diff --git a/infra/firewall/firewall.sh b/infra/firewall/firewall.sh
index bfc0ea0..037b114 100755
--- a/infra/firewall/firewall.sh
+++ b/infra/firewall/firewall.sh
@@ -2,10 +2,30 @@
 # ============================================================
 # firewall.sh — deny-by-default firewall untuk orangevps
 # Public: 22 (SSH), 80/443 (Caddy), 4013 (hermes dashboard)
+#         25565 (Minecraft) — WHITELIST TCPShield proxy only
 # Tailscale CGNAT 100.64/10: semua port (imrnes & node lain)
 # Localhost: semua
 # Sisanya: DROP + log
 # ============================================================
+# TCPShield proxy ranges (https://tcpshield.com/v4/ + /v4-cf/)
+# Update saat TCPShield publish range baru.
+TCPSHIELD_V4=(
+  198.178.119.0/24
+  104.234.6.0/24
+)
+TCPSHIELD_V4_CF=(
+  89.222.122.36/31
+  152.233.22.8/31
+  89.222.108.246/31
+  84.17.55.186/31
+  51.79.45.52/31
+  5.135.84.92/30
+  51.75.35.44/30
+  51.161.27.110/31
+  152.233.30.16/31
+  152.233.30.232/31
+  203.205.31.160/31
+)
 set -e
 
 ### IPv4 ###
@@ -33,6 +53,10 @@ iptables -A INPUT -p tcp --dport 80 -j ACCEPT
 iptables -A INPUT -p tcp --dport 443 -j ACCEPT
 # Public: hermes dashboard (auth-protected)
 iptables -A INPUT -p tcp --dport 4013 -j ACCEPT
+# Public: Minecraft (FTB sky) — hanya dari proxy TCPShield
+for cidr in "${TCPSHIELD_V4[@]}" "${TCPSHIELD_V4_CF[@]}"; do
+  iptables -A INPUT -s "$cidr" -p tcp --dport 25565 -j ACCEPT
+done
 
 # ICMP (ping, PMTU)
 iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5/sec --limit-burst 10 -j ACCEPT
@@ -66,15 +90,10 @@ ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 4013 -j ACCEPT
-# ICMPv6/MLD: ping + neighbor discovery (NIC multicast ff02::1 = MLDv2 reports
-# dari host lain; kena LOG+DROP tiap menit — 1800 baris/6h di journal).
-# IPv6 layer-2 discovery WAJIB di-ACCEPT, bukan cuma dropped.
+# Minecraft 25565: TCPShield IPv4 only — tidak ada range IPv6 publik
 ip6tables -A INPUT -p icmpv6 -j ACCEPT
-ip6tables -A INPUT -d ff02::1 -j ACCEPT
-ip6tables -A INPUT -d ff02::2 -j ACCEPT
-ip6tables -A INPUT -d ff02::fb -j ACCEPT
 ip6tables -A INPUT -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "FW6-DROP " --log-level 4
 ip6tables -A INPUT -j DROP
 
 echo "Firewall applied:"
-iptables -L INPUT -n --line-numbers | head -20
+iptables -L INPUT -n --line-numbers | head -24