For others to join your server at home, your router has to forward connections on port 25565 (TCP) to the PC running the server. That's called port forwarding.
Forward only this one port, never the whole PC, and don't share your home IP with anyone. The safest way for friends to join is through protection in front.
Contents
What port forwarding does
Your router doesn't let anything in from outside that you didn't ask for. That protects you. A Minecraft server, however, has to accept connections. With port forwarding you tell the router: “Send everything that arrives on port 25565 to this one PC.”
Many cable, fibre and mobile connections share one public IPv4 address between many customers (“CGNAT” or “DS-Lite”). Then IPv4 port forwarding doesn't work, whatever you set. If the WAN/internet IP in your router doesn't match what “what is my IP” sites show, that's likely the case. More: Hosting at home.
Port forwarding on your router
Every router looks a bit different, but the steps are always similar. The feature is usually called Port forwarding, Virtual server or NAT.
- Open the router interface
In your browser, open your router's address (often
192.168.0.1or192.168.1.1, it's printed on the router) and log in. - Give the PC a fixed address
Under DHCP or LAN settings, reserve a fixed local IP for the PC running the server (often called DHCP reservation). Otherwise the forwarding might point at the wrong device after a restart.
- Create the forwarding rule
In the port forwarding section, add a rule: device / internal IP = your server PC, protocol TCP, external and internal port
25565. - Save
Save and apply. For Bedrock via Geyser, add a second rule for UDP port
19132.
Many routers offer a dynamic DNS name that always points to your current home IP. You can enter that name as the target at BlackProtect, so it keeps working when your IP changes.
Don't forget the Windows firewall
The first time the server starts, Windows asks whether Java may accept connections. Allow access for private and public networks. If you clicked it away, find the rule under Windows Security → Firewall & network protection → Allow an app through firewall.
Testing
Testing from your own Wi-Fi often isn't reliable. Ask a friend to join, or connect from your phone over mobile data (hotspot) to your PC.
- Not working? Is the server really running and listening on
25565? Is the local IP in the rule correct? Did the Windows firewall allow Java? - Still not working? You probably have CGNAT (see above).
Staying safe
- Forward only this one port. Never put the PC in a “DMZ” or “exposed host” mode – then it's completely open.
- Don't share your home IP. Anyone who knows it can take your whole household offline.
- Let friends join via a domain with protection, so they never see your IP: Protect your home IP.
- Whitelist on (
/whitelist on) if only friends play. Scanners find open servers quickly otherwise: Unknown IPs in your logs.
Frequently asked questions
Is port forwarding dangerous?
For exactly one port with your Minecraft server behind it, the risk is manageable. It gets dangerous when you expose the whole PC or your home IP is public.
Do I still need port forwarding with BlackProtect?
Yes. Our filter has to be able to reach your server. The difference: your players connect to us, and only we know your home IP.
Which port does Bedrock need?
Geyser and Bedrock servers use UDP port 19132 by default. That needs its own rule with protocol UDP.