Server IP and port 25565: letting players connect

The port is set by server-port in server.properties and defaults to 25565, TCP. On the default port players just type the IP or domain; on any other port they add it after a colon: play.example.com:25570. Which address to hand out depends on where the player connects from.

Which address to give players#

On Windows ipconfig shows the internal IP (the “IPv4 Address” line); on Linux it's ip addr (the inet line of your network interface). Your public IP is in the router's settings or on any “what is my IP” site. If you're still deciding where to run the server, compare the options in game hosting or a VPS.

Port forwarding on a home router#

The router is the only device with a public IP; the computers behind it are visible only inside your network. A port forward tells the router: whatever arrives from outside on port 25565, send it to this computer. Router menus differ, but the steps are the same:

1. 1

   Pin the server's internal IP

   The router hands out addresses over DHCP and may give the computer a different one later — then the forward stops working. Reserve the address in the router (DHCP reservation) or set a static IP on the computer.

2. 2

   Open the router's settings

   The router's address is the “Default Gateway” in ipconfig output, often 192.168.0.1 or 192.168.1.1. The login is usually printed on a sticker underneath.

3. 3

   Find port forwarding

   It goes by different names: Port Forwarding, Virtual Server, NAT, Applications.

4. 4

   Create the rule

   Internal IP: the server's address. External and internal port: 25565. Protocol: TCP. Name it anything, e.g. minecraft.

5. 5

   Open the port in the computer's firewall

   On Windows, the first server start brings up a firewall prompt for “OpenJDK Platform binary” — allow it. On Linux, add a ufw rule (below).

6. 6

   Test from outside

   With the server running, test the port from another network — how is described below.

Firewall on Linux: ufw#

On an Ubuntu or Debian VPS the firewall is usually ufw. Open the game port — and allow SSH before enabling the firewall, or you'll lock yourself out:

sudo ufw allow 22/tcp        # SSH (or your SSH port)
sudo ufw allow 25565/tcp     # Minecraft
sudo ufw enable
sudo ufw status verbose

The game only needs TCP. UDP on the same number is used only by the query protocol if you turned it on (enable-query) — and you shouldn't without a reason. Cloud providers often have their own firewall in the control panel (security groups): the port must be open there as well.

How to check the port is open#

• The server is listening. On the machine itself: ss -tlnp | grep 25565 — you should see a java process. Nothing there means the server isn't running or listens on another port.
• The port is reachable from outside. From another network (a phone hotspot works): nc -vz <public-IP> 25565 on Linux and macOS, or Test-NetConnection <public-IP> -Port 25565 in PowerShell on Windows.
• It answers as a Minecraft server. Add the address to the game's server list or check it with an online Minecraft server status tool.

Don't trust a test of your own public IP from inside your own network: many routers can't loop such a connection back (NAT loopback), so the test fails even when everything works from outside.

A domain without a port: the SRV record#

A domain is easier to remember than an IP, and moving to another machine is just a DNS change. Start with an A record pointing to the server's IP. On the default port that's all: players type play.example.com.

On a custom port, add an SRV record — since Java Edition 1.3.1 the client reads the port from it. The game looks the record up strictly as _minecraft._tcp.<your domain>, and the value holds priority, weight, port and target — a hostname with an A record, not an IP:

play.example.com.                  A    203.0.113.10
_minecraft._tcp.play.example.com.  SRV  0 5 25570 play.example.com.

Check it with dig _minecraft._tcp.play.example.com srv (Linux, macOS) or nslookup -q=srv _minecraft._tcp.play.example.com (Windows). DNS changes take time to spread — sometimes up to a day. If your domain is on Cloudflare, the server's record must be “DNS only” (grey cloud): Cloudflare's proxy only carries HTTP and HTTPS.

Which ports to keep closed#

Scanners constantly sweep the internet for Minecraft servers on 25565 and for open service ports. Only the game port should face the outside:

On a network of a proxy and several Paper servers, only the Velocity port is public (it defaults to 25565 too), and the game servers listen on 127.0.0.1 or accept only the proxy's IP: sudo ufw allow proto tcp from <proxy IP> to any port 25566. Velocity's documentation states plainly that modern forwarding is not a replacement for a firewall. How to build such a network: Velocity setup.

Your anticheat doesn't need any ports opened. DGuard goes on each game server with its own key and reaches the DGuard site itself over HTTPS — for the license, updates and the cloud check of aim and TriggerBot. So the only firewall requirement is not blocking outbound HTTPS. Install steps are in the guide.

A non-default port and enable-status=false attract fewer scanners, but they won't stop a targeted attack. Bots and DDoS have their own article: bots and DDoS.

FAQ#