If your Minecraft server works on localhost but friends outside your home network cannot join, troubleshoot from the inside out. First prove that the server is listening, then test it from another device on your LAN, allow the correct traffic through the host firewall, verify the router rule and WAN address, and finally check for double NAT or carrier-grade NAT (CGNAT). Port forwarding cannot repair a server that is not listening, a rule aimed at the wrong private address, or an internet connection that has no publicly reachable IPv4 address.
Godlike.Host offers hosted Minecraft Java servers with its own game panel, SFTP access and free DDoS protection, if you would rather not host it yourself.
Keep the server running during every external test. A port checker normally reports a port as closed when no process is listening, so that result alone does not identify a router problem.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Use this decision tree before changing settings
- Test the host itself. On the computer running the server, connect to
localhost:25565for Java Edition, or the configured Bedrock port. If this fails, stay on the host: inspect startup errors, Java or server software,server.properties, and the listening socket. - Test from the same LAN. From another computer or phone on your home network, connect to the server computer’s private address, such as
192.168.1.50:25565. A failure here points to binding, the host firewall, Wi-Fi client isolation, or a wrong private address—not port forwarding. - Test from outside the LAN. Use a phone on cellular data or ask a friend to connect while the server is running. Do not rely only on a public-address test from inside your own Wi-Fi; many routers lack hairpin NAT and cannot loop an internal client back through the public address.
- Compare addresses and inspect every NAT hop. Compare the router’s WAN/Internet IPv4 address with the public IPv4 shown by an independent service. A mismatch, or a WAN address in a private or shared range, indicates upstream NAT or CGNAT.
This order prevents a common mistake: repeatedly editing a router rule when the server never opened the port in the first place.
Confirm the Minecraft edition and network protocol
Forwarding the wrong protocol or port produces a perfectly configured-looking rule that can never work. Minecraft Help’s 2026 Java server guidance identifies 25565 as the default forwarded port and tells external players to enter the host’s public IPv4 address followed by :25565. SurvivalConfigs records the usual protocol split as Java Edition using TCP 25565 and Bedrock Edition using UDP 19132.
#1 Best Overall
- Play and share with friends on console, mobile and Windows 10
- discover community creations in the new in-game store
- access new mini games and game modes through servers
| Server and client | Typical default | Router rule | Address players use |
|---|---|---|---|
| Java Edition | TCP 25565 | External TCP 25565 to the host’s internal TCP 25565 | public-ip:25565 (the port can be omitted only when it is the client/server default) |
| Bedrock Edition | UDP 19132 | External UDP 19132 to the host’s internal UDP 19132 | Public IPv4 and the configured Bedrock port |
| Custom configuration | The value in server.properties or the server software’s settings |
Forward the same external and internal port and the protocol the software actually listens on | Use the public address plus that custom port |
Do not send Java players to a Bedrock listener or forward TCP when the service is listening on UDP. If you changed the server port, the router rule and the address shared with friends must change with it.
Make sure the server is listening on the host
Check the startup console and configuration
Start the server and wait for its normal ready message before testing. A crash, an incomplete world load, a missing Java runtime, an EULA refusal, or a mod/plugin error can leave no listening socket at all. Read the newest lines in the server console or log and correct the first startup error rather than the later connection symptom.
Open server.properties and verify the port. For a normal multi-interface setup, leave server-ip empty. Binding it to an old address, a loopback address, or an interface that no longer exists prevents LAN and WAN clients from reaching the service. SurvivalConfigs recommends an empty value or 0.0.0.0 so the server can accept connections on the host’s interfaces. Only bind to a specific private address when you have a deliberate reason and that address is current.
After editing the file, stop the server cleanly, save the change, and start it again. A running process may keep the previous port or bind setting until restarted.
Verify a local socket with platform tools
For Java’s TCP listener, run the following on Windows PowerShell:
Test-NetConnection 127.0.0.1 -Port 25565
netstat -ano | findstr :25565Tc pTestSucceeded : True (shown without the space in the actual command output) indicates that something accepted the local TCP connection. The netstat line should show a listening state and a process ID. On Linux, use:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Learn your way around one block at atime in the new tutorial mode
- Craft all sorts of items from boats todiamond armor and create enormousstructures
- Team up with friends in eight-playeronline multiplayer and four-player splitscreen modes
ss -lntp | grep 25565
nc -vz 127.0.0.1 25565For a Bedrock UDP listener, inspect UDP sockets instead:
ss -lunp | grep 19132Windows’ Test-NetConnection is a TCP test; it cannot prove that a UDP Bedrock service is reachable. Use the server’s own log and a LAN client for the UDP confirmation.
Interpret a failed localhost test
- Connection refused or no listener: the process is stopped, crashed, using another port, or bound only to an unexpected address.
- Port already in use: another service owns the port. Stop that service or select a free port and update both
server.propertiesand the forwarding rule. - Local connection works only with a special address: inspect
server-ipand the host’s active interfaces. A loopback-only bind will not accept LAN traffic. - Local Java connection works but Bedrock does not: check that the Bedrock server is running and that you are testing UDP 19132 (or its configured custom UDP port), not TCP 25565.
Prove LAN reachability before touching the WAN rule
Find the host’s current private address
On Windows, run ipconfig and note the active adapter’s IPv4 address. On Linux, ip addr shows addresses on each interface. Use the address on the same home network as the test device, not 127.0.0.1, a VPN address, or an inactive Ethernet/Wi-Fi adapter.
From the second device, enter that private address and the server port. For Java, a typical test is 192.168.1.50:25565. If this works, the server process and LAN path are sound; an outside failure is then in the firewall, NAT, WAN address, or ISP path.
Recommended Free Tools
Check isolation and segmented networks
Guest Wi-Fi and many access points enable client isolation, which intentionally blocks one wireless client from reaching another. Mesh systems can also place wireless and wired devices in separate VLANs. Temporarily test from a trusted, non-guest network or disable the isolation feature for that test. Keep isolation enabled for untrusted guests afterward and create a narrowly scoped network policy if your equipment supports one.
Do not confuse discovery with connectivity
A server not appearing in a multiplayer list does not prove that its port is closed. Directly enter the private address (LAN test) or public address (external test). Discovery broadcasts are often blocked across subnets even when direct TCP or UDP traffic is allowed.
Rank #3
- ENGAGING AND COOPERATIVE: Experience the thrill of Minecraft in a unique and cooperative board game format. Perfect for teams of 2 to 4 players, the game encourages joint strategies and shared victories
- EVER-CHANGING GAMEPLAY: With a map that changes every time you play, this game offers high replay value, making every game a unique and unpredictable experience
- QUALITY COMPONENTS: The game includes 25 wooden blocks, 18 world tiles, 4 inventory boards, 6 player cards, 9 buildings, 12 mob tokens and more. All components are crafted with care to enhance your gaming experience
- AGE-APPROPRIATE CHALLENGE: Aimed at ages 7 and up, this game offers a great balance of fun and challenge, making it a great choice for family game nights, parties, or gatherings
- TRUSTED BRAND: With over 130 years of experience, Ravensburger ensures top quality games that stimulate the mind, engage the hands, and touch the heart
Allow the server through every relevant firewall
Firewalls are independent checkpoints. A successful router mapping still fails if the operating system or security suite drops the packet. EnderDash and SurvivalConfigs both identify host and router firewalls as separate causes.
Windows Defender Firewall
- Open Windows Defender Firewall with Advanced Security.
- Select Inbound Rules, then New Rule.
- Choose Port, select the protocol (TCP for Java; UDP for Bedrock), and enter the actual listening port.
- Choose Allow the connection, limit the profiles and remote scope to your intended networks where practical, name the rule, and save it.
- Ensure no higher-priority block rule or third-party security product overrides it. A temporary, logged firewall test can isolate the cause; restore the restrictive policy immediately after testing.
You can also allow the specific Java or Bedrock executable, but a port rule is easier to audit when the server port is known.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Linux firewalls
With ufw, allow only the required protocol and port:
sudo ufw allow 25565/tcp
sudo ufw allow 19132/udp
sudo ufw status verboseUse only the rule that matches your server; opening both is unnecessary. On systems using firewalld:
sudo firewall-cmd --permanent --add-port=25565/tcp
sudo firewall-cmd --permanent --add-port=19132/udp
sudo firewall-cmd --reload
sudo firewall-cmd --list-portsRemove any test rule you do not need. Also inspect cloud security groups, endpoint security suites, VPN kill switches, and container or virtual-machine networking if the server is not running directly on the physical host.
Build a correct router port-forwarding rule
Reserve the host address first
A DHCP lease can change after a reboot, silently leaving the router rule pointed at yesterday’s address. Create a DHCP reservation for the server’s network adapter, or configure a static address outside the DHCP pool with the correct gateway and DNS settings. Then verify the host still has that address and that the reservation is tied to the correct MAC address.
Rank #4
- Minecraft Dungeons Hero Edition includes the Hero Pass DLC content: a Hero Cape, two player skins, and a chicken pet. It also includes the Jungle Awakens and Creeping Winters DLC packs.
- Dungeon Creeper Battle new-and-nasty mobs in this all-new action-adventure, inspired by classic dungeon crawlers.
- Multiplayer Up to four players can team up and fight together in co-op mode.
- Power Up Unlock dozens of unique items and weapon enchantments for devastating special attacks.
- Options Personalize your character, then fight up-close and personal with melee swings, hang back with ranged attacks, or tank your way through swarms of mobs, by heavy armor
Enter matching external and internal values
Router labels differ, but the fields have the same meaning:
| Field | What to enter |
|---|---|
| Service or description | A clear name such as Minecraft-Java or Minecraft-Bedrock |
| External/WAN port | The port friends will reach (25565 TCP for the usual Java setup; 19132 UDP for the usual Bedrock setup) |
| Internal/LAN port | The port the server process actually listens on; it may differ only if you intentionally translate ports |
| Destination IP | The host’s reserved private IPv4 address, not the router address and not 127.0.0.1 |
| Protocol | TCP, UDP, or both only when the server documentation requires both |
| Enabled | On; save or apply the configuration |
Some routers require separate rules for TCP and UDP. If you use a custom external port, tell players that port explicitly; forwarding 25565 to an internal custom port is valid only when the destination field matches that custom port.
Check for conflicts and router-level blocks
Delete duplicate or stale entries, and confirm that another device is not already using the same external port. Review the router’s inbound firewall, access-control, and parental-control logs. A rule can be enabled yet blocked by a separate WAN policy. Reboot only after saving the configuration; a reboot cannot correct a wrong destination or protocol.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDetect double NAT and CGNAT
Double NAT: forward through every router
Netgate’s pfSense documentation explains that when an edge router sits behind an upstream router, the forward must exist on both devices. For example, a fiber gateway may give your personal router a private WAN address. Forward the public port on the gateway to the personal router’s WAN address, then forward it again on the personal router to the Minecraft host. Alternatively, put the upstream gateway into bridge or passthrough mode if your ISP and equipment support that arrangement.
Look at the router’s WAN address. Ranges such as 192.168.0.0/16, 10.0.0.0/8, and 172.16.0.0/12 are private. The shared CGNAT range 100.64.0.0/10 is also not publicly reachable. If the router WAN address is private while the upstream device owns the public address, you have at least one additional NAT hop.
A packet capture or firewall log that shows no traffic leaving the inside interface is consistent with a NAT or firewall failure, not a Minecraft configuration problem.
Best Value
- Official Minecraft Puzzle Game – Hands-On Logic Game Based on the Best-Selling Video Game.
- 40 Strategic Challenges – Use the Actions to Navigate & Solve Increasingly Tough Puzzles.
- No Screens, Just Strategy – Promotes Problem-Solving with Off-Screen Minecraft Fun.
- Perfect for Ages 8+ – Great Gift for Minecraft Fans Who Love a Challenge!
- Trusted by Parents Worldwide – With Over 50 Million Sold, ThinkFun is the World's Leading Manufacturer of Brain Games and Mind-Challenging Puzzles!
CGNAT: recognize when a local rule cannot solve it
With CGNAT, the ISP translates many customers behind a provider-controlled public IPv4. Your router cannot create an inbound mapping on equipment you do not control. Compare the router WAN IPv4 with the public IPv4 reported by an independent service; a difference, especially when the router address is in 100.64.0.0/10 or another non-public range, is a strong indication.
Ask the provider for a real public IPv4 address (static or dynamic, depending on availability). If that is unavailable, use a tunnel or game-server VPS that supports Minecraft’s required protocol. These options avoid inbound forwarding at home but add a provider dependency, setup work, and potentially recurring cost. A router change fixes local NAT; only an upstream/provider change fixes CGNAT.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test from the real internet path
- Start the server and leave it listening.
- Turn off Wi-Fi on a phone and use cellular data, or have a friend on another network connect.
- Give Java players the public IPv4 followed by
:25565(or your chosen external port). Give Bedrock players the public address and UDP port. - Record the exact symptom and time. Check the host and router firewall logs at that moment.
- Repeat after any address change; dynamic public IPv4 service can change the address you previously shared.
Run a TCP port test only for a Java listener and only while it is active. A “closed” result while the server is stopped is expected. A generic TCP checker cannot validate a UDP-only Bedrock port, and a checker run from inside the same LAN may fail because the router lacks hairpin NAT even though outside players can connect.
Match the symptom to the likely fault
| What you see | Most useful next check |
|---|---|
| Localhost fails | Server startup log, Java/runtime, port value, server-ip, and listening-socket commands |
| Localhost works; LAN fails | Private address, host firewall, Wi-Fi isolation, interface binding, and whether the server is on a different VLAN |
| LAN works; outside times out | Router destination and protocol, WAN firewall, double NAT, and whether the WAN address is public |
| Outside connection is refused | The packet likely reached a host or forwarding endpoint with no listener; verify the port and server process, then inspect NAT rules |
| Outside test works but a friend cannot join | Check the address and port they entered, edition compatibility, whitelist, authentication, and whether their network blocks the protocol |
| Public-IP test fails only at home | Use cellular data or a remote friend; hairpin NAT may be absent |
Once the network handshake succeeds, Minecraft-level controls become relevant. Check the whitelist, bans, online-mode/authentication, player limits, and mod or version compatibility only after the port is demonstrably reachable. Those settings cannot make a closed WAN port open.
Direct forwarding versus a tunnel or VPS
| Approach | Requirements | Trade-offs |
|---|---|---|
| Direct port forward | Public IPv4, stable LAN address, correct NAT path, matching firewall rules, and a listening server | Lowest architectural complexity and no relay dependency, but exposes a service from your home connection and fails under CGNAT |
| Tunnel | A tunnel provider that supports the Minecraft edition and protocol, plus a client running near the server | Avoids inbound router rules; adds provider dependency, possible latency or limits, and often a paid tier |
| Game-server VPS | A VPS with adequate CPU, memory, storage, bandwidth, and firewall control | Public reachability and isolation from the home NAT; requires migration, administration, and recurring cost |
| Router change | Access to every local NAT device | Can fix double NAT or a wrong rule, but cannot bypass ISP CGNAT |
| ISP change | Provider willingness to assign public IPv4 or remove CGNAT | Solves the upstream limitation; availability and price vary by region and plan |
Choose direct forwarding when you control a public IPv4 and are comfortable maintaining firewall rules. Choose a tunnel or VPS when the ISP will not provide inbound reachability or when you prefer not to expose your home connection.
Quick Recap
Security and reliability checks after it works
- Keep the operating system, server software, mods, and plugins updated from trusted sources.
- Use a whitelist for a private world, strong operator credentials, and regular world backups.
- Expose only the Minecraft port; do not forward router administration, remote desktop, SSH, or unrelated services to the internet.
- Restrict firewall source ranges when your group has stable addresses, but remember that friends on changing networks may need a broader rule.
- Document the reserved LAN address, external port, edition, and router rule so a future DHCP or hardware change is easy to diagnose.
- Monitor CPU, memory, bandwidth, and logs. Lag or a full server is a capacity problem, not evidence that forwarding is broken.
Final end-to-end checklist
- Identify Java versus Bedrock and write down the actual configured port and protocol.
- Start the server and confirm a local listener; fix startup or binding errors first.
- Set
server-ipto empty or0.0.0.0unless a deliberate interface bind is required. - Connect from a second LAN device using the host’s current private IPv4.
- Allow the matching port and protocol through the host firewall and any security software.
- Reserve the host’s private address in DHCP.
- Forward the external port to that address and the correct internal port on every NAT router.
- Compare the router WAN IPv4 with an independently observed public IPv4.
- If the WAN address is private, shared, or different, resolve double NAT or request a public IPv4; do not keep editing the inner router.
- Test from cellular data or another remote network while the server is running, then give players the correct public address, port, and edition.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
