Short answer
Forward TCP port 25565 on your router to the machine running the server, allow that port through the machine's firewall, and keep the server on the same local IP. Then confirm from a network that is not your own, because a device on your Wi-Fi proves nothing.
Port forwarding is the step that makes a server running in your house reachable from the internet. It tells your router to send incoming Minecraft traffic to your machine instead of dropping it, and it is where most first-time self-hosters give up, because the router interface rarely explains itself.
This guide does the forwarding, then the firewall, then the test that actually proves it worked. It also covers the case where it cannot work at all, because some connections never reach your router.
Before you start
- The server running and joinable on your own local network
- Access to your router's settings, usually from a web page
- The machine's local IP address and its MAC address
1. Reserve a local IP for the server machine
Before forwarding anything, make the machine's address stable. Routers hand out addresses with DHCP, so the machine can get a different one after a reboot and your forwarding rule will quietly point at nothing.
Set a DHCP reservation on the router for the machine's MAC address, or set a static IP on the machine itself inside the range your router uses. Note the address; it goes into the forwarding rule.
# Linux
ip addr show | grep "inet "
ip link show | grep ether
# macOS
ipconfig getifaddr en0
ifconfig en0 | grep ether
# Windows
ipconfig /all2. Create the forwarding rule
Port forwarding lives in your router's settings, usually under a heading like Port Forwarding, NAT, Virtual Server or Applications. Log into the router's own web interface, which is usually an address like 192.168.1.1 or 192.168.0.1.
Create one rule: protocol TCP, external port 25565, internal port 25565, internal address the machine's local IP, and leave the external address blank so it applies to the connection you have. Some routers need the rule enabled as well as configured, which is a separate checkbox.
Protocol TCP
External port 25565
Internal port 25565
Internal IP 192.168.1.50
External IP blank (your current connection)
Enabled yesip route | grep default # Linux
route -n get default | grep gateway # macOS
ipconfig | findstr /i gateway # Windows3. Allow the port through the machine's firewall
The router rule is the outer wall. The machine has its own one. Windows Defender Firewall blocks inbound Java connections by default unless you allow them, and the block is silent: you can reach the server locally and nobody can reach it from outside.
Allow the Java executable, or the port, in the machine's firewall. Prefer the executable rule: it follows the server when the port changes.
netsh advfirewall firewall add rule name="Minecraft Server" dir=in action=allow protocol=TCP localport=25565sudo ufw allow 25565/tcp
sudo ufw status4. Test from a network that is not your own
Joining from your own Wi-Fi proves nothing: that traffic never leaves your house. The real test is a phone on mobile data, or a friend asking for the address.
Find your public IP address from your router's status page or an external service, and give that address, with :25565, to the tester. If they connect, forwarding works. If they time out, the problem is upstream of your machine, and the next step names where.
203.0.113.42:25565
(the public IP of your connection, and the port you forwarded)5. Know what forwarding exposes
The rule opens one port to the whole internet, on a machine that also has your files and your browser on it. That is worth taking seriously: keep the machine updated, do not run other services on it, and change the router's admin password if you have not.
Then consider whether you still need it. A hosted server has a public address and no forwarding, no open port and nothing on your home connection. Making a free server is the trade in the other direction, and it is a good one for a group that only wants to play.
Good to know
- Two ports, not one: Minecraft's game traffic is TCP 25565. The Bedrock Edition protocol is UDP 19132, which is a different game and a different rule.
- Only forward what you need. Every open port on your router is a door, and this guide needs exactly one.
- The server must be running and listening when you test. A rule pointing at a stopped server fails exactly like a broken one.
- The ports reference explains why the game needs a port at all, and connection errors covers what the error messages mean once people can reach you.
Common questions
What port does a Minecraft server use?
25565 by default, and it can be changed in server.properties with server-port. If you change it, the router rule and the firewall rule have to use the same number.
Why can my friends join on my Wi-Fi but not from home?
Traffic inside your network never reaches the router's forwarding rule, so a successful local join proves the server works and nothing about the internet path. Test from mobile data or another network to check the forwarding itself.
Do I need to forward ports with a hosted server?
No. A hosted server has a public address already, which is why it needs neither port forwarding nor a fixed local IP. That is the main practical difference between hosting at home and hosting elsewhere.
My port forward does not work. What now?
Check in order: the machine's local IP has not changed, the rule is enabled as well as configured, the port matches server-port, the machine's firewall allows it, and your connection is not behind carrier-grade NAT. The public IP on your router's status page is the place to start.
Is it safe to forward 25565?
It opens one port to one program, which is the minimum a self-hosted server needs. Keep the machine updated, do not run other services on it, and change your router's admin password, since a forwarded port is only as safe as the machine behind it.
Sources
Official documentation this guide was checked against.
Rather not run this on your own machine? PufferHost gives every player a free Minecraft server with 3 GB of RAM and 10 slots. Create a free server.