Minecraft server port forwarding: open it, fix it, or skip it

Start here: which of these is you?

Four situations, four different answers. Find yours and jump — the causes barely overlap, so reading the wrong branch wastes an evening.

The two-minute check worth doing first

One thing decides whether port forwarding can work for you at all, and it takes two minutes. Do it before you touch a single router setting, because if it comes back the wrong way, nothing else on this page's first branch will help.

1. Open your router's admin page and find the WAN or Internet address it says it has. It is on the status or overview screen, usually labelled WAN IP, Internet IP or IPv4 address.
2. Search "what is my IP" in a browser on the same network and note the address that comes back.
3. Compare them. If they match, you have a real public address and port forwarding will work once it is set up correctly. If they do not match, your provider is translating your traffic and a forwarded port on your own router cannot reach the internet — see why it did not work for what to do about it.

Forward the port properly

Every router's menu is laid out differently and the feature goes by several names — Port Forwarding, Virtual Server, NAT Forwarding, Applications and Gaming. What has to happen is the same everywhere: tell the router that traffic arriving on the Minecraft port should be handed to the machine running the server.

1. Give the server machine a fixed local address first. This step gets skipped and it is why forwards stop working a week later. Your router hands out local addresses temporarily, so the PC that is 192.168.1.42 today can be 192.168.1.57 after a reboot — and the forward still points at the old one. Fix it either in the router, by adding a DHCP reservation for that PC, or on the PC itself by setting a static address outside the router's DHCP range. The reservation is the safer of the two because the router stays the single source of truth.
2. Create the forwarding rule. Internal and external port both set to the server's port. Protocol TCP for Java (25565), UDP for Bedrock (19132). Destination: the local address you just fixed. If the router insists on a port range, use the same number for start and end.
3. Allow it through the machine's firewall. The router now sends traffic to the PC, and the PC's own firewall can still drop it. On Windows, add an inbound rule for the port — or for the Java executable running the server — in Windows Defender Firewall. This is the second most common reason a correct forward appears to do nothing.
4. Test it from outside your network. Not from a browser in your living room. Turn Wi-Fi off on a phone so it is on mobile data and try to reach the address, or use an online port checker while the server is running. Both are testing the same thing: whether the outside world can get in.

Once the check from outside succeeds, your friends connect using your public address and the port — for Java, your.public.ip:25565. If your provider changes your public address from time to time, which most residential connections do, a free dynamic DNS name gives you a fixed hostname that follows it.

You forwarded it and it still does not work

Work down this list in order. It is ordered by how often each one turns out to be the answer, and the first two are free to rule out.

1. You tested it from inside your own network

Covered above, and it is genuinely the most common false alarm: hairpinning is a MUST in the standard that many routers ignore, so testing your public address from your own living room can fail on a perfectly working setup. Re-test from mobile data before changing anything else.

2. The server machine's local address changed

If it worked and then stopped, this is almost always why. The forward still points at an address the PC no longer has. Add a DHCP reservation so it cannot drift again.

3. Carrier-grade NAT — the one with no workaround

If the WAN address in your router does not match what "what is my IP" reports, your traffic is being translated by your provider before it reaches the internet, and a port you open on your own router does not exist as far as the outside world is concerned. You can read it straight off the router:

Carrier-grade NAT exists because there are not enough IPv4 addresses to give every household one, so providers share a single public address between many customers. It is not a fault and nobody did anything wrong. Your options are to ask your provider for a public IPv4 address — many offer one, sometimes free, sometimes as a paid add-on — or to stop needing one, with either a tunnel or a hosted server.

4. Double NAT: two routers, one chain

A private address on your router's WAN side means your router is plugged into another router — typically the box your provider supplied, running in router mode rather than as a plain modem. Your forward is correct; it just stops at the second device. Three ways out, best first: put the provider's box into bridge or modem mode so your router gets the public address directly; or forward the same port a second time on the upstream box, pointing at your router; or move the server behind the upstream box instead.

5. The machine's own firewall

The router forwards, the PC drops. Add an inbound rule for the port, or for the server executable, and test again from outside.

6. The wrong protocol or the wrong port

Java is TCP 25565, Bedrock is UDP 19132. They are not interchangeable, and a Bedrock server behind a TCP forward is unreachable while looking completely healthy from the inside. If your server is Bedrock, the setup differs in more places than the port — the Bedrock server guide covers it end to end.

Is port forwarding safe?

The short answer: opening one port to a server you keep updated is fine, and it is what every Minecraft server on the internet does. The risk is not the open port itself — it is what is listening behind it, and the fact that your home address is now the server address. Both are manageable, and neither is a reason to be scared off.

What an open port actually does

A forwarded port exposes exactly one program to the internet: the one listening on that port. It does not open your PC, your files, or the other devices in the house. What it does mean is that anybody who finds the address can send that one program whatever they like — so the software behind it has to be software you keep patched.

The real precedent, stated accurately

The Minecraft example people reach for is Log4Shell — CVE-2021-44228, scored 10.0 Critical and published on 10 December 2021 — and Mojang published an advisory the same day confirming Java Edition was affected. It is worth being precise about how it worked, because the popular retelling is wrong in a way that matters here.

Microsoft's own write-up documents the attack as an adversary connecting to a vulnerable server and sending a crafted in-game message, which then executed code on the server and on connected vulnerable clients. Both directions were real. But in every documented case the attacker had to connect and interact — an open port on its own executed nothing. The lesson is not "do not open ports", it is "keep the thing behind the port updated", which in that instance meant moving to 1.18.1 or applying the flag Mojang published for older versions.

The cost that has no patch

The part worth thinking hardest about is not a vulnerability at all: your public address becomes the server address, and everybody you invite has it, along with everybody they pass it to. A denial-of-service attack aimed at a hosted server hits that server; aimed at a home connection it takes the whole household off the internet, and you cannot filter it from your side because the line is already saturated. An address cannot be un-shared once it is out. The uptime guide covers what that means over time; the practical summary is that it is a fine trade for five friends and a poor one for a public server.

What actually makes it safe

Keep the server on a current version, turn the whitelist on so only people you invited can join, leave online-mode at its default so accounts are verified, and back the world up before you experiment. Those four are the whole checklist, and they live in the safe-settings section of the server setup guide with the exact settings. Do those and one forwarded port is an unremarkable thing to have.

Letting friends in without opening a port

A tunnel gives the outside world an address that belongs to the tunnel provider, then carries traffic from there to the server on your PC through a connection your PC opened outward. Nothing changes on the router, which is why it works behind carrier-grade NAT where port forwarding cannot. The trade is that a third party now sits in the path, and free tiers come with real limits.

The three names people search for, with what their own documentation says today:

playit.gg

The one that covers both editions. Java and Bedrock are both built-in presets on the free tier, so a Bedrock server on UDP works without paying — which is unusual and is the main reason to pick it. Your players get a playit-assigned address rather than yours, and only you install anything. The honest limits: free tunnels ride shared global routing and playit's own documentation warns that a player can be sent to a distant datacenter, describing the path as four hops whose latency adds up; choosing a region and using your own domain are paid. Free accounts can allocate four ports.

ngrok

Fine for Java, useless for Bedrock — ngrok supports HTTP, HTTPS, TCP and TLS, and states plainly that it does not do UDP. Two free-tier details will trip you up if nobody warns you: opening a raw TCP endpoint requires adding a payment method to the account, even though it stays free, and the address is randomly assigned each time you start the tunnel, so friends need a new one every session unless you pay for a reserved address. One myth to retire while you are here: the widely repeated claim that free ngrok tunnels die after two hours is out of date — ngrok's current documentation says free endpoints can stay online indefinitely.

Hamachi

The oldest of the three and the one that works differently: it is not a tunnel to a public address at all, it is a virtual LAN. Everybody joins the same private network and then connects as though they were in the same room. That difference is the whole story, in both directions.

It is still going — GoTo Group runs it under the LogMeIn brand and the release notes carry entries from 2026 — and the free tier still exists, but it caps a network at five members including you. Four friends. And unlike playit.gg or ngrok, every player installs the client and joins the network, which for a group of teenagers is usually where the plan dies. On the technical side it is a full virtual network adapter and brokers connections over UDP by default, so it is not limited to TCP — but GoTo's documentation never mentions Minecraft, Bedrock or port 19132, so treat Bedrock over Hamachi as untested rather than supported. GoTo also cautions in its own help pages that applications built for "high-speed, low-latency LAN environments" may not perform well over it.

What a tunnel costs you

Latency, mostly. Traffic that would have gone straight to your house now goes to the provider first, and on free tiers you rarely get to choose where that is. For a survival world with five friends nobody notices; for anything where timing matters, they do. The other cost is that your server's availability now depends on a third party's free tier continuing to exist on the same terms — which, as the tunnels above show, is not something to assume.

When a hosted server is the honest answer

Not every reader needs this, and pretending otherwise would be dishonest — plenty of people run a good server on a spare PC for years. But there are four situations where the fight above is not winnable or not worth it, and it is better to say so than to leave you tuning a router that cannot help:

• You are behind carrier-grade NAT. This is the one with no workaround at the router. A tunnel or a hosted server are the only two routes, and only one of them gives you an address you control.
• You want the world reachable when your PC is off. A server on your desktop exists while the desktop is awake. If people play at different hours, that is the whole problem, and no port setting solves it.
• You would rather not hand out your home address. Especially if the server will be public, or if the people joining are your kid's friends rather than yours.
• More than a handful of players. A residential upload link and a PC that is also being used for other things both start to show, and it shows as lag that looks like a game problem.

What changes: the address is a datacenter address rather than your house, it stays up on its own, and an attack aimed at it does not take your family offline. A managed plan also removes the parts of this page that are chores — no forwarding, no dynamic DNS, no firewall rule. HytHost servers run on NVMe storage with a 99.9% Uptime SLA, with Voxility DDoS filtering in front and live chat support from 8 AM to 11 PM (Chișinău time). If you already have a world on your PC, moving it over is a folder copy and we will do it for you.

If you have not built the server yet at all, start with how to make a Minecraft server instead — this page assumes you already have one running and only the connection is missing.