Disclaimer: I know next to nothing about admin-ing minecraft. You can set an allowlist of mojang account identifiers in your server.properties. I don't know

Disclaimer: I know next to nothing about admin-ing minecraft. You can set an allowlist of mojang account identifiers in your server.properties. I don't know how airtight that is, though, and I guess if you're running a public server on the default port 25565, you can expect to receive a bunch of connection attempts from people you don't know that will ultimately be unsuccessful but will take some CPU to reject (just like SSH on port 22). It's probably less likely to receive UDP traffic on tailscale's default port these days than TCP on 25565. Even then, I would bet that it's cheaper to discard the tailscale/wireguard packets that you don't trust / aren't authenticated than it is for minecraft.jar to either fail to authn a client with mojang's servers or authenticate a client and then see that it's not in the allow list.