The server's running, you can join it yourself, but nobody outside your house can. Work down this page in order, the first few take a minute each to rule out. If it turns out you're on CGNAT, nothing on your router will ever fix it. The section on that shows how to tell and what does work.
Updated October 2026
In MC Server Manager, open the server's Overview tab and press Check if players can join. It asks your router what it's forwarding and compares the address your router thinks it has with the one the rest of the internet sees. In a second or two it gives one of these:
| The check says | What it means |
|---|---|
| Players can reach you | The router is forwarding the port to this PC. If friends still can't join, check the address and the firewall |
| Nothing is forwarding port 25565 yet | Your connection can take players, the router isn't passing the port through. See UPnP or forwarding by hand |
| Can't tell from here | The router didn't answer, usually because UPnP is off on it. See forwarding by hand |
| Your internet provider is blocking this | Your router is behind another one, so forwarding can't reach you. See CGNAT and double NAT |
The check works on the server's own port, so it says 19132 on a Bedrock server or your number if you changed it. If you're running a server by hand without the app, the sections below are the same checks done yourself.
A timeout or a message? If your friend sees the connection time out or get refused, they aren't reaching the server at all and the causes on this page are the ones to look at. If they get a message from the server, like You are not white-listed on this server! or a version mismatch, the connection is fine. That's the server's settings, the whitelist or the Minecraft version.
The quickest thing to get wrong and the quickest to fix. The Overview tab's How people join card has the right address for each kind of player.
192.168.1.100) is for people on your network. Friends anywhere else need the Over the internet one, your public IP or your relay address.203.0.113.42:25566. Bedrock has a separate port box, 19132 unless you changed it.Windows blocks a server the first time it listens for players and asks you whether to allow it. If that box was closed, or only Private networks was ticked while Windows has your home network down as Public, nobody gets in, sometimes not even people on your wifi.
In the app, Settings, then the Network tab, press Open the Minecraft ports. After one admin prompt it adds two rules named MC Server Manager, Java on TCP 25565 to 25599 and Bedrock on UDP 19132 to 19159, which cover every server you make. By hand, open Windows Security > Firewall & network protection > Allow an app through firewall and make sure Java (or bedrock_server.exe) is ticked for Private and Public. Antivirus suites with their own firewall need the same allowance in their settings.
Your router throws away connections it wasn't expecting. To let friends in it needs a rule sending the Minecraft port, TCP 25565 for Java or UDP 19132 for Bedrock, to your PC's local address. The port forwarding guide has the menus for Sky, BT, Virgin Media, Netgear, TP-Link, ASUS, Linksys and Xfinity routers.
The rule points at one local address. If your PC gets a new one after a restart, the rule points at nothing, so reserve the address in the router (DHCP reservation) while you're in there.
UPnP lets a program on your PC ask the router to open a port. On the server's Network tab, Automatic port forwarding uses it to open the port when the server starts and close it when it stops. The card says whether it worked. If it says it couldn't forward the port, UPnP is off or missing on the router. Turn it on in the router's settings (it's often under Advanced or NAT) and start the server again, or forward the port by hand as above.
If UPnP says it worked and friends still can't get in, keep going. A router can accept the rule happily and still be behind another router that never sees it, which is the next section.
Port forwarding only works when your router is the thing on the public internet. With CGNAT (carrier-grade NAT) your provider puts you behind a router of their own, shared with other customers. You can't forward anything on it. It's normal on mobile broadband, 4G and 5G home internet, Starlink and some fibre providers. Double NAT is the same picture inside your house, two routers in a row, often the provider's box with your own router or mesh plugged into it.
192.168.1.1 or 192.168.0.1, the address and password are often on a sticker) and find the status page. Look for the WAN IP, Internet IP or public IP| Router's WAN address | What it means |
|---|---|
| The same as your public IP | No CGNAT. Port forwarding can work, go back to sections 2 to 4 |
100.64.0.0 to 100.127.255.255 | CGNAT. That range (100.64.0.0/10) is set aside for providers sharing addresses between customers |
192.168.x.x, 10.x.x.x or 172.16.x.x to 172.31.x.x | Double NAT. There's another router in front of this one, usually in your house |
| Any other address that doesn't match your public IP | CGNAT, the provider is translating between the two |
The app's check does this same comparison through UPnP. From inside your network it can't tell your provider's router from a second one of your own, so when it says your provider is blocking this, a quick look at the WAN address tells you which it is.
Put the provider's box in modem mode (some call it bridge mode) so your own router faces the internet, or turn your router into an access point so the provider's box does the routing. Either way there's one router left and port forwarding works again. If neither is possible, forward the port on both, the outer router to the inner one and the inner one to your PC.
You've got two routes that don't cost anything to try:
Hosting from a phone's hotspot or a 4G or 5G router is CGNAT nearly every time, there's no port to forward. Some hotspots hand the CGNAT address straight to the PC, the app's check spots that too. Friends can still join through the relay. Keep an eye on data if your plan has a cap, every player's game traffic goes up your connection.
A few providers block some incoming connections even on a public address, often on business or student lines and shared accommodation networks. If the WAN address matches your public IP, the firewall's open, the port's forwarded and friends still time out, ask your provider whether they filter incoming traffic. The relay gets round this as well, since the connection starts from your PC.
The free relay is for you and three friends, 4 players at once and 10GB of data a month, in Europe or the United States. Its address is one we pick, a word from the game and a number on play.mcservermanager.com. It works for Java and Bedrock, it keeps your home IP hidden from players and it's one per account.
If you need more players or a name you choose, Relay Starter is £1.50 a month and Plus is £24 a year or £2.49 a month with no player limit and your own domain. You don't need either to find out whether the relay works for you. The details are on the relay page.
Ask in our Discord or on the support page. Say what the check said, what your router's WAN address starts with (the first two numbers are enough, never post the whole thing) and what your friend sees when they try.
Other guides