Minecraft Port Forwarding: Java and Bedrock Server Guide
Set up Minecraft port forwarding with the correct Java or Bedrock port, a stable local IP, a focused firewall rule, and a real test from outside your home network.
The short answer
For a default Minecraft Java Edition server, forward TCP port 25565 to the computer running the server. For a default Bedrock Dedicated Server, forward UDP port 19132; Bedrock also uses UDP 19133 for IPv6 by default. Confirm the actual values in server.properties and keep the server running while you test. If those settings are correct but friends still cannot connect, CGNAT or ISP filtering may be blocking inbound traffic. In that case, a VPN that explicitly supports port forwarding can provide an alternative route, provided you use its assigned port and confirm UDP support for Bedrock; compare recommended VPN options.
Which Minecraft port should you forward?
The edition, protocol, and configured server port must all match. Forwarding both TCP and UDP is not a substitute for identifying the correct rule.
| Server | Default port | Protocol | What to check |
|---|---|---|---|
| Java Edition | 25565 | TCP | Check server-port in the Java server.properties file. |
| Bedrock Dedicated Server (IPv4) | 19132 | UDP | Check server-port in the Bedrock server.properties file. |
| Bedrock Dedicated Server (IPv6) | 19133 | UDP | This is server-portv6. IPv6 firewall and router behavior differs from IPv4 port forwarding. |
| Modded Java server | Usually 25565 | Usually TCP | Use the port in server.properties and check the modpack documentation for any additional services. |
Do not forward 19132 just because a player uses Bedrock, or 25565 just because a guide says Minecraft. The port belongs to the server software you are actually hosting.
Before you change the router
Make sure the server works locally
Join from the host with localhost, then from another device on your LAN with the host's private IPv4 address. Port forwarding cannot repair a server that is not listening locally.
Give the host a stable local IP
Create a DHCP reservation in the router, or use a carefully configured static address. If the host's local IP changes, the forwarding rule points to the wrong device.
Find the router login
You need the router's admin address and credentials. The page may call the feature Port Forwarding, Virtual Server, NAT Rule, or Port Mapping.
Check that inbound IPv4 can reach you
If your ISP uses CGNAT, or another router sits upstream, a rule on your own router may not be enough. The troubleshooting section below shows how to identify this.
How to port forward a Minecraft server
Identify the server edition and protocol
Java Edition normally accepts TCP connections on 25565. Bedrock Dedicated Server normally accepts UDP traffic on 19132 for IPv4. A Java client cannot directly join a Bedrock server, and a Bedrock client cannot directly join an unmodified Java server.
Run the server and confirm server.properties
Start the server once so it creates its files. Open server.properties and confirm the configured port. If you change it, save the file and restart the server. Official server downloads and setup instructions are linked in the sources section.
# Java Edition
server-port=25565
# Bedrock Edition
server-port=19132
server-portv6=19133Find the host's IPv4 address and default gateway
On Windows, open Command Prompt and run ipconfig. Under the active network adapter, note IPv4 Address for the server computer and Default Gateway for the router. Reserve the IPv4 address in the router before using it as the forwarding target.
ipconfigCreate one precise port forwarding rule
Open the router admin page, find its port forwarding section, and send the server's public-facing port to the same port on the host's private IPv4 address. Save or apply the rule; some routers require a restart.
| Router field | Java example | Bedrock example |
|---|---|---|
| Rule name | Minecraft Java | Minecraft Bedrock |
| External port | 25565 | 19132 |
| Internal port | 25565 | 19132 |
| Protocol | TCP | UDP |
| Target IP | Host's private IPv4, such as 192.168.1.50 | Host's private IPv4, such as 192.168.1.50 |
Allow the same port through Windows Firewall
Open Windows Defender Firewall with Advanced Security and create an inbound rule for the required local port and protocol, or run the matching PowerShell command below as administrator. Limit the rule to the Minecraft port instead of disabling the firewall.
New-NetFirewallRule -DisplayName "Minecraft Java Server" -Direction Inbound -Protocol TCP -LocalPort 25565 -Action Allow
New-NetFirewallRule -DisplayName "Minecraft Bedrock Server" -Direction Inbound -Protocol UDP -LocalPort 19132 -Action AllowIf you changed server-port, replace the sample port. Bedrock's IPv6 port needs a separate UDP rule only when you are intentionally serving over IPv6.
Test from outside your home network
Keep Minecraft running, then ask a friend to connect or use a phone on mobile data. Java players enter your public IPv4 address and add :port only when it is not 25565. Bedrock players add the address and port separately. A test from the same Wi-Fi may fail because some routers do not support NAT loopback, so it does not prove the public rule is broken.
Check the network before changing more settings
Run the NAT test on the same home connection as the server. The result can reveal restrictive or symmetric behavior, but the final proof is still a connection attempt from a different network while the server is online.
Run the NAT testWhy friends still cannot join after port forwarding
Start with the server and work outward. This order prevents repeated router changes when the actual problem is the game edition, host firewall, or ISP connection.
| What you see | Check | What to do |
|---|---|---|
| Nobody on the LAN can join | Server console, local address, version, EULA, and server-port | Fix the local server first. Confirm it is listening and that a LAN device can join. |
| The server appears online but a player cannot join | Java vs Bedrock, game version, mods, allowlist, and address format | Use a compatible client and the exact server version or modpack. Port forwarding does not translate editions. |
| It worked before a restart, then stopped | Compare the host's current IPv4 address with the router rule | Update the target and add a DHCP reservation so the address remains stable. |
| Localhost works, but another LAN device cannot join | Windows Firewall rule, protocol, port, network profile, and third-party security software | Allow the server app or exact inbound port. Do not leave the firewall disabled. |
| LAN works, but outside connections fail through two routers | Look for an ISP gateway plus your own router, or a private WAN address on the second router | Bridge the upstream gateway, use access point mode, or forward the port through both layers. |
| The router WAN IP does not match your public IPv4 | Look for 100.64.0.0/10 or another private address on the router WAN page | Ask the ISP for a public IPv4 address, or use a hosting method with supported inbound forwarding. |
| Connections fail only while a VPN is active | Whether the VPN supports inbound port forwarding, the assigned port, and UDP support | Disconnect it for normal router forwarding, or configure the server to use the provider's assigned inbound port. |
When the router rule is not the whole path
Port forwarding works only when every layer between the internet and the server permits the connection. Use these guides to check the upstream path before opening more ports.
Keep a public Minecraft server safer
- Forward only the port and protocol the server needs. Remove the rule when you stop hosting.
- Do not place the server computer in the router's DMZ just to make Minecraft work; that exposes far more traffic than one port rule.
- Keep the operating system, Java runtime, Minecraft server, plugins, and mods current.
- Use the server allowlist for a private group, use operator permissions sparingly, and never share router or server admin credentials.
- Back up worlds and configuration before updates or major changes, and review server logs for unexpected access attempts.
Hosting through a VPN when normal forwarding is blocked
A VPN can provide a different inbound path when CGNAT or an ISP prevents normal port forwarding, but only if the VPN provider explicitly supports incoming port forwarding. The Minecraft server must listen on the port the provider assigns, and Bedrock hosting also requires UDP support.
A normal VPN connection does not open your Minecraft server
Many VPNs block unsolicited inbound traffic. A VPN also does not change the NAT settings on your home router. Confirm the provider's current port forwarding availability, supported locations, protocol, platform, and assigned-port rules before paying.
PureVPN
PureVPN is a long-running VPN brand with 3M+ satisfied users and independently audited no-log claims. Its port-forwarding add-on can open specific ports, while the 31-day money-back guarantee and 24/7 support make it easy to test before keeping it.
Private Internet Access
Private Internet Access is a long-running, well-known VPN brand in the US and Europe with 10+ years in the market. Its court-tested, Deloitte-audited no-logs policy, open-source apps, selected-server port forwarding, and 30-day money-back guarantee make it a practical lower-risk test.
Proton VPN
Proton VPN comes from the team behind Proton Mail, part of a privacy ecosystem trusted by over 100 million users. It combines open-source apps, repeated independent no-logs audits, port forwarding on P2P servers, and a 30-day money-back guarantee, making it a strong privacy-first VPN workaround to test.
Minecraft port forwarding FAQ
What port does Minecraft Java Edition use?
A default Minecraft Java Edition server uses TCP port 25565. If server-port in server.properties has a different value, forward that configured TCP port instead.
What port does Minecraft Bedrock Edition use?
A default Bedrock Dedicated Server uses UDP port 19132 for IPv4 and UDP port 19133 for IPv6. Confirm server-port and server-portv6 in its server.properties file.
Is Minecraft port 25565 TCP or UDP?
The normal Java Edition game connection on port 25565 uses TCP. Bedrock's default 19132 connection uses UDP. Optional plugins, query services, proxies, or mods may document additional ports.
Why can I join locally but my friends cannot?
The most common causes are a rule targeting the wrong local IP, the wrong port or protocol, a host firewall block, Double NAT, CGNAT, or testing while the server is offline. Compare the router WAN IP with your public IPv4 and test from a different network.
Is Minecraft port forwarding safe?
It creates a public path to the server, so it carries risk. Reduce that risk by forwarding only the required port, keeping software updated, using an allowlist for private servers, limiting operator access, and maintaining backups. Do not use a full-device DMZ as a shortcut.
Can I host a Minecraft server without port forwarding?
Yes. You can rent a hosted server, use a managed realm, or use a tunnel or VPN service that explicitly supports inbound connections. These alternatives are useful behind CGNAT, but they may add cost, latency, assigned-port limits, or third-party dependence.
Official setup and security references
Port defaults and firewall guidance on this page are based on official Minecraft and Microsoft documentation.