Minecraft Port Forwarding Not Working? How to Check for CGNAT and Fix It
Why port forwarding for a Minecraft server fails even when the router settings look right: how CGNAT and double NAT block incoming connections, how to check for them, other common causes, and your options, from asking your ISP to IPv6, tunnels or hosting elsewhere.
In this guide
How port forwarding is supposed to work
Your home has one public IP address, shared by every device through your router. When a friend connects to that public IP on port 25565, the router has to know which device inside your home should receive the connection. A port forward is that rule: "send TCP 25565 to my PC at 192.168.1.50".
That only works if the public IP actually belongs to your router. With CGNAT, it doesn't, and no setting on your router can fix that.
What CGNAT is
There aren't enough IPv4 addresses for every home. Many internet providers solve this with carrier-grade NAT (CGNAT): they put many customers behind one shared public IP, and give each customer's router a private address on the provider's network.
Outgoing connections work normally, which is why browsing and gaming feel fine. Incoming connections don't, because the provider's equipment has no idea which of its customers should receive a connection to port 25565 on the shared IP. Your port forward exists on your router, but traffic never reaches your router in the first place.
CGNAT is common on mobile and 4G/5G home internet, satellite internet, and some fibre and cable providers, especially newer ones.
How to check if you're behind CGNAT
1. Find your router's WAN (internet) IP address. It's on the router's status page, often labelled WAN IP, Internet IP or Public IP. 2. Find your public IP by searching "what is my IP" in a browser on the same network. 3. Compare them.
• Same address: no CGNAT. Your router has the public IP, and port forwarding can work. Look at the other causes below.
• The WAN address starts with 100.64 up to 100.127 (the range 100.64.0.0/10): this is the range reserved for CGNAT. You're behind CGNAT.
• The WAN address is private (10.x.x.x, 172.16.x.x to 172.31.x.x, or 192.168.x.x): either CGNAT using private addresses, or double NAT inside your home.
• Different public addresses: you're behind some form of provider NAT.
- A traceroute to any website (
tracert 1.1.1.1on Windows,traceroute 1.1.1.1on macOS and Linux) that shows a 100.64.x.x hop right after your router also points to CGNAT.
Double NAT: two routers in a row
Double NAT happens when your provider's modem is also a router, and you've plugged your own router into it. Your PC sits behind two NATs, so a port forward on your own router isn't enough.
Fixes: put the provider's device in bridge or modem-only mode, or forward the port on both devices (the provider's router forwards to your router, and your router forwards to your PC). Unlike CGNAT, double NAT is something you can fix yourself.
Other reasons port forwarding fails
Before blaming CGNAT, rule out the common mistakes:
• The server isn't running. Port checkers only show a port as open while something is listening on it.
• The forward points to the wrong device. Your PC's local IP can change; give it a reserved (static) address in the router's DHCP settings.
• Wrong protocol. Java Edition needs TCP 25565. Bedrock and GeyserMC need UDP 19132.
• A firewall blocks it. On Windows, allow Java (and the server) through Windows Defender Firewall for private and public networks, or add an inbound rule for the port.
• You're testing from inside your own network. Many routers don't support connecting to your own public IP from inside (NAT loopback). Test from mobile data, or have a friend try.
• server-ip in server.properties is set to an address. Leave it empty so the server listens on all addresses.
• The provider blocks the port. Rare for 25565, but some block common ports. Try another port, such as 25570, on both the forward and server-port.
Option 1: ask your provider
Contact your internet provider and ask for a public IPv4 address, or to be taken off CGNAT. Some providers do it for free on request, some charge for a static IP, and some can't do it at all (common on mobile and satellite connections). It's worth asking, because it fixes the problem for every game and service, not only Minecraft.
Option 2: IPv6
Many CGNAT connections also have IPv6, and IPv6 addresses are not shared, so incoming connections can work. Java Edition can connect to IPv6 addresses written in brackets, such as [2001:db8::1]:25565.
The catch: every friend also needs working IPv6 on their own connection, and you need to allow incoming traffic to your PC's IPv6 address in the router's IPv6 firewall. It's a good option when it works, but you can't rely on it for a whole group.
Option 3: a tunnel or VPN
A tunnel gives your server a public address elsewhere and forwards traffic to your PC over an outgoing connection, which CGNAT allows.
• Game tunnel services such as playit.gg are made for this and support Minecraft Java and Bedrock. • Your own VPS running a tunnel (for example WireGuard or frp) gives you full control, but you pay for and maintain the VPS. • Mesh VPNs such as Tailscale or ZeroTier connect your friends' PCs directly to yours. Every player has to install the VPN app, and Bedrock on consoles can't use them.
Tunnels add a hop, so ping depends on where the tunnel's servers are compared to you and your friends. Your PC also still has to be on whenever anyone wants to play.
Option 4: host the server somewhere else
If your PC would have to stay on all day and you're fighting your connection, running the server on a host is usually simpler. The server gets a public address that friends can join from anywhere, and your home network isn't involved at all.
Enzonic's free tier gives 3.5 GB RAM, 200% CPU and 5 GB storage, with no credit card. It sleeps after 15 minutes with nobody online and starts when a player connects (they wait about 20 seconds in a lobby, then join). Every address is behind Cloudflare Spectrum DDoS protection, so you never share your home IP. You can upload your existing world with the web file manager or SFTP. If you need it always on, paid plans start at $3.79/mo for 4 GB.
Check whether CGNAT is blocking your Minecraft server: step by step
- Find your router's WAN IP Open your router's status page and note the WAN or Internet IP address.
- Find your public IP Search "what is my IP" in a browser on the same network and note the address.
- Compare the two addresses If they differ, or the WAN IP is in 100.64.0.0/10 or a private range, you're behind CGNAT or double NAT.
- Rule out other causes Make sure the server is running, the forward points to the right local IP with the right protocol (TCP 25565 for Java), the firewall allows Java, and you test from outside your network.
- Pick a fix Ask your provider for a public IPv4, try IPv6, use a tunnel, or host the server with a provider instead.
Frequently asked questions
Why is port 25565 closed even though I forwarded it?
Common reasons are CGNAT, double NAT, a firewall blocking Java, a forward to the wrong local IP, or the server not running when you test.
How do I know if I have CGNAT?
Compare your router's WAN IP with the IP shown by a "what is my IP" search. If they differ, or the WAN IP starts with 100.64 to 100.127, you're behind CGNAT.
Can I host a Minecraft server with CGNAT?
Not with port forwarding alone. Use IPv6 if everyone has it, a tunnel service, a VPN, or a server host.
Does a VPN fix CGNAT for Minecraft?
A normal VPN for browsing doesn't. A mesh VPN like Tailscale works if every player installs it, and some VPN services offer port forwarding as a feature.
Is playit.gg safe to use?
It's a widely used tunnel service made for game servers. As with any tunnel, your server is reachable by anyone with the address, so use a whitelist.
Which port does Bedrock need?
Bedrock uses UDP port 19132 by default. Java uses TCP port 25565.