Port forwarding, worked out for you

Choose your game and your router. You get the exact ports, written the way your firmware wants them typed, the rules spelled out field by field, and — the part most guides leave out — the ports you should refuse to open.

Pick your game

Your setup

Pick the firmware family, not the exact model — the menus are identical across a range.

Default is 25565. If you changed it, it is the value of server-port (server.properties).

The private address of the machine running the server — ipconfig on Windows, ip addr on Linux. It starts with 192.168, 10. or 172.

Open these

This firmware accepts ranges, so each line below is a single rule.

  • 25565 TCP
  • 25565TCPJava EditionEvery Java client connects here. Minecraft is TCP — forwarding UDP alone is the single most common failed setup.

Only if you want them

The server works without these. Every port you open is a port someone can knock on, so skip anything you do not need.

  • 25565 UDP
  • 25565UDPQueryOnly needed when enable-query=true, which is not the default. Server-list sites read player counts from it.

Do not open these

These are administrative sockets. Plenty of guides list them next to the game ports; opening them puts a remote console for your server on the public internet.

  • 25575TCPRCONRemote console. The password crosses the wire unencrypted — administer over SSH or your host panel instead.

If you need remote administration, reach the machine over SSH or a VPN and talk to the port from there. The port stays closed to everyone else.

Step by step: your router

  1. 1

    Give the server a fixed local IP

    A forward points at one address. If the server picks up a different one after a reboot, the rule silently starts pointing at nothing — this is why forwards "stop working" on their own.

    On this router:look for DHCP Reservation, Address Reservation, Static Lease or Manually Assigned IP

  2. 2

    Open the router admin page

    Try these addresses in a browser on the same network:

    • 192.168.0.1
    • 192.168.1.1
    • 192.168.2.1
    • 10.0.0.1

    Almost always printed on a sticker on the router itself.

  3. 3

    Find the port forwarding page

    Port Forwarding, Virtual Server, NAT, Applications & Gaming, or Port Mapping

    Vendors use at least six names for the same feature. Whatever it is called, the page you want is the one asking for a port, a protocol and a device on your network. If the external and internal port fields both exist, set them to the same number.

  4. 4

    Create one rule per line

    a description field, if there is oneExternal / WAN / Public / Service portInternal / LAN / Private portProtocolInternal IP / Device / Server IP
    Minecraft2556525565TCPyour server’s local IP

    External and internal port are the same number here. Changing the external port is possible, but then everyone connects on the new one, so keep them matched unless you have a reason.

  5. 5

    Let the server through its own firewall

    The router now sends traffic to the machine, and the machine can still refuse it. Windows Defender Firewall in particular blocks a freshly installed dedicated server by default, which looks exactly like a failed forward.

Take it with you

Minecraft — port forwarding rules
---------------------------------
25565  TCP  ->  <server local IP>

Check whether it worked

Test from outside your own network. Connecting from a machine in the house proves nothing — that traffic never leaves the LAN and never touches the rule you just wrote.

What a forward actually does

Your router holds one public address and hands out private ones to everything in the house. When a packet arrives from the internet, the router has to decide which of those machines it was meant for, and for an unsolicited packet it has no way to know. A forwarding rule is that decision, written down in advance: traffic arriving on this port goes to this machine. Nothing else about it is complicated, which is why the failures are almost never conceptual — they are a wrong protocol, a wrong address, or a second firewall nobody thought about.

When forwarding cannot work at all

A growing number of connections — most mobile broadband, a lot of fibre, and nearly all 4G and 5G home internet — put customers behind carrier-grade NAT. Your router gets an address that looks public, and it is not: the ISP is sharing one real address between hundreds of households. Incoming connections stop at their equipment, and no rule you write on your own router can reach past it.

The test takes ten seconds. Use the Detect button above to see the address the internet sees you as, then read the WAN or Internet address off your router’s own status page. If they match, you have a public address and forwarding will work. If they differ, they do not, and no further clicking will change that — your options are to ask the ISP for a public address, tunnel out through a VPN, or run the server somewhere that already has one.

Open the fewest ports you can

A forwarded port is a standing invitation, and the internet answers invitations automatically. Scanners find a newly opened game port within hours, and while a game port is not much of a target, the administrative ports that guides list alongside it very much are. RCON and telnet consoles authenticate with a single password sent in clear text; a web dashboard is a login form on a machine inside your house. This tool marks those separately and refuses to include them in the generated rules, no matter which game you pick.

Every game covered

Test whether a server is reachableSkip the router entirely
Support & Help