Port Forward Minecraft Server: Guide and How to Skip It

To port forward Minecraft server traffic, you add a rule in your router that sends TCP port 25565 (Java Edition) or UDP port 19132 (Bedrock Edition) to the local IP address of the computer running the server, then allow that port in the computer’s firewall. When it fails, the cause is usually CGNAT, a second router or a firewall. This guide covers each one, plus how to skip the router.

You only need port forwarding when players join from outside your home. Friends on the same Wi-Fi can connect with your local address (192.168.x.x) and no router changes. For everyone else, the router blocks unsolicited incoming connections until you tell it where to send them.

Which ports Minecraft uses

These are the defaults from server.properties, as documented on the Minecraft Wiki. If you changed server-port, forward the number you set instead.

Java uses TCP and Bedrock uses UDP. Mixing them up is one of the most common reasons a rule “does nothing”. If your router asks for a protocol and you are not sure, the Wiki suggests choosing TCP/UDP or Both.

Before you start: three checks

1. The server works locally. Start it and join with localhost from the same computer. If that fails, port forwarding won’t help. Fix the server first.
2. You know two addresses. On Windows, open Command Prompt and run ipconfig. Note the IPv4 Address (your PC, for example 192.168.1.50) and the Default Gateway (your router, often 192.168.0.1 or 192.168.1.1).
3. You can log in to the router. The login is usually on a sticker on the device. Without access, skip to hosting without port forwarding.

How to port forward Minecraft server ports, step by step

1. Give your PC a fixed local IP. Routers hand out addresses with DHCP, so your PC may get a different one tomorrow and the rule would point to nothing. In the router, look for DHCP reservation (also called address reservation or static lease) and bind your PC’s current IP to its MAC address. Setting a static IP in Windows works too, as long as it is outside the router’s DHCP range.
2. Open the router panel. Type the Default Gateway address into your browser and log in.
3. Find the forwarding section. Each brand names it differently: Port Forwarding, Virtual Server, NAT, Applications & Gaming or Port Mapping. It is often under Advanced, Firewall or WAN.
4. Create the rule. Fill the fields as in the table below and save. Some routers need a restart to apply it.
5. Allow the port in Windows Firewall (next section).
6. Test from outside your network with your public IP address and the port.

One detail that trips people up: in server.properties, leave server-ip empty. The Wiki recommends it, because that field picks which network interface the server listens on. It is not the place for your public IP.

Allow Minecraft through Windows Firewall

The first time a Java server starts, Windows usually shows a prompt for OpenJDK Platform binary (or Java). Allow it and Windows creates the rule for you. If you dismissed it, or the server still can’t be reached, create an inbound rule by hand:

1. Press Start, type wf.msc and press Enter to open Windows Defender Firewall with Advanced Security.
2. Select Inbound Rules, then New Rule.
3. Choose Port, then TCP and Specific local ports: 25565. For Bedrock, choose UDP and 19132.
4. Choose Allow the connection, tick the profiles you use, name it “Minecraft” and press Finish.

The same rule from PowerShell, run as administrator:

New-NetFirewallRule -DisplayName "Minecraft Java" -Direction Inbound -Protocol TCP -LocalPort 25565 -Action Allow
New-NetFirewallRule -DisplayName "Minecraft Bedrock" -Direction Inbound -Protocol UDP -LocalPort 19132 -Action Allow

Microsoft documents both methods in its Windows Firewall rules guide. A third-party antivirus with its own firewall needs the same exception.

How to check that the port is open

1. Keep the server running. A port checker can only see an open port if something is listening on it.
2. Find your public IP. Search “what is my IP” in your browser.
3. Run an online port checker for that IP and 25565. These tools usually test TCP, so for Bedrock the reliable test is a real player joining.
4. Join from another network. Turn off Wi-Fi on your phone and use mobile data, or ask a friend to add your.public.ip:25565. On Bedrock, add the server with the IP and port 19132.

If the friend gets “Connection timed out”, the traffic is still being dropped before it reaches the server. Our guide to the Minecraft “connection timed out” error walks through it. If Bedrock players can’t see the server at all, see why a Bedrock server is not showing up.

Port forwarding not working? The usual causes

How to tell if you are behind CGNAT

Compare the WAN IP shown on your router’s status page with the IP from “what is my IP”. If they are different, something between you and the internet is translating addresses. A WAN IP between 100.64.0.0 and 100.127.255.255 is a giveaway: RFC 6598 reserves that range for carrier-grade NAT and lists “the inability to open incoming ports through the CGN” as a known limitation. Mobile internet and hotspots are almost always behind CGNAT, and many fixed-line ISPs use it too. No rule in your own router can get around it. Some ISPs will give you a public IP if you ask, sometimes for an extra fee.

Double NAT

The Minecraft Wiki warns that your modem might be acting as a router as well. If your own router’s WAN address is a private one, the ISP device is the one facing the internet, and it needs the forwarding rule too (pointing to your router), or bridge mode so that your router gets the public IP directly.

Is it safe to open ports for Minecraft?

It is a normal setup, but it exposes your home connection:

• Your home IP becomes public to everyone you share the address with. Anyone who wants to flood it can take down the internet for your whole household, not only the server.
• Scanners look for 25565. The Wiki notes that griefers scan the internet for servers on the default port. Turn on the whitelist (white-list=true), keep online-mode=true, and consider enable-status=false so the server doesn’t answer in server lists.
• Forward only what you need. Never forward RCON (25575) or remote desktop ports, and delete the rule when you stop hosting.

How to host a Minecraft server without port forwarding

If you have no router access (dorm, apartment Wi-Fi, a parent’s locked router), you are behind CGNAT, or you just don’t want your home IP out there, you have three options.

A tunnel works for a weekend session, but a daily server brings back the PC-must-stay-on problem. We compare both paths in hosting a Minecraft server on your PC or online, and the simplest ways to get a group together are in how to play Minecraft with friends.

Skip the router: a server with its own IP

On TheGameHosting, your server already has a public IP and port when it is ready, about 60 seconds after payment. You share that address and your friends join. No router login, no firewall rules, no CGNAT, and your home IP stays private.

• Runs 24/7 in Dallas or Amsterdam without your PC on, with DDoS protection on every plan.
• Minecraft Java hosting with Paper, Purpur, Fabric, Forge and more through the Version Changer, and Minecraft Bedrock hosting for phones and consoles.
• Plugin, mod and modpack installers, backups and sFTP, from a panel that works on your phone.

Plans start at $1.90 USD/month for 2 GB, enough for a small group on Java or Bedrock. If port forwarding is the wall you hit, see the server plans and use code FULL2026 for 15% off for life.

FAQ

Hosting for these games

• Minecraft Java hostingPaper, Purpur, Fabric, Forge and more
• Minecraft Bedrock hostingPhones, consoles and Windows