How to Open Port 25565 for a Minecraft Server and Find Where It Is Closed

What a port is and which one Minecraft needs

An IP address points to a device, and a port points to a particular program on it: it is like the address of a building and an apartment number. A computer runs a browser, messaging apps and games at the same time, and every program that accepts incoming connections needs its own port number (from 0 to 65535). A Minecraft server listens on one such port, and friends connect to a pair: an address and a port.

• Java Edition: port 25565, protocol TCP. This is the default.
• Bedrock Edition (the version for phones, consoles and Windows): port 19132, protocol UDP; for IPv6 it uses port 19133. This edition needs its own server program (Bedrock Dedicated Server): you can’t join a Java server from Bedrock without extra software such as Geyser, and game consoles can’t add a server by address.

When the port is the default one, friends in Java Edition only need to type the address. If the port is different, it is added after a colon: 203.0.113.5:25570. Below we use 25565 and TCP; for Bedrock, replace them with 19132 and UDP.

Keep in mind that “opening a port” is not a single button. A friend’s connection passes through four “doors”, and if even one of them is closed, they get an error.

Four doors on the way to the server

To reach your server from the internet, a connection has to get through four checkpoints, and at each of them it can be stopped:

1. 1The server. The Minecraft program has to listen on the right port.
2. 2The Windows firewall. It blocks incoming connections until you allow them.
3. 3The router. It has to know which computer in the house to pass an incoming connection to. This is called port forwarding.
4. 4The provider. It has to give you a public IP address; otherwise the connection won’t even reach your router.

It is best to set up and check from the inside out: from the server to the provider. While the first door is closed, checking the second is pointless: you won’t know which of them is to blame. After each door there is a check in this article, so don’t skip it. One exception: check whether you have a public IP (door 4) right at the start: it takes a couple of minutes and can save you an hour of setup.

Preparation: find your computer’s address on the home network

You will need this address in several steps. Press Win+R, type cmd and press Enter, then run the command ipconfig. Find the section for your connection (Ethernet if you use a cable, or the Wi-Fi adapter) and write down two lines: “IPv4 Address” (for example, 192.168.0.105: this is your computer’s address) and “Default Gateway” (for example, 192.168.0.1: this is your router’s address; if two addresses are listed there, take the one made of four numbers separated by dots, not the one that starts with fe80::).

If there are several adapters (for example, because of a VPN or virtual networks), choose the one with a filled-in “Default Gateway”: that is your real connection to the router.

Door 1. The server listens on the right port

Open the server.properties file in the server folder (plain Notepad will do). Two lines matter to us: server-port=25565 and server-ip=. You don’t need to change the port. The server-ip field must be empty: if you put an address there, the server will accept connections only on it, and if the address is wrong it won’t start at all. Restart the server after any changes.

Start the server and wait for the last line, which looks like Done (12.873s)! For help, type "help", in the console (once it appears, the server is ready). Higher up in the console, find a line like Starting Minecraft server on *:25565: it shows which port the server listens on. If another program is using the port (often a second copy of the same server that is still running: open Task Manager, go to the “Details” tab and look for java.exe or javaw.exe), the server will print FAILED TO BIND TO PORT and won’t start: close the other program or change server-port.

To check this door, start the game, open “Multiplayer”, click “Add Server”, type localhost in the “Server Address” field and click “Done”. Then select the server in the list and click “Join Server”. If the server lets you in, the first door is open. If you see “You are not white-listed on this server!”, the first door is open too: since Minecraft 26.3 (15 September 2026) a new server starts with the whitelist turned on and lets in nobody who is not on the list, the owner included. Type /whitelist add PlayerName in the server console, replacing PlayerName with your nickname (or /op PlayerName: operators can always join), and try again. If you see something else, the problem is not the ports but the server itself: go back to the guide to making a server and check the Java version, the eula.txt file and the console messages.

Door 2. The Windows firewall

The Windows firewall blocks incoming connections until you allow them. You may have already done this: the first time you start the server, Windows shows a window asking whether to allow access to Java (it may be called Java(TM) Platform SE binary or OpenJDK Platform binary). But if Windows considers your home network public and you selected only private networks, access stays closed anyway. It is more reliable to create a rule for the port by hand. One caveat: if you clicked “Cancel”, closed that window, or your Windows account has no administrator rights, Windows creates blocking rules for Java instead, and a block rule always takes precedence over an allow rule. The rule from the steps below won’t work until you delete the blocking rules (how to do that is described after the check).

1. 1Press Win+R, type wf.msc and press Enter (Windows will ask for administrator permission): the firewall opens in advanced security mode.
2. 2On the left choose “Inbound Rules”, on the right click “New Rule”.
3. 3Rule type: “Port”. Click “Next”.
4. 4Choose TCP and “Specific local ports”, and type 25565. Click “Next”.
5. 5Action: “Allow the connection”. Click “Next”.
6. 6Profiles: leave all three selected (Domain, Private, Public), so that the rule works regardless of whether Windows treats your network as private or public. But then it also applies on other people’s networks (a coffee shop, a dormitory), so turn off the server or this rule there. Click “Next”.
7. 7Name: anything, for example Minecraft server. Click “Finish”.

The same can be done with one command. Open Command Prompt as administrator (press Win, type cmd, right-click “Command Prompt” and choose “Run as administrator”) and run netsh advfirewall firewall add rule name="Minecraft server" dir=in action=allow protocol=TCP localport=25565. If you have a third-party antivirus with its own firewall, allow this port there too.

To check this door, you will need a second device on the same home network: a laptop or another computer. Connect to the server using the address from the “Preparation” section: in the game, type your computer’s address, for example 192.168.0.105. On a second Windows computer you can do without the game: open PowerShell and run Test-NetConnection 192.168.0.105 -Port 25565, replacing 192.168.0.105 with your computer’s address. If the TcpTestSucceeded line in the output shows True, the second door is open. For Bedrock, take a phone (or a Windows computer with Minecraft Bedrock) on the same Wi-Fi network: add the server with this address and port 19132. A game console can’t be used for this check: consoles can’t add a server by address. If the game answers “You are not white-listed on this server!”, this door is open too (see that error in the section “What connection errors mean”).

If the check fails, look for old blocking rules. Open wf.msc again (as in the first step of the list above), click “Inbound Rules” and look for rows named Java(TM) Platform SE binary or OpenJDK Platform binary with a red prohibition icon, a circle with a line (there are usually two, for TCP and UDP). Right-click each one, choose “Delete” and restart the server: if Windows asks again, click “Allow access”.

Don’t test from the computer itself using its own local address: that doesn’t check the path of an incoming connection over the network, so the result proves nothing. If the server lets you in via localhost but not from the second device, most often the Windows firewall or the antivirus is to blame (also look for the old blocking rules described above). Less often the cause is in the network: the second device is on the router’s guest Wi-Fi, or the router has “AP isolation” turned on (Wi-Fi devices can’t see each other), or the computer’s address is no longer the one you wrote down.

Door 3. The router: port forwarding

All devices in the house reach the internet through the router, which has one external address. When a friend connects to that address, the router doesn’t know which device to pass the connection to and drops it. Port forwarding is a rule: whatever arrives at port 25565, hand it to the computer running the server.

Step 1. Open the router’s settings

Type the address from the “Default Gateway” line (usually 192.168.0.1 or 192.168.1.1) into a browser and log in with the username and password. They are often printed on a sticker on the router’s case.

Step 2. Give the computer a permanent address

The router hands out addresses automatically (using the DHCP protocol) and after a restart it may give the computer a different one. Then the rule will point at nothing and the server will become unreachable. To prevent that, reserve the computer’s current address (the one you found in the “Preparation” section) in the router’s settings. Look in the DHCP section for “Address Reservation” or a binding by MAC address; to find the computer’s MAC address, run ipconfig /all and look at the “Physical Address” line. For example:

• TP-Link: Advanced → Network → DHCP Server → Address Reservation.
• ASUS: Advanced Settings → LAN → DHCP Server: set Enable Manual Assignment to Yes, add the computer to the Manually Assigned IP list and click Apply.
• Keenetic: click your computer in the device list (My Networks and Wi-Fi) and turn on the permanent (static) IP address option.

Step 3. Create the forwarding rule

Find the Port Forwarding or Virtual Server section. Here is where it is on popular routers:

• TP-Link: Advanced → NAT Forwarding → Virtual Servers (or Port Forwarding); in older firmware, Forwarding → Virtual Servers.
• ASUS: Advanced Settings → WAN → Virtual Server / Port Forwarding.
• Keenetic: Network Rules → Forwarding, the Add Rule button.
• Other routers: look for Port Forwarding, Virtual Server, NAT or Port Mapping. If you can’t find it, search the internet for instructions using “port forwarding” and your router’s model.

Create a new rule. The field names differ between routers, but in essence there are five:

• Name: anything, for example Minecraft.
• External Port (or Service Port; Port Range on ASUS; “Open the port” on Keenetic): 25565.
• Internal Port (or Local Port; “Redirect to port” on Keenetic): 25565.
• Internal IP (or Local IP, Device IP Address; on Keenetic pick your computer in the “Output” list): your computer’s address from the “Preparation” section, for example 192.168.0.105.
• Protocol: TCP. For Bedrock choose UDP. If the router doesn’t let you pick a single protocol, TCP/UDP (also called Both or All) will do.

If the form has a Source IP or Remote IP field, leave it empty: then the port is reachable from anywhere. Turn the rule on (Enable, Status; on ASUS turn on “Enable Port Forwarding”: the switch reads ON, or “Yes” in older firmware) and save the settings (Apply). Some routers need a restart after that.

What about UPnP

UPnP lets programs ask the router to open a port by themselves. An ordinary Minecraft server doesn’t open a port on the router on its own, and on some routers UPnP is turned off for security reasons. So don’t count on it: it is simpler to create the rule by hand once.

Two routers in a row

Sometimes there is another router in front of yours: for example, the provider’s equipment that your own router is plugged into. Then you have three options: set up forwarding on both devices, switch the device in front of your router to bridge mode, or connect the computer to that device directly. A sign of such a setup: your router’s external address (WAN IP) is private, for example 192.168.x.x. If it is an address from the range 100.64.0.0–100.127.255.255, the routers are not the issue: the provider uses CGNAT. How to check the external address is described below, in the section about the fourth door.

A different port and two servers

The external and internal ports in the rule don’t have to match. For example, external 25570 and internal 25565: friends type 203.0.113.5:25570, while the server keeps listening on 25565. If you have two servers, give the second one a different server-port (say, 25566) in its server.properties, create a second rule and allow that port in the firewall. Avoid ports below 1024: some providers block them.

How to check the third door

You can’t check this door from the inside: connections from your own network to the external address often don’t work. So it is checked together with the fourth door, in the section “Checking from outside”.

Door 4. The provider: you need a public IP

Port forwarding works only if your router itself has a public address. If it has a private one, there is another device in front of it that translates addresses, and your friends’ connections never reach your router. To check, open the router’s settings (how to log in is described in step 1 of door 3) and find the external address (the “Status”, “WAN” or “Internet” section), then open canyouseeme.org and read the “Your IP” line (with the VPN turned off): it shows your IPv4 address, that is, four numbers separated by dots. Don’t compare the router’s address with the result of a “my IP” search if that is a long address with colons: it is IPv6. If the addresses are the same, you have a public IP. We covered the details, the private address ranges and the check with tracert in the article about the public IP address.

If the addresses differ, there is another device in front of your router. First check whether it is in your home: if it is a modem or router (yours or installed by the provider), forwarding on both devices or bridge mode fixes it (see “Two routers in a row” above; for the provider’s device you may have to ask the provider to switch it to bridge mode). If there is no such device at home, or your router’s address is in the range 100.64.0.0–100.127.255.255, the provider is translating addresses in its own network (CGNAT), and port forwarding won’t help. There are three ways out: ask the provider for a public IP (usually a paid service), create a virtual network or a tunnel (programs like Radmin VPN, ZeroTier and playit.gg: with the first two every friend has to install the program and join your network, while with playit.gg only you run the program and your friends simply type the address it gives you; we described them in the article about the public IP address), or don’t keep the server at home. Paid and free hosting (methods 2 and 3 in the guide to making a server) work without a public IP and without router setup.

Even a public address can change: if the provider gives you a dynamic IP, friends will stop connecting after it changes, until you send them the new address. How to deal with this (a static address or DDNS) is described in the article about the public IP address.

Checking from outside

Doors 3 and 4 are checked together and only from outside, from another network. The server must be running: the checking sites try to connect to the port, and if nobody is listening behind it, they will report that the port is closed even when forwarding is correct.

1. 1Start the server and wait for a line like Done (12.873s)! For help, type "help".
2. 2Find out your external IPv4 address: open canyouseeme.org and read the “Your IP” line (with the VPN turned off). It must be four numbers separated by dots, for example 203.0.113.5. If a “my IP” search shows a long address with colons instead, that is IPv6: don’t send it to friends, because it doesn’t match the forwarding rule from this article.
3. 3Check the port online on the same canyouseeme.org site: type 25565 and run the check. A successful result means the port can be reached from the internet.
4. 4Check Minecraft itself: the mcsrvstat.us site queries the server the same way the game does and shows whether it is online, its version and the number of players. Type your external IP (add a colon and the port if it is not 25565) and, for Bedrock, select the “Bedrock server?” option. The result is cached for about 5 minutes, so after changing something wait a little before checking again. If it says “offline” while canyouseeme.org reports the port open, check that server.properties contains the line enable-status=true.
5. 5It is best to ask a friend to join using your external IP (add their nickname to the whitelist first: type /whitelist add PlayerName in the server console). If there is no friend at hand, connect a second laptop to your phone’s mobile hotspot and join from it: that is a different network, like your friend’s.

If the check fails, make sure the server is running, recheck the rule on the router (the computer’s address, the port and the protocol), and then make sure your router has a public IP (door 4). The next section explains connection errors.

Don’t test from your own computer using your own external IP. Many routers can’t send such requests back into the home network (this feature is called NAT loopback), and you will see an error even though everything works for your friends. Join the server yourself through localhost or the local address, and give your friends the external one.

What to send to friends: the external IPv4 address (four numbers separated by dots). If you used a different port, add it after a colon.

What connection errors mean

The error text tells you which door the connection stopped at. In your friend’s server list the text “Can’t connect to server” appears next to your server, and after clicking “Join Server” a window titled “Failed to connect to the server” opens. The Connection timed out and Connection refused lines come from Java itself, so they stay in English whatever language the game is set to. The game translates the other messages, so in a game set to another language you will see a translation of the English texts below.

Connection timed out

There is no reply at all: your friend’s connection vanished on the way. This is the most common case. The usual causes: the router has no forwarding rule or it points to the wrong address or port (door 3); the Windows firewall silently drops the connection (door 2); or you have a private IP (door 4). Also check that the computer with the server is on and not asleep, that your external IP has not changed, that your friend didn’t mistype the address, and that your friend’s own network (a school or office network, for example) doesn’t block the port.

Connection refused

The connection reached your network, but nobody is listening on this port. Most often the server isn’t running or listens on a different port than the one the forwarding rule points to (doors 1 and 3). Sometimes the router itself replies with a refusal if there is no forwarding: not all models behave this way.

Unknown host

This is not about ports: the server name wasn’t found. In the server list the same problem is shown as “Can’t resolve hostname”. Check that the address was typed without spaces or typos. If you use a domain name, make sure it exists.

Incompatible client!

Good news: the port is open and all four doors are passed. The game version doesn’t match the server version. The full message reads “Incompatible client! Please use …” with a version number, and in the server list the server is marked “Incompatible version!”. In the launcher, choose the version named in the message.

You are not white-listed on this server!

The port is open here too: the server has a whitelist turned on, and your friend is not on it. Since Minecraft 26.3 (15 September 2026) a new server starts with the whitelist turned on (white-list=true), so every friend has to be added. Type /whitelist add PlayerName in the server console, replacing PlayerName with your friend’s nickname (in the game, an operator can type the same command). If you don’t want a list at all, open server.properties, set white-list=false and restart the server, but then anyone who knows your address can join.

Failed to verify username!

And this one is not about ports either. The server asks Minecraft’s account service to confirm the player’s identity (the online-mode setting is responsible for this), and the confirmation failed. Most often the player uses a cracked launcher: it can’t join a server with online-mode=true, so this error is expected. Another possible cause is a broken login session on the player’s side: ask them to restart the game and the launcher and sign in to their licensed account. If everyone sees “Authentication servers are down. Please try again later. Sorry!” instead, then either Minecraft’s servers are down or the server computer itself can’t reach them: check the internet connection, firewall, antivirus and VPN on the server computer. Don’t turn off online-mode on a server that is open to the internet: anyone could then join under any name, including the administrator’s.

Security

An open port is a door into your home network, so spend a few minutes on security before you invite your friends. The full checklist is in the article How to Secure a Minecraft Server and Your Home Network: A Security Checklist, and here are just the most important points:

• Forward only the port you need. Don’t turn on “DMZ” on the router and don’t open all ports “just in case”. When you don’t need the server, turn the forwarding rule off.
• Keep online-mode=true and use the whitelist (white-list=true in server.properties): then only operators and the people you add with /whitelist add PlayerName can join.
• Don’t expose RCON (port 25575) or Query (port 25565, UDP) to the outside. They are off by default, so leave them that way. If your router offers only “TCP/UDP” for the Minecraft rule, it also forwards UDP 25565 (the Query port): that is harmless while enable-query=false.
• Keep the server and Java up to date: most serious vulnerabilities are fixed by updates. And don’t post your IP in open chats.
• Before you change the router’s settings, check with whoever pays for the internet and is in charge of your home network. Afterward, check that the router’s own settings page is not reachable from the internet (the option is called “Remote Management”, “Remote Access” or “Web Access from WAN” and should be off) and that the default admin password has been changed.

Frequently asked questions

Do I need to open a port to play on someone else’s server?

No. When you connect to someone else’s server, the connection is outgoing and you don’t need to configure the router. A port is needed only by whoever accepts connections.

Can I open a port without access to the router?

No, the rule is created on the router itself. If it belongs to your provider or neighbors and you can’t log in, ask the owner or the provider. If that is impossible, use a virtual network, a tunnel or hosting.

What should I change if I have Bedrock Edition?

Port 19132 and protocol UDP: choose them in both the firewall and the router. The messages in the server window, described in the section about door 1, apply to the Java server. Online port checkers usually work only with TCP, so for Bedrock check by joining in the game or on mcsrvstat.us (select the “Bedrock server?” option).

What next

When all four doors are open, send your friends the external IP and play. If the check runs into a private IP, or you are tired of fiddling with the router, look at hosting: there you don’t have to open any ports.