How to port forward a Minecraft server

1What a port forward does

Friends outside your home reach your router's public address, not your PC. A port forward tells the router that connections to port 25565 go to one PC on your network. Without it the router has nowhere to send them, and friends get Connection refused or connection timed out.

2The ports to forward

A new Minecraft 1.21.1 server's server.properties starts with these, and add-ons bring their own:

A second server on the same PC needs a port of its own, like 25566, with its own forward.

3Forward the port, step by step

1. 1

   Find the PC's local address

   On Windows, ipconfig lists it as IPv4 Address. On Linux, hostname -I prints it. It looks like 192.168.1.20.

2. 2

   Keep that address fixed

   In the router's DHCP settings, reserve the address for the PC. Otherwise the router can give it a new one, and the forward points at nothing.

3. 3

   Open the router's settings

   Type its address in a browser: ipconfig calls it Default Gateway, and ip -4 route show default on Linux prints it after default via.

4. 4

   Add the forward

   External port 25565, protocol TCP, to the PC's address and port 25565. Routers call the page Port Forwarding, Virtual Server or NAT.

5. 5

   Allow the port on the PC

   On Windows, allow Java when the firewall asks as the server first starts, or add a rule for TCP 25565. On Ubuntu, sudo ufw allow 25565/tcp.

6. 6

   Test it from outside

   Ask a friend to join, or run nc -vz with your public address and 25565 from a machine outside your network. curl -4 ifconfig.me prints your public address.

Friends then join at your public address, followed by :25566 or whichever port when it isn't 25565.

Checked on 29 Sep: the ports from a new Minecraft 1.21.1 server.properties, the Linux and ufw commands on Ubuntu 24.04, and nc against open, closed and blocked ports. The Windows steps follow Microsoft's documentation; router pages differ by maker.

4When no forward can work

Compare the internet address on your router's status page with the one curl -4 ifconfig.me prints. If they differ, something between your router and the internet shares one address among many homes, and connections from outside stop there:

• A router address from 100.64.0.0 to 100.127.255.255 is carrier-grade NAT, the range set aside for it in RFC 6598. Ask your internet provider for a public IPv4 address, or host the server somewhere else.
• An ISP box in front of your own router: forward the port on both, or set the ISP box to bridge mode.

5Joining from home, and keeping it safe

• On your own network, join at the PC's local address. Some routers don't send a connection to their own public address back inside.
• Forward only the game port, never RCON, and keep online-mode=true with an allowlist, so only friends you add can join.
• Your public address can change. Many home connections get a new one now and then; check it again when friends can't join.

6Or skip the router: a VPS

A VPS has a public address and no router in front of it, so there's nothing to forward. Allow the port in the provider's firewall instead. Playkeeper's installer allows TCP 25565 in ufw or firewalld when one is on, each further server takes the next port from 25566, and friends join at a free name like survival.alex.playkeeper.me instead of an address that changes.

Install it on a VPS with one command: