How to port forward a Minecraft server
A Java Edition server needs exactly one port open, and it is a TCP port. That single fact resolves most failed Minecraft setups: the protocol is a plain TCP stream, so a rule that opens UDP alone looks perfectly correct in the router and accepts no connections at all.
Your setup
Pick the firmware family, not the exact model — the menus are identical across a range.
Default is 25565. If you changed it, it is the value of server-port (server.properties).
The private address of the machine running the server — ipconfig on Windows, ip addr on Linux. It starts with 192.168, 10. or 172.
Open these
This firmware accepts ranges, so each line below is a single rule.
- 25565 TCP
25565TCPJava EditionEvery Java client connects here. Minecraft is TCP — forwarding UDP alone is the single most common failed setup.
Only if you want them
The server works without these. Every port you open is a port someone can knock on, so skip anything you do not need.
- 25565 UDP
25565UDPQueryOnly needed when enable-query=true, which is not the default. Server-list sites read player counts from it.
Do not open these
These are administrative sockets. Plenty of guides list them next to the game ports; opening them puts a remote console for your server on the public internet.
25575TCPRCONRemote console. The password crosses the wire unencrypted — administer over SSH or your host panel instead.
If you need remote administration, reach the machine over SSH or a VPN and talk to the port from there. The port stays closed to everyone else.
Step by step: your router
- 1
Give the server a fixed local IP
A forward points at one address. If the server picks up a different one after a reboot, the rule silently starts pointing at nothing — this is why forwards "stop working" on their own.
On this router:look for DHCP Reservation, Address Reservation, Static Lease or Manually Assigned IP
- 2
Open the router admin page
Try these addresses in a browser on the same network:
- 192.168.0.1
- 192.168.1.1
- 192.168.2.1
- 10.0.0.1
Almost always printed on a sticker on the router itself.
- 3
Find the port forwarding page
Port Forwarding, Virtual Server, NAT, Applications & Gaming, or Port Mapping
Vendors use at least six names for the same feature. Whatever it is called, the page you want is the one asking for a port, a protocol and a device on your network. If the external and internal port fields both exist, set them to the same number.
- 4
Create one rule per line
a description field, if there is one External / WAN / Public / Service port Internal / LAN / Private port Protocol Internal IP / Device / Server IP Minecraft 25565 25565 TCP your server’s local IP External and internal port are the same number here. Changing the external port is possible, but then everyone connects on the new one, so keep them matched unless you have a reason.
- 5
Let the server through its own firewall
The router now sends traffic to the machine, and the machine can still refuse it. Windows Defender Firewall in particular blocks a freshly installed dedicated server by default, which looks exactly like a failed forward.
Take it with you
Minecraft — port forwarding rules --------------------------------- 25565 TCP -> <server local IP>
Check whether it worked
Test from outside your own network. Connecting from a machine in the house proves nothing — that traffic never leaves the LAN and never touches the rule you just wrote.
What usually goes wrong
Bedrock Edition is a different server on a different port over a different protocol, and the two are not interchangeable. If your players are on phones, consoles or the Windows Store version, they are on Bedrock and the guide you want is the one for port 19132 over UDP. The other frequent trap is the query port: it only matters if you have turned querying on so that server-list sites can read your player count, and it is not needed for anyone to join.
Not forwarding at all
You can skip forwarding entirely by publishing an SRV record, which lets players type a domain instead of an address and port — though the port still has to be reachable, so it solves tidiness rather than connectivity. A hosted server sidesteps the question: the machine already sits on a public address with the port open.