How to Set Up a Minecraft Server on a VPS

Before you put Minecraft on a VPS

The first few players rarely expose a Minecraft server’s limits. Five minutes later, three of them may be exploring different chunks, generating new terrain while a plugin saves data and the operating system waits on storage. That is when a VPS that looked comfortably sized starts feeling very small.

I plan the resources before downloading the server JAR. The examples below use Ubuntu Server 24.04 LTS, Minecraft Java Edition 1.21.x, and Paper. Paper is a sensible choice when you want plugin support and useful performance settings without straying too far from vanilla Minecraft. If you choose vanilla, the JAR name and start command change; the user, firewall, and backup work still apply.

CPU and RAM are only starting points

Minecraft is sensitive to single-thread CPU performance. One world’s main game loop may not benefit much from a provider’s “8 vCPU” label, especially when those virtual CPUs are shared. I check the provider’s CPU policy, processor generation, and storage type instead of counting cores alone.

My own 10 Essential Steps to Secure and Harden Your Linux Server checklist starts with choosing an environment I can understand and monitor.

These are starting points, not promises. World generation, view distance, mob counts, and plugin behavior can matter as much as player count. If the VPS runs other services, physical RAM is not all available to Minecraft.

On a 4 GB VPS, I normally leave roughly 700 MB to 1 GB for the operating system, SSH, monitoring, and filesystem cache. Setting the Java heap to -Xmx3G may look efficient, but allocating nearly everything to Java can push the machine into swap. If you need swap, see How to Create Swap Space on a VPS for Linux Memory Management. Swap is not RAM.

Prepare the VPS without doing everything as root

Logging in as root and running every command directly is convenient. It also makes a bad plugin or an incorrect command much more dangerous. I create a separate account for the Minecraft process and keep administrative work separate from game data.

ssh root@SERVER_IP
apt update && apt full-upgrade -y
apt install -y sudo
adduser --disabled-password --gecos "" minecraft
usermod -aG sudo minecraft
hostnamectl set-hostname mc-01

Replace mc-01 with your own hostname. My production prompts are red, and my test machines have distinct hostnames. I once got within one keystroke of running rm -rf on the wrong server; the hostname in the terminal stopped me. Since then, checking the hostname has been a pre-flight check, not a vague good habit.

If you use SSH keys, copy yours to the new account:

ssh-copy-id minecraft@SERVER_IP

Do not disable root SSH access until you have tested a separate session as minecraft. After that test succeeds, restrict root and password authentication in /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no

Validate the configuration before applying it:

sshd -t && systemctl reload ssh

Changing the SSH port is not security by itself. I prefer fail2ban and nftables, while still reading the logs to see what actually reaches the server. The Minecraft port will be public, so do not skip the checks in 10 Essential Steps to Secure and Harden Your Linux Server.

Install a Java version that fits the server

The Java version must match the Minecraft and Paper versions. For Minecraft 1.20.5 and later, Java 21 is the normal starting point for the Paper releases I use. Check the release notes for your exact build before installing anything.

apt install -y openjdk-21-jre-headless curl wget unzip ufw
java -version

The output should show Java 21, for example openjdk version "21.0.x". Minecraft 1.20.4 and older commonly use Java 17, but the server and Paper documentation should decide the final version.

The JRE is enough to run the server. There is no need for a full JDK unless you have another task that actually requires one.

Download and start Paper

Switch to the Minecraft account and create a dedicated working directory. This layout makes version changes and backups less confusing.

su - minecraft
mkdir -p /home/minecraft/server
cd /home/minecraft/server
wget -O paper.jar 'PAPER_DOWNLOAD_URL'
ls -lh paper.jar

Replace PAPER_DOWNLOAD_URL with the download link for your selected Minecraft version from Paper’s official download page. I am not hard-coding a URL because Paper releases change. Do not run a random JAR because its filename looks familiar; compare its SHA-256 checksum with the published value.

sha256sum paper.jar

If the value does not match, stop there. This check takes seconds.

The first start creates the EULA file and normally exits immediately:

cd /home/minecraft/server
java -Xms2G -Xmx3G -jar paper.jar --nogui

Read the EULA. If you accept it, update the value:

sed -i 's/^eula=false$/eula=true/' eula.txt

Start the server again and wait for the world to generate. Initial map generation can produce a short burst of CPU and disk activity, so do not judge the VPS from that first minute alone.

Heap size, view distance, and actual performance

-Xms sets the initial Java heap, while -Xmx sets its upper limit. They do not have to be identical on a small VPS. Leave room for the operating system.

On a 4 GB machine, I usually begin with -Xms2G -Xmx3G. On an 8 GB machine, I might allocate 5-6 GB, depending on the plugins and player count. More heap does not fix every performance problem. If the main CPU thread cannot keep up with chunk generation, adding another 4 GB will not repair the TPS.

These are conservative starting values in server.properties:

view-distance=8
simulation-distance=6
online-mode=true
motd=Friends' Minecraft Server
max-players=10

view-distance controls how many chunks are sent to a player. simulation-distance controls the area where entities, redstone, and similar mechanics remain active. Raising both without a reason increases CPU work, especially on a small VPS.

When performance is poor, measure before changing settings. Check Paper’s timings or profiling tools alongside CPU load, memory pressure, disk activity, and player movement. I have seen “the server needs more RAM” become the diagnosis simply because someone looked at memory usage and stopped there.

Let systemd own the process

Leaving an SSH session open with java running in the terminal is fine for testing, not for a live server. tmux can preserve a session when SSH drops (I moved away from screen years ago), but systemd gives the service a proper boot sequence, restart policy, and log location.

Create the service file as root:

exit
vim /etc/systemd/system/minecraft.service

[Unit]
Description=Minecraft Paper Server
After=network-online.target
Wants=network-online.target

[Service]
User=minecraft
Group=minecraft
WorkingDirectory=/home/minecraft/server
ExecStart=/usr/bin/java -Xms2G -Xmx3G -jar paper.jar --nogui
Restart=on-failure
RestartSec=10
TimeoutStopSec=60

[Install]
WantedBy=multi-user.target

User=minecraft matters. The server does not run as root, so a vulnerability in Paper or a plugin does not automatically grant unrestricted access to the operating system. It is not a complete security boundary, but removing unnecessary privileges still helps.

systemctl daemon-reload
systemctl enable --now minecraft
systemctl status minecraft --no-pager

You should see active (running). If it fails, do not restart it repeatedly. Read the logs:

journalctl -u minecraft -n 100 --no-pager
journalctl -u minecraft -f

While repairing a server that failed to boot after a kernel update, I had to work through rescue mode and chroot. That incident reminded me to take a snapshot before a significant change. I do that before Java or plugin updates now.

Open only the required network ports

Minecraft Java Edition uses TCP 25565 by default. Open only the traffic you need with UFW:

ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw allow 25565/tcp
ufw enable
ufw status verbose

If SSH uses a non-standard port, replace OpenSSH with the actual port rule. Before enabling the firewall, verify a second SSH connection without closing the current one. Otherwise, you can lock yourself out of the VPS.

Bedrock players need more than a Java server. A bridge such as GeyserMC and usually a UDP port are required. If you are serving Java Edition only, do not open an unnecessary UDP rule.

Give players a hostname

An address such as mc.example.com is easier to share than an IP address. Add an A record pointing that name to the VPS IPv4 address. If you use IPv6, check that the AAAA record points to the intended server; a wrong AAAA record can affect only some players, which makes the problem particularly annoying.

dig +short A mc.example.com
dig +short AAAA mc.example.com

When DNS is involved, I go to the terminal before the control panel. If dig +short does not return the address you expect, changing Minecraft settings will not help. If the server uses a non-default port, players must connect with an address such as mc.example.com:25570. An SRV record can hide the port, but an A record is simpler for a first setup.

Whitelist first, plugins second

When the server is running, use its console to grant yourself operator access and enable the whitelist:

op PLAYER_NAME
whitelist on
whitelist add PLAYER_NAME
save-all

A whitelist prevents unknown players from entering a private world. Give OP privileges only to accounts that need them. Plugin administrators are not root, either; a malicious or outdated plugin can still damage every file the Minecraft user can access. Do not test an unknown JAR on a live server.

Paper plugins go in /home/minecraft/server/plugins:

install -d -o minecraft -g minecraft /home/minecraft/server/plugins
systemctl stop minecraft
cp plugin.jar /home/minecraft/server/plugins/
chown minecraft:minecraft /home/minecraft/server/plugins/plugin.jar
systemctl start minecraft

Run these commands with root privileges. Add plugins one at a time so you know which change caused a problem. If you want container-based management, see How to Install Docker on a VPS and Run Your First Container. Docker does not remove the need to understand Java, storage, or backups.

A running world is not a backup

A Minecraft world contains hours of other people’s work. Disk failure, a bad plugin, a corrupted chunk, or an abusive player can make it unusable.

For a consistent backup of a small server, I prefer saving the world and briefly stopping the service:

systemctl stop minecraft
tar -czf /var/backups/minecraft-$(date +%F).tar.gz 
  -C /home/minecraft/server world world_nether world_the_end server.properties whitelist.json ops.json
systemctl start minecraft

This creates a local archive. A file on the same VPS will not save you if the VPS disappears. Copy it to external storage with rsync or borgbackup, then test the restore. A backup that has never been restored is only a hopeful pile of bytes.

Once a month, I extract one archive into a temporary directory and check that the world files are present and readable. Testing is part of taking the backup.

You can automate this with cron, but check the schedule twice. I once added an extra asterisk to a cron entry; the backup script ran every minute and a mail queue grew behind it. A tiny syntax mistake can turn into an expensive night in systems administration.

Monitor the game, not just the port

Uptime Kuma can tell you whether the port responds. It cannot tell you whether the game is running well. Sending CPU, RAM, disk usage, and disk latency to Prometheus with node_exporter, then viewing them in Grafana, gives a more useful picture.

In my homelab, a failing fan once made the temperature graph climb in steps. The graph warned me before the players did.

To inspect disk usage:

df -h
ncdu -x /home/minecraft/server

The -x flag matters: ncdu stays on the same filesystem instead of wandering into mounted paths. If the world directory grows unexpectedly, inspect world generation, log files, and plugin caches.

If the service is running but nobody can connect:

systemctl status minecraft --no-pager
ss -ltnp | grep 25565
ufw status
mtr -rwzbc 20 mc.example.com

The ss output should show Java listening on the port. If the port is listening, the firewall is open, and DNS is correct, use mtr to inspect the network path. Packet loss at an intermediate hop is not automatically a Minecraft problem; some routers limit ICMP responses.

When players say “there is lag,” separate TPS, CPU load, and network latency. Lowering view distance may reduce CPU pressure, but it will not fix high ping. Adding RAM will not remove an entity flood caused by a broken plugin.

Check these before sharing the address

• Does the Java version match the Minecraft and Paper versions?
• Does the server run as minecraft instead of root?
• Will it start after a reboot with systemctl enable minecraft?
• Does UFW expose only SSH and the required Minecraft port?
• Is the whitelist enabled, with OP accounts limited?
• Do you have an external backup that has been restored successfully?
• Do you have alerts for CPU, RAM, disk usage, and service status?

If you cannot answer yes to all of these, wait before announcing the server. I still catch myself saying “it works for now” and postponing monitoring or backups. That is how a small maintenance task becomes a night shift.

Questions I hear often

How much RAM does a Minecraft server need?

A Java server for 2-5 players with few plugins can start with 2 GB, but the operating system also needs memory. As player count, mods, view distance, and world generation grow, 4 GB or more may be necessary.

Which Java version should I use for a Minecraft VPS?

Minecraft 1.20.5 and newer versions generally use Java 21, while older versions commonly use Java 17. Confirm the exact version in the relevant Paper notes and the server startup output.

How do I point a domain name to a Minecraft server?

Add an A record for the subdomain pointing to the VPS IPv4 address. If the server uses a port other than 25565, players must append the port or you must configure a suitable SRV record.

Can I back up the server without stopping it?

Yes, but a copy taken while the world is being written may be inconsistent. On a small server, save-all followed by a short stop is safer; more advanced setups can use filesystem snapshots and restore tests.

For me, setup is not finished when the first player connects. It is finished when the server starts after a reboot and a backup has successfully come back. I do not send the IP to the group chat until both tests pass.