Port 25565Minecraft Java Edition server

What port 25565 is used for

A Minecraft Java Edition server listens on TCP 25565 by default. Players on the same LAN connect directly to the host's private address; players elsewhere need the host's public address and a router rule that forwards 25565 to the server machine.

Port forwarding in brief

1. Give the server machine a fixed LAN address (DHCP reservation or static IP).
2. In the router, forward external TCP 25565 to that address, port 25565.
3. Allow Java through Windows Defender Firewall on the Private profile.
4. Share your public address (the router's WAN address, or a dynamic-DNS name).

If the router's WAN address is in a private range such as 100.64.x.x or 10.x.x.x, the ISP is using carrier-grade NAT and forwarding will not work; ask the ISP for a public address or use a tunnel service.

Security considerations

• Whitelist and online mode. white-list=true limits who can join; online-mode=true verifies accounts with Mojang and blocks impersonation.
• Keep the server and plugins updated. The Log4Shell vulnerability in 2021 affected Minecraft servers directly.
• Isolate the host. A server machine exposed on 25565 should not be the family PC with personal files, or should at least run the server under a separate limited account.
• Consider not forwarding at all. Hosted servers, or a mesh VPN such as Tailscale or ZeroTier, let friends connect without opening a port.

How to check port 25565

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :25565

A line in the LISTENING state means a local program has bound port 25565; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :25565 or lsof -i :25565.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection your-public-address -Port 25565

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 25565. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Firewall considerations

Allow inbound TCP 25565 to the server machine only, on the Private profile. On the router, forward only 25565 and remove the rule when the server is not in use.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 25565 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.