How to Port Forward a Minecraft Server: Step-by-Step Guide

Game Updated on : August 10, 2026

Setting up a Minecraft server is only half the job. If you want friends outside your home network to join, your router needs to know where to send their connection requests. That is exactly what port forwarding does: it opens a specific doorway through your router firewall and points it directly at the Minecraft server running on your PC, so incoming traffic does not get dropped at the router.

This guide walks through the entire process end to end, from finding your local IP to router-specific instructions and troubleshooting, for both Java and Bedrock Edition.

What is Minecraft Port Forwarding?

Your router acts as a gatekeeper between your home network and the internet. By default, it blocks unsolicited incoming traffic to protect the devices behind it. That’s great for security, but it also means a Minecraft server running on your PC can’t be reached by anyone outside your house, since the router has no idea which device on your network should receive traffic on port 25565.

Port forwarding creates a rule that tells the router: any traffic arriving on this specific port should be sent directly to this specific device, rather than being dropped.

Picture the flow this way: a friend’s Minecraft client sends a connection request to your public IP address; that request lands on your router, and the forwarding rule hands it off to your PC’s local IP address on the correct port, where the Minecraft server software is listening.

Before You Start

Before touching any router settings, confirm the basics. You’ll need administrator access to your Minecraft server’s host PC, the ability to log into your router’s admin panel (usually via a browser at an address like 192.168.1.1), and Minecraft server software already installed and able to run locally. If you prefer to avoid managing these settings yourself, Minecraft Server Hosting is another option.

One important caveat worth checking early is whether your ISP uses CGNAT (Carrier-Grade NAT). Under CGNAT, your router doesn’t actually receive a unique public IP address it shares one with other customers, which makes traditional port forwarding impossible no matter how correctly you configure it. Mobile carriers and some fiber ISPs (including several regional providers) use this by default.

You can usually tell by comparing the public IP shown on a site like whatismyip.com against the WAN IP listed in your router’s status page; if they don’t match, you are behind CGNAT and will need one of the tunneling alternatives covered later in this guide.

Find Your Local IP Address

Your local IP is the address your router uses to identify your PC within your home network, and it’s what the forwarding rule will point to. Verify if the server works locally:

Windows

Open Command Prompt and run ipconfig. Look for “IPv4 Address” under your active network adapter. It typically looks like 192.168.1.X or 10.0.0.X.

MacOS

Open System Settings, go to Network, select your active connection (Wi-Fi or Ethernet), and the IP address is listed under connection details. Alternatively, run ipconfig getifaddr en0 in Terminal for Wi-Fi, or en1 for Ethernet on some Mac models.

Linux

Run hostname or Ip address shown in a terminal. The address next to your active interface (often labeled eth0 or wlan0) is your local IP.
Use the command:

OR

Set a Static IP Address

By default, most routers assign IP addresses dynamically, meaning your PC’s local IP can change after a restart or reconnect which would silently break your forwarding rule. Locking in a static address prevents that.

DHCP Reservation

This is a recommended method. In your router admin panel, find the DHCP client list or LAN settings, locate your PC by its device name or MAC address, and reserve its current IP permanently. The router will always assign that same address to that device going forward, while still managing the rest of your network normally.

Manual Static IP

Alternatively, you can set the static IP directly on the PC through its network adapter settings. This works but is more fragile, since it requires you to manually choose an address outside your router’s DHCP range to avoid conflicts, and to correctly enter the subnet mask, gateway, and DNS values yourself. DHCP reservations are generally safer for most users.

Open the Port on Your Router

Every router interface looks slightly different, but the underlying steps are the same. Log into your router (commonly at 192.168.1.1 or 192.168.0.1; check the label on the router itself if unsure), and find the section labeled Port Forwarding, Virtual Server, or NAT Forwarding, usually under Advanced Settings.

---

Save the rule and reboot the router if prompted.

Router-Specific Setup

TP-Link

Log in at tplinkwifi.net, go to Advanced > NAT Forwarding > Virtual Servers, click Add, and fill in the service port, internal IP, and protocol as shown above.

ASUS

Log in and navigate to WAN > Virtual Server / Port Forwarding, enable the feature, then add a new rule with your port and local IP.

Netgear

Go to Advanced > Advanced Setup > Port Forwarding/Port Triggering, select Port Forwarding, and add a custom service using the Minecraft port details.

D-Link

Navigate to Advanced > Port Forwarding, add a new rule, and specify the port range and the internal IP of your server PC.

Linksys

Go to Security > Apps and Gaming > Single Port Forwarding and enter the external/internal port and device IP.

JioFiber / Airtel / ACT

These regional Indian ISPs often provide a modified router firmware. Look for Advanced Settings > NAT/Port Forwarding in JioFiber’s app or admin panel; Airtel and ACT routers typically expose similar menus under Firewall or Application Settings.

Because these ISPs frequently deploy CGNAT on newer connections, verify your public vs. WAN IP match (see the CGNAT note above) before assuming a misconfigured rule is the problem.

---

Allow the Port in Windows Firewall

Even with the router correctly configured, Windows Defender Firewall can independently block the connection at the PC level.

Java Edition

Open Windows Defender Firewall with Advanced Security, create a new Inbound Rule, select Port, choose TCP, and enter 25565. Allow the connection for all profiles (Domain, Private, Public) and name the rule something identifiable like “Minecraft Java.”

Bedrock Edition

Repeat the same process but select UDP and enter port 19132.

---

Test the Minecraft Port

Online Checker

Use a port-checking tool such as canyouseeme.org or portchecktool.com. Enter your public IP and the relevant port; a successful result confirms the port is open and reachable from outside your network.

External Connection Test

For a more direct test, have a friend on a different network (or use your phone on mobile data with Wi-Fi off) attempt to join using your public IP and port. This confirms that the full chain router, firewall, and server are working end-to-end.

---

Find Your Public IP

IPv4 Check

Search “what is my IP” in a browser, or visit whatismyip.com, to get the address friends will use to connect.

Example Server Address

Friends enter your public IP followed by the port if it’s non-default, in the format your. public.ip:25565. If you are using the default port, the:25565 can often be omitted since Minecraft assumes it automatically.

---

Minecraft Java Edition Setup

Open the server.properties file in your server’s root folder and confirm the server-port value is set to 25565 (or your custom port; if you intentionally change it, just make sure the router rule matches).
After launching the server, check the console log for a line confirming it’s listening on that port, which verifies the software side is working correctly before you troubleshoot the network side.

Minecraft Bedrock Edition Setup

Bedrock Edition communicates over UDP rather than TCP, which is a common point of confusion since Java uses TCP; using the wrong protocol in your router rule is one of the most frequent reasons Bedrock connections fail even when the port number itself is correct.

Confirm the server’s default port (19132) in its configuration file, and double-check that both your router rule and Windows Firewall rule specify UDP.

---

Troubleshooting

Port Closed

Re-verify the forwarding rule was saved; the router was rebooted if needed, and that you’re testing the correct port and protocol combination.

Wrong Local IP

If your PC’s IP changed since you created the rule, the forwarding will silently point to the wrong device. Confirm that the static IP or DHCP reservation is still active.

Firewall Blocking

Temporarily disable Windows Firewall (or third-party antivirus firewalls) to isolate whether it’s the cause, then re-enable it and add a proper rule rather than leaving it off.

Double NAT

If you have a modem and a separate router, or a mesh system behind an ISP-provided gateway, traffic may need to be forwarded twice at each device. Check whether your modem/gateway also has its own NAT layer, and either forward the port there too or set it to bridge mode, so only one device handles NAT.

CGNAT

As covered earlier, if your ISP doesn’t assign a unique public IP, no router-side configuration will fix this. Contact your ISP for a static or public IP option or use a tunneling service instead.

Wrong Protocol

Mixing up TCP and UDP is common, especially when running both Java and Bedrock servers. Java needs TCP; Bedrock needs UDP.

Security Tips

Opening a port does introduce some exposure, so it’s worth pairing it with a few basic safeguards. Enable a server whitelist so only approved players can connect, rather than leaving the server open to anyone who finds the address.

Use a strong server or account password where applicable and keep both your router firmware and Minecraft server software updated to patch known vulnerabilities. Finally, avoid forwarding more ports than necessary only to open what your server actually needs, and close the rule when you’re done hosting long-term.

---

Alternatives to Port Forwarding

If port forwarding isn’t possible (CGNAT) or you’d rather avoid router configuration entirely, a few tunneling services can create the connection without opening any ports.

Tailscale

Creates a private mesh VPN between your devices and your friends, letting them connect as if on the same local network free for personal use with a generous device limit.

ZeroTier

Similar concept to Tailscale, a software-defined virtual network that bypasses the need for traditional port forwarding entirely.

Playit.gg

Purpose-built for game server tunneling, including Minecraft specifically, and works well for users behind CGNAT.

Ngrok

A general-purpose tunneling tool that can expose local ports to the internet, though it’s less gaming-specific and typically better suited to more technical users.

---

Summing Up

Port forwarding a Minecraft server comes down to a short chain of matching settings: a server that already works locally, a stable local IP, a router rule pointing to that IP, a firewall rule allowing the same port, and the correct protocol for your edition TCP 25565 for Java, UDP 19132–19133 for Bedrock.

Work through each link in that chain in order, and most connection issues resolve themselves. If you are behind CGNAT and can’t get a rule to work no matter what you try, skip straight to a tunneling option like Tailscale or Playit.gg rather than troubleshooting a router setting that was never going to work in the first place.

---

Frequently Asked Questions

Q1. Do I need port forwarding to host Minecraft?

Ans. Only if you want players outside your local network to join. Players on the same Wi-Fi can connect via LAN without any forwarding.

Q2. What port does Minecraft use?

Ans. 25565 (TCP) for Java Edition, and 19132–19133 (UDP) for Bedrock Edition by default.

Q3. Why can’t friends join even after forwarding to the port?

Ans. The most common causes are a mismatched local IP after a router restart, a firewall still blocking the port, incorrect protocol (TCP vs UDP), CGNAT on your ISP connection, or your ISP outright blocking the port.

Q4. Is port forwarding safe?

Ans. It’s reasonably safe for a single game port when paired with basic precautions like a whitelist, online-mode=true, and updated software, though it does technically expose that port and your home IP to the wider internet.

Q5. Can I host without opening any ports?

Ans. Yes, tunneling tools like Tailscale, ZeroTier, Playit.gg, or LocalXpose let you host without touching your router’s forwarding settings at all, and they work even behind CGNAT.