How to port forward a Minecraft server

To let friends outside your home join a server running on your PC, you forward TCP port 25565 on your router to that PC's local IP address, allow it through the firewall, and give friends your public IP. Below is every step, plus what to do when it still doesn't work because of CGNAT or double NAT.

Why you need it

Your router shares one public IP address between every device in your home. When a player connects to that public IP, the router doesn't know which device should get the connection, so it drops it. A port forward is a rule that says: "send anything that arrives on port 25565 to this computer". If you rent a server from a host, you do not need any of this. Port forwarding is only for servers at home. The full server setup is in how to make a Minecraft server.

Step 1: find your computer's local IP

The local IP is the address your router gives the PC that runs the server, usually starting with 192.168., 10. or 172.16. to 172.31..

• Windows: open Command Prompt and run ipconfig. Note the IPv4 Address and the Default Gateway of the adapter you use (Ethernet or Wi-Fi). The gateway is your router's address.
• macOS: open System Settings, then Network, select your connection, click Details and open TCP/IP. Or run ipconfig getifaddr en0 in Terminal (en0 is usually Wi-Fi on laptops).
• Linux: run ip a for the address and ip route for the gateway (the address after default via).

Step 2: make the local IP permanent

Routers hand out local addresses automatically and can give your PC a different one after a restart. If that happens, the port forward points to the wrong device and the server becomes unreachable. Fix it with a DHCP reservation (sometimes called "static lease" or "address reservation") in the router: pick your PC from the list of connected devices and reserve its current IP. This is easier and safer than setting a static IP by hand on the PC.

Step 3: log in to your router

1. Type the Default Gateway address (often 192.168.0.1 or 192.168.1.1) into your browser.
2. Log in. The default password is often printed on a sticker on the router. If you never changed it, change it now.
3. Some internet providers manage the router through an app instead of a web page. Look for the same settings there.

Step 4: create the port forwarding rule

The menu is called different things depending on the brand: Port Forwarding, Virtual Server, NAT, Applications or Gaming, often under Advanced. Create a rule like this:

Save and, if the router asks, apply or restart. Only forward the Bedrock port if you run a Bedrock Dedicated Server or Geyser, and only forward ports you actually use. If you changed server-port in server.properties, forward that port instead.

Do not use DMZ or "expose host" as a shortcut. It sends every port to your PC, including ones you never meant to open.

Step 5: allow the port through the firewall

Windows

The first time the server starts, Windows usually asks whether Java may communicate on networks. Allow it on private networks. If you missed the prompt, open Windows Defender Firewall with Advanced Security, choose Inbound Rules, then New Rule: Port, TCP, 25565, Allow the connection. Or run this in an administrator PowerShell window:

New-NetFirewallRule -DisplayName "Minecraft" -Direction Inbound -Protocol TCP -LocalPort 25565 -Action Allow

Add a second rule with -Protocol UDP -LocalPort 19132 if you need Bedrock. Third-party antivirus suites with their own firewall need the same exception.

macOS

If the macOS firewall is on (System Settings, Network, Firewall), it asks whether Java may accept incoming connections when the server starts. Click Allow. You can also add Java under the firewall's Options.

Linux

• ufw: sudo ufw allow 25565/tcp
• firewalld: sudo firewall-cmd --permanent --add-port=25565/tcp then sudo firewall-cmd --reload

Step 6: test it from outside

1. Start the server and wait until the console says Done.
2. Find your public IP by searching "what is my IP" in a browser.
3. Enter that IP in our server status checker. If it shows your MOTD and player count, the port forward works.

Testing your public IP from inside your own network often fails even when everything is correct, because many routers don't support "NAT loopback". You and others in your home should join with the local IP, while friends outside use the public IP. A phone on mobile data is another quick way to test from outside.

Most home connections get a new public IP from time to time. A dynamic DNS service gives you a name that follows your IP, and you can point your own domain at it as described in how to use a domain for a Minecraft server.

It still doesn't work: CGNAT and double NAT

Look at the WAN or Internet IP shown on your router's status page and compare it with your public IP from "what is my IP".

• They match: port forwarding should work. Recheck the local IP, protocol, firewall and that the server is running.
• The router's WAN IP starts with 100.64. to 100.127.: this is CGNAT. Your provider shares one public IP between many customers, and you cannot forward ports on their equipment.
• The router's WAN IP is a private address like 192.168.x.x or 10.x.x.x: this is double NAT. There is another router in front of yours, often the provider's modem.

Fixing double NAT

Either put the provider's modem in bridge mode so your own router gets the public IP, or forward the port on both devices: on the modem to your router's WAN IP, and on your router to the PC.

Working around CGNAT

• Ask your provider for a public IPv4 address. Some providers give one for free on request, others charge a small fee.
• Use a tunnel service. A small program connects out from your PC and gives you a public address, with no ports to open. Expect some extra latency. More options are in how to make a Minecraft server for free.
• Rent a cheap server or VPS and run Minecraft there instead. For a server that should be online all the time, this is usually the best answer anyway.

Security notes

• Never forward the RCON port (25575 by default) or any admin panel. RCON gives full console control and its password is sent unencrypted.
• Keep online-mode=true so nobody can join under someone else's name. server.properties explained covers why.
• Only share your public IP with people you trust, or use a whitelist. Your home IP reveals your rough location and can be targeted with DDoS attacks.
• Keep the server, Java and plugins updated, and run the server under a normal user account, not as administrator or root.
• When you stop hosting, delete the port forwarding rule.

If players still cannot join after all of this, work through can't connect to a Minecraft server.