Server · Networking

How to Port Forward a Minecraft Server

To let friends join from outside your house, your router has to send incoming traffic on port 25565 to the machine running the server. One forwarding rule does it, here is the exact setup and how to prove it works.

192.168.1.1,  Port Forwarding
SERVICEPORTFORWARD TOPROTO
Minecraft25565192.168.1.42TCP/UDP
SSH22192.168.1.5TCP
Web443192.168.1.10TCP
Rule saved · router rebooting
~$ nc -zv 203.0.113.7 25565█
Connection to 203.0.113.7 25565 port [tcp] succeeded!<Steve> joined the game

The one rule that matters

1
Set a static local IP
Give the PC running the server a fixed LAN address (e.g. 192.168.1.42) via a DHCP reservation, so the forward never points at the wrong device.
2
Open the router panel
Browse to your gateway, usually 192.168.1.1 or 192.168.0.1, and log in. Find Port Forwarding, sometimes under NAT, Virtual Server, or Gaming.
3
Add the 25565 rule
Create a rule: external port 25565, internal port 25565, internal IP 192.168.1.42, protocol TCP/UDP (both). Java uses TCP; UDP covers Bedrock and pings.
4
Save and apply
Save the rule and let the router apply or reboot. Make sure Windows Firewall also allows javaw.exe / java on port 25565 inbound.
5
Test from outside
Find your public IP, then test with nc -zv YOUR_IP 25565 or a port checker. Friends connect using that public IP, not 192.168.x.x.

What you need

Public IP address

Local server IP

Port 25565 TCP/UDP

Port checker / nc

Quick answers

What port does Minecraft use?

Java Edition defaults to 25565 (TCP). Bedrock uses 19132 (UDP). Forward TCP/UDP on 25565 for Java; the same port the server-port line in server.properties is set to.

Do I need TCP or UDP?

Java needs TCP. Select TCP/UDP (both) so server-list pings and Bedrock clients work too. There is no downside to forwarding both.

What IP do friends use?

Your public IP, not the 192.168.x.x LAN address. Find it at whatismyip or in the router WAN status. They type publicIP:25565 in Add Server.

My public IP keeps changing.

Most home ISPs hand out dynamic IPs. Use a free Dynamic DNS hostname (No-IP, DuckDNS) so a fixed name always points at your current IP.

Port forward done but still offline.

Check Windows Firewall, confirm the static LAN IP matches the rule, and rule out CGNAT, where the ISP shares one public IP and blocks inbound. CGNAT needs a VPN tunnel or a host.

Is opening 25565 safe?

It exposes only that one port to your server. Keep the server updated, set a whitelist (whitelist on), and never forward your whole DMZ to the machine.