By way of troubleshooting I've disabled the firewall on the server and can still observe the same behavior. I've also attempted to install Nukkit on an entirely new VM and run it on a new port; 19133, and it still behaves the same way. If I; instead, install PocketMine (An inferior product in my mind) on the VM then portcheckers.com actually reports the port as being open. The fact that I can successfully establish a TCP connection from portcheckers.com to the same VM but running PocketMine tells me that it's a configuration specifically related to my Nukkit installation.

Is it possible that my daughter; with OP privileges, could have disabled something on the server unknowingly? Is there something in server.properties that I need to adjust? Here's what my server.properties looks like:

[root@browncraft minecraft]# more server.properties
#Properties Config file
#2018-12-27 04:18:07
motd=Nukkit Server For Minecraft: PE
sub-motd=Powered by Nukkit
server-port=19132
server-ip=0.0.0.0
view-distance=10
white-list=off
achievements=on
announce-player-achievements=on
spawn-protection=16
max-players=20
allow-flight=off
spawn-animals=on
spawn-mobs=on
gamemode=0
force-gamemode=off
hardcore=off
pvp=on
difficulty=1
generator-settings=
level-name=world
level-seed=
level-type=DEFAULT
allow-nether=on
enable-query=on
enable-rcon=off
rcon.password=*REDACTED*
auto-save=on
force-resources=off
bug-report=on
xbox-auth=on

Thank you for any consideration.

 

[SupremeMortal]

Minecraft Bedrock Edition does NOT use TCP like Java but UDP. Looks like that might be your problem.

 

[dutsnekcirf]

That's interesting. So I suppose I should not expect portcheckers.com to be able to report that the port is open since it only attempts to establish a tcp connection. If I attempt to use https://portscanner.standingtech.com/ it allows me to specify UDP in the port scan. It's behaving the same way with UDP. Here's the tcpdump output when using UDP.

IP 104.131.180.108.39756 > 192.168.2.3.19132: Flags , seq 3017696556, win 29200, options [mss 1460,sackOK,TS val 85233982 ecr 0,nop,wscale 8], length 0
IP 192.168.2.3.19132 > 104.131.180.108.39756: Flags [R.], seq 0, ack 3017696557, win 0, length 0

Here's another weird behavior. If my daughter attempts to connect from outside the house over the internet it works. She was able to access the server from her friend's house. However, if anyone else attempts to connect they fail to reach the server. This again makes me think there's something regarding the configuration of my server that is preventing others from connecting to it and that the port forwarding is configured correctly. But I would still expect a port scan from the internet to indicate that the port is open.

my white-list.txt file and banned-players.json are both empty. ops.txt only includes my daughter's xbox live account.