Unable to join server outside of machine hosting

[u/ATurtleNearYou]

Hello!
I recently wanted to self host a Minecraft server again for my friends but unlike the last times I've done it I can't seem to connect to it outside of the machine actively hosting it. Even on a laptop on the same network I can't seem to connect to it.

So far I have

-Port forwarded 25565 on both TCP and UDP

-Added Windows Firewall rules to allow connections to and from port 25565

-Tried hosting a regular LAN world (still couldn't connect on the same network)

-Restarting both my computer and router

I have self hosted in the past with barely any problems and can't seem to find what the issue could even be this time

Edit: we are so barrack, all I did was configure the windows firewall settings for Java instances

[u/Matita008]

Can you ping the server from a different machine?

[u/ATurtleNearYou → u/Matita008]

I believe pings go through, yes

[u/Matita008 → u/ATurtleNearYou]

is the bind address (server-ip) empty or set to 0.0.0.0?

[u/Cabecinha84]

The detail that matters is buried in your list. It fails from a laptop on the same network, and an Open to LAN world fails too. Neither of those ever touches the router, so port forwarding and CGNAT are not your problem, which also fits your WAN address matching. Everything is going wrong on the Windows box.

The LAN test is also less informative than it looks. An Open to LAN world picks a random port every time it is opened, so your 25565 rule does not apply to it at all. Its failing alongside everything else points at inbound being blocked for the Java process as a whole rather than for one port.

Four things to check, roughly in the order they turn out to be the cause.

Network profile. If the adapter is set to Public, inbound is blocked by default and any rule you created under the Private profile simply does not apply. Set the adapter to Private, then reopen your rule and confirm all three profile boxes are ticked.

Existing block rules for Java. Open Windows Defender Firewall with Advanced Security, go to Inbound Rules, sort by name and look for java.exe and javaw.exe. Windows writes a block rule when somebody dismisses the popup, a block always wins over an allow, and people then add a port rule that never gets a chance to fire. Delete every Java entry you find and re-add an allow for the exact java.exe your server launches with.

server-ip in server.properties. If it has any value at all, the server binds only to that address. Leave it empty.

Client isolation on the router, or the machines being on a guest SSID, which stops LAN devices reaching each other. Retest with the laptop on ethernet to rule it in or out.

One diagnostic to run instead of ping: from the laptop, Test-NetConnection 192.168.x.x -Port 25565 in PowerShell. Ping only proves ICMP is allowed and says nothing about TCP 25565, so a ping that works alongside a connection that does not is precisely what a firewall block looks like. Also scroll your server console back and confirm it printed that it started on *:25565 with no bind failure above it.

[u/ATurtleNearYou → u/Cabecinha84]

this^{^}

[u/PM_ME_YOUR_REPO]

Sounds like CGNAT. Home ISPs frequently use CGNAT to increase the availability of IPv4 addresses. You can verify by comparing the "WAN address" shown in the router admin panel with the one shown on https://4.icanhazip.com to see if they match. If not, you're behind CGNAT, and will never be able to port forward.

If you are, you'll need to either request/purchase a non-CGNAT public IP from your ISP, or use something else to tunnel out.

The simple and free option is playit.gg, but performance/latency has been reported to be middling in some cases. Alternatively, you can use a service like Tailscale. The easy option is to have all users install the Tailscale client and use the code from the Tailscale instance running on the server to join the same VPN.

If your users don't want to do this, then you can rent a very low power VPS for cheap or free, install either Tailscale or FRP on it, and then use that VPS as a public node to tunnel connections into your network.

Finally, you can always use your IPv6 address to connect, as that one will be publicly available even if you are behind CGNAT.

[u/ATurtleNearYou → u/PM_ME_YOUR_REPO]

I checked, the addresses match

I also checked with tech support and apparently IPv6 isnt currently supported