Port forwarding for game servers

Tell us the game and the router. You get the ports to open in the format your firmware expects, each rule laid out field by field, and a list of the ports you should never open — the section most guides skip.

Pick your game

Your setup

Router

Choose the firmware family rather than your exact model — every router in a family shares the same menus.

Game port

Out of the box it is 25565. If you changed that, use whatever you set in server-port (server.properties).

Server’s local IP

The local address of the computer that runs the server. Find it with ipconfig on Windows or ip addr on Linux; it will begin with 192.168, 10. or 172.

Open these

Your firmware takes ranges, so each line here is one rule.

25565 TCP

25565TCPJava EditionEvery Java client connects here. Minecraft is TCP — forwarding UDP alone is the single most common failed setup.

Only if you want them

The server runs fine without these. Each open port is one more door for strangers to try, so leave out what you do not need.

25565 UDP

25565UDPQueryOnly needed when enable-query=true, which is not the default. Server-list sites read player counts from it.

Do not open these

These are admin sockets. Many guides put them in the same list as the game ports, but forwarding them exposes a remote console for your server to the whole internet.

25575TCPRCONRemote console. The password crosses the wire unencrypted — administer over SSH or your host panel instead.

For remote administration, connect to the machine through SSH or a VPN and use the port locally from there. Nobody else can reach it that way.

Step by step: your router

1
Give the server a fixed local IP
A forwarding rule targets a single local address. If the server comes back from a reboot with a new one, the rule quietly points at an empty address — which is how forwards seem to "break by themselves".
On this router:look for DHCP Reservation, Address Reservation, Static Lease or Manually Assigned IP
2
Open the router admin page
From a device on the same network, open one of these in a browser:
- 192.168.0.1
- 192.168.1.1
- 192.168.2.1
- 10.0.0.1
Almost always printed on a sticker on the router itself.
3
Find the port forwarding page
Port Forwarding, Virtual Server, NAT, Applications & Gaming, or Port Mapping
Vendors use at least six names for the same feature. Whatever it is called, the page you want is the one asking for a port, a protocol and a device on your network. If the external and internal port fields both exist, set them to the same number.
4
Create one rule per line
a description field, if there is one External / WAN / Public / Service port Internal / LAN / Private port Protocol Internal IP / Device / Server IP
Minecraft 25565 25565 TCP your server’s local IP
Use the same number for the external and internal port. You can make the external one different, but then every player has to connect on that new number, so keep them identical unless you have a specific reason not to.
5
Let the server through its own firewall
The router is now sending traffic to the right computer, but that computer can still turn it away. Windows Defender Firewall is the usual offender: it blocks a newly installed dedicated server by default, and from outside that is indistinguishable from a broken forward.

Take it with you

Minecraft — port forwarding rules
---------------------------------
25565  TCP  ->  <server local IP>

Check whether it worked

Always test from outside your network. A connection from another device in the house proves nothing: that traffic stays on your LAN and never passes through the rule you just created.

Your public IP

What forwarding really does

Your router has a single public address and gives every device at home a private one. When something from the internet arrives without being asked for, the router cannot tell which device it belongs to. A forwarding rule answers that question ahead of time: anything arriving on this port goes to that machine. That is the whole idea, and it is why forwarding problems are almost never about understanding — they are the wrong protocol, the wrong address, or a second firewall nobody remembered.

When forwarding is impossible

More and more connections — most mobile broadband, plenty of fibre, and nearly every 4G or 5G home service — place customers behind carrier-grade NAT. Your router receives an address that looks public but is not, because the ISP shares one genuine address among hundreds of homes. Inbound connections end at the ISP's equipment, and no rule on your router can reach beyond it.

Checking takes ten seconds. Press Detect above to see the address the internet sees, then look up the WAN or Internet address on your router's status page. Same address: you have a public IP and forwarding will work. Different address: you do not, and nothing else you try will change that. Your choices are asking the ISP for a public address, tunnelling out through a VPN, or running the server somewhere that already has a public IP.

Open as few ports as possible

An open port is an invitation that stays open, and the internet accepts invitations automatically. A new game port gets found by scanners within hours; the game port itself is a poor target, but the admin ports that guides list beside it are a very good one. RCON and telnet consoles log in with one password sent unencrypted, and a web dashboard is a login page on a computer in your home. This tool lists those ports separately and never puts them in the generated rules, whatever game you choose.

Test whether a server is reachable Skip the router entirely

Port forwarding for game servers

Pick your game

Your setup

Open these

Only if you want them

Do not open these

Step by step: your router

Give the server a fixed local IP

Open the router admin page

Find the port forwarding page

Create one rule per line

Let the server through its own firewall

Take it with you

Check whether it worked

What forwarding really does

When forwarding is impossible

Open as few ports as possible

All supported games

Rather not run the server yourself?