Networking
Port forwarding for a Minecraft server, step by step
Port forwarding has a scary reputation, and it doesn’t deserve it. It’s one rule on your router that says “anyone who knocks here goes to that computer”. What makes it annoying is that every router brand hides the page somewhere different and calls it something else.
This guide sticks to the steps that never change. Nothing stings like an hour of clicking through a menu that was never going to work, so there’s a quick test near the end that tells you if yours can.
What a forwarded port is
Picture your PC as a building with numbered doors. Java servers use number 25565 over TCP, Bedrock uses 19132 over UDP, and your router is the front gate that keeps every door shut to strangers.
A forwarding rule just tells the gate: whatever shows up for 25565, walk it to this PC.
Step 1: pin your PC’s local address
Your router hands out local addresses as it sees fit, so yours can change after a restart. When that happens the rule points at nobody, and nothing tells you.
The fix is a DHCP reservation, which makes the router give this PC the same address every time. It lives under LAN, DHCP or Address Reservation, and you’ll need the PC’s current address and its MAC address, both of which ipconfig /all prints.
Step 2: add the rule
Type the router’s address into a browser. It’s often 192.168.0.1 or 192.168.1.1, and the login is usually on a sticker underneath the router. Then hunt for Port Forwarding, which some brands call Virtual Server, NAT, or something under Gaming or Applications.
The rule needs five values:
- A name. Minecraft is fine.
- The external port, 25565, for both the start and the end of the range.
- The internal port, also 25565.
- The protocol, TCP for Java. Bedrock wants UDP and 19132.
- The local address you pinned in step 1.
Save it. Some routers want a restart before they pick it up.
Step 3: let Windows say yes too
Getting past the router isn’t the end of it. Windows has its own firewall and it can still drop the connection. The first time Java starts a server, Windows pops up a question about allowing it. If you hit Cancel once, that’s your problem. Open Windows Security, go to Firewall and network protection, pick Allow an app through firewall, and add Java for private networks.
Step 4: test from outside, not from your couch
Trying it from your own network proves very little, because many routers treat inside traffic differently. Ask a friend, use your phone on mobile data, or run one of the free online port checkers that probe from the internet.
The address your friends need is your public one, which any “what is my IP” site will show. They type that into Minecraft. Adding :25565 at the end is allowed, though it’s optional on the default port.
When none of it works: CGNAT
Here’s the nasty surprise. Plenty of providers don’t give every customer a public address. Many homes share one, behind a setup called carrier-grade NAT, or CGNAT. If you’re one of them, your router can’t be reached from the internet at all, and forwarding does nothing.
You can check in a minute. Compare the WAN or Internet address on your router’s status page with what a “what is my IP” site says. If they’re different, or the router’s one begins with a number from 100.64 to 100.127, that’s CGNAT. Some providers will hand you a public address if you ask nicely, and some charge for it.
If yours won’t, don’t throw the server away. A tunnel never needs an incoming connection, so it works fine from behind CGNAT. That’s what the Network tab in Mineshire switches on.
A word on safety
An open port is an open invitation to anyone who finds it. Switch the whitelist on, keep your server software current, and forward only what you need. If that all feels like a lot to look after, a tunnel avoids most of it.
Quick answers
Do I forward both TCP and UDP? Not for Java Edition. TCP on 25565 is enough. Bedrock uses UDP.
My address changed and my friends can’t get in. Why? Many providers change a home’s public address from time to time. A dynamic DNS service gives you a name that follows it, and a tunnel avoids the problem entirely.