Minecraft server port forwarding guide (TCP 25565, NAT, and CGNAT)

A Minecraft Java Edition server only needs one port open to be reachable from the public internet: TCP 25565. That sentence is the easy part. The hard part is the path the connection takes from the player's PC to your server process, and the four different places that path can be blocked. This guide walks every layer in order, gives you a way to test it, and covers the CGNAT case that breaks port forwarding entirely.

What port does a Minecraft server use?

Java uses TCP because the protocol is reliability sensitive. Bedrock uses RakNet over UDP. If you are running both editions side by side via Geyser, you forward both TCP 25565 and UDP 19132.

The four layers that can block the connection

Trace the connection in order and you will find the failure on exactly one layer:

1. The Minecraft server itself. Theserver-ip field in server.properties must be empty or set to 0.0.0.0. Setting it to 127.0.0.1 or a LAN address binds the listener to a single interface and the router cannot reach it.
2. The host machine firewall. Windows Defender Firewall, ufw, firewalld, or a third party security suite must allow TCP 25565 inbound for the Java process.
3. The router. The router needs an explicit port forward rule mapping public TCP 25565 to the LAN IP of the host machine, also on TCP 25565.
4. The ISP. If your provider uses CGNAT, your public IPv4 address is shared with hundreds of other subscribers and port forwarding cannot work no matter how the router is configured. The fix is a tunnel service or a VPS.

Step 1: Fix server.properties

Open server.properties in the server directory. Confirm these two fields:

$server-port=25565
$server-ip=

Step 2: Open the host firewall

Windows Defender Firewall

$New-NetFirewallRule -DisplayName "Minecraft Server TCP 25565"   -Direction Inbound -Protocol TCP -LocalPort 25565 -Action Allow

Linux with ufw

$sudo ufw allow 25565/tcp comment "Minecraft Java"
$sudo ufw reload
$sudo ufw status

Linux with firewalld

$sudo firewall-cmd --permanent --add-port=25565/tcp
$sudo firewall-cmd --reload

Step 3: Add the router port forward

Every router admin UI is slightly different, but the fields are always the same five values. Use the table as a template; the labels in your router may differ.

Step 4: Is your ISP putting you behind CGNAT?

Carrier Grade NAT is increasingly common on mobile carriers, rural ISPs, and some fiber providers. Easy test: look up your public IP at whatismyipaddress.com and compare it to the WAN IP shown in your router's status page. If they differ, you are behind CGNAT and a router port forward cannot work.

Three options if you are stuck on CGNAT:

• Ask the ISP for a dedicated IPv4 address. Some will assign one on request, sometimes for a small fee.
• Use a tunneling service like Playit.gg, ngrok, or Cloudflare Spectrum. These give you a public address that proxies into your server over an outbound connection, no router config required.
• Move the server to a VPS. Even a $5 per month box can run a small Paper server comfortably and gives you a stable public IPv4.

Verifying the port is open

Start the server, then ask a port checker to look at your public IP on TCP 25565. Two reliable options:

• mcsrvstat.us performs a real Minecraft protocol handshake, so a green response means the world is actually reachable, not just that the port is open.
• portchecker.co is a generic TCP probe. Useful for confirming the port is open even when the server is offline for maintenance.

Changing the default port

Running multiple servers on the same machine? Each one needs a unique port. Change server-port inserver.properties, mirror that value in the firewall rule and the router forward, and tell players the new address. Java clients accept example.com:25575 directly in the server address field.

$server-port=25575
$server-ip=

Need a full deployment walkthrough? See Minecraft PaperMC via Docker Compose.