Minecraft Java

Java tunnels need no port. Every Java client puts the address it connected to into the first packet (the handshake). Relay nodes listen on 25565, read that hostname without consuming any bytes, and route the player to your tunnel.

Addresses

• yourname.r.enzonic.dev on every plan
• yourname.play-mc.cc on Plus and Pro, while the name is free there (play-mc.cc is shared with Enzonic Cloud servers, so a name an existing server uses is refused, and the tunnel keeps its r.enzonic.dev address). It stops when the plan ends or the tunnel is paused, and comes back on upgrade if nobody took the name meanwhile.
• your own domain (Plus and Pro), see custom domains
• a direct node address with a dedicated port, for clients or proxies that rewrite the handshake host

Server settings

Keep online-mode=true in server.properties. Players connect through the relay and your agent, so your server sees connections coming from the agent (usually 127.0.0.1). Ban and whitelist by player name or UUID, not by IP.

The dedicated port of a Java tunnel only accepts connections that start with a Minecraft handshake. Other traffic is closed before it reaches your server.