Port Forwarding, DNS and Firewalls for Minecraft Servers

Home or hosting?

You can host a server on a computer at home, or rent a server. Home hosting is free and fine for friends, but it exposes your home internet connection's address to everyone who joins, can be knocked offline by someone targeting that address, and depends on your connection and power. A rented game host or VPS has a better connection, is on all the time and keeps your home address private. For a public server that you want to list, hosting is the safer choice.

Which ports

Java uses TCP and Bedrock uses UDP. If you forward the wrong type, the server will look online from your own computer but not from outside.

• Minecraft Java Edition: TCP 25565 by default.
• Bedrock Dedicated Server: UDP 19132 (and UDP 19133 for IPv6).
• Geyser on a Java server: UDP 19132 by default, set in Geyser's config.
• Do not open ports for remote admin features such as RCON unless you really need them, and never without a strong password.

Step 1: Give the server a fixed local address

Your router hands out local addresses such as 192.168.1.50 and can change them. In your router's settings, reserve a fixed address for the server computer (often called DHCP reservation or static lease), so the forwarding rule keeps pointing at the right machine.

Step 2: Forward the ports on your router

1. Open your router's admin page (the address is usually on a sticker on the router).
2. Find Port Forwarding, Virtual Server or NAT.
3. Add a rule: protocol TCP, external port 25565, internal port 25565, internal address your server's fixed address. For Bedrock add another rule with protocol UDP and port 19132.
4. Save and, if the router asks, restart it.

Some internet providers put many customers behind one shared address (called CGNAT). If your router's WAN address is different from the address a "what is my IP" website shows, port forwarding cannot work, and you need to ask your provider for a public address, or use a hosting service instead.

Step 3: Allow it through the server's firewall

On a rented host, also open the same ports in the provider's own firewall or security group, which is separate from the machine's firewall.

New-NetFirewallRule -DisplayName "Minecraft Java" -Direction Inbound -Protocol TCP -LocalPort 25565 -Action Allow
New-NetFirewallRule -DisplayName "Minecraft Bedrock" -Direction Inbound -Protocol UDP -LocalPort 19132 -Action Allow

sudo ufw allow 25565/tcp
sudo ufw allow 19132/udp

Step 4: Test from outside

1. Ask a friend on a different network to join using your public address, or test from a phone on mobile data.
2. Use an online port checker for TCP 25565 (Java). For UDP and Bedrock, test from a real Bedrock device.
3. When it works, add your server to MCServerShare. Our status checks will show it online, and you will see the status on your listing.

Domain names and SRV records

Players can join using your public IP address, but a domain is easier to remember and lets you move the server later without telling anyone. Buy a domain, then create a DNS record:

• An A record pointing a name such as play.example.com at your server's IPv4 address.
• If your Java server uses a port other than 25565, add an SRV record so players do not need to type it: service _minecraft, protocol _tcp, name play, priority 0, weight 5, the port number, and target play.example.com.
• Bedrock does not use SRV records. Bedrock players must type the port, so keep Bedrock on 19132 if you can.

If you use Cloudflare for DNS, set the record to DNS only (grey cloud). Cloudflare's proxy does not carry Minecraft traffic.

Safety basics

• Keep online-mode=true (Java) or online-mode=true (Bedrock) so accounts are verified.
• Use a whitelist while you are still setting up.
• Keep the server software and plugins up to date.
• Never share your home IP address publicly if you can avoid it. Putting the server behind a domain and a host hides it.
• Back up regularly, so a bad update or an attack does not cost you the world.

When it still does not work

• It works on your own computer but not for friends: the router rule or firewall is wrong, or the provider uses CGNAT.
• It works for friends on Java but not Bedrock: you forwarded TCP only. Bedrock needs UDP.
• It worked, then stopped: your home address changed. Use a dynamic DNS service, or switch to a host with a fixed address.
• Players see "Can't resolve hostname": the DNS record has a typo or has not propagated yet. Give it up to an hour.

Frequently asked questions