Host a Minecraft Server From Home Without Port Forwarding
You set up the server, forwarded the port, and your friends still cannot join. Usually the router is not the problem: your internet provider puts you behind CGNAT, and there is no port to forward. Here are two ways that work, what each one costs, and how to pick.
Why port forwarding fails
Port forwarding tells your router: whatever arrives on port 25565 goes to this computer. That only works if your router holds a public address. Under CGNAT it does not. Your provider shares one public address among many customers, and the equipment doing that sharing sits in their network, not in your house. A friend's connection reaches that equipment, and it has no way to know which customer the connection is for.
To check: find the WAN or internet address on your router's status page, then open ifconfig.me in a browser on the same network. If the router's address starts with anything from 100.64 to 100.127, you are behind CGNAT. If the two addresses are different and you do not have a second router of your own in front of the first, you almost certainly are too. The CGNAT guide has the details.
Java and Bedrock use different ports
Minecraft Java Edition uses TCP port 25565. Bedrock Edition, the version on phones and Windows, uses UDP port 19132. If you run both, you need both. Opening TCP when the game speaks UDP is the most common reason a correct setup looks dead.
Option 1: playit.gg
playit.gg is a tunnel service built for game servers. You run their program next to your server, and they give you an address and a port that forward to it. It has a free plan for small servers. If you just want a few friends to join, try it first: it is made for exactly this.
What it does not give you is an address of your own. The address and port belong to the service. For their paid options and current limits, check their site: we do not quote other companies' prices.
Option 2: your own public IPv4 with TunnelNet IP
TunnelNet IP gives the computer that runs your server a public IPv4 address of its own, from our own address block (23.187.152.0/24, network AS396500). Your computer opens a connection out to our network, which CGNAT allows, and your address is routed back to you through that connection. Your router needs no changes and there is no port to forward.
Your friends type your address. On Java with the normal port, they do not need to type a port at all. Your TunnelNet address stays the same even when your provider changes the one it gives you.
- Buy TunnelNet IP ($10 a month) and install it on the computer that runs the server. Setup is in the docs, which are in English.
- Open the game's port. Everything except SSH is closed until you open it. The command depends on the computer:
# Linux $ sudo tnet ports allow tcp 25565 # Mac (the port goes first) $ sudo tnet ports allow 25565 tcp # Windows, in PowerShell opened as Administrator > tnet ports allow 25565 # Bedrock: the same, with udp 19132
Then test from outside your house: a phone on mobile data, not on your home Wi-Fi. A test from inside the house can work without the traffic ever leaving it, which tells you nothing.
Side by side
| playit.gg | TunnelNet IP | |
|---|---|---|
| Cost | Free plan for small servers; paid options on their site | $10 a month |
| Address | The service's | Your own, fixed |
| Port | Part of the address the service gives you | The one you choose |
| What you run | Their program, next to your server | Our program, on Linux, Windows or a Mac with Apple Silicon |
| Protection from flood attacks (DDoS) | See their site | Not included |
Before you pick TunnelNet
- No protection from flood attacks (DDoS). Public game servers attract them. If that is your biggest worry, playit.gg or a paid Minecraft host is the better choice.
- Your upload speed sets the player count. As a rough guide, a Minecraft server wants around 100 to 200 kbit/s of upload per player. That is an order of magnitude, not a promise.
- Traffic goes through our hubs in Chicago and Newark, in the US. If you and your players are far from there, that distance adds to your ping.
- The address is yours and tied to your account. What runs on it is your responsibility; see the acceptable use policy.
- It runs on a computer: Linux, Windows, or a Mac with Apple Silicon. A phone cannot host the server.
- A public address gets scanned within minutes. Keep the server updated and open only the ports it needs.
Which one?
Want a few friends on your server this weekend: playit.gg. Want a fixed address of your own, that you control, for this server and anything else you run: TunnelNet IP, $10 a month. Plans and prices.