Minecraft Firewall & Port Checklist

See which TCP and UDP ports to open for Java, Bedrock, Geyser, or Velocity — plus sample firewall commands.

Your stack

Pick what you run so we list the ports that need to be open on your firewall or hosting panel.

Optional — one per line. Examples: 8123/tcp Dynmap or 25575/tcp RCON (local only)

Required ports

Keep RCON private. Never expose port 25575 (or your RCON port) to the public internet. Restrict it to this machine or a trusted admin connection only.

UFW commands


                
            

        


        

            
firewalld rich rules

            

                

                
            

        


        

            
iptables examples

            

                

                
            

        

    






    

        
Minecraft Firewall & Port Checklist guide

                
See which Minecraft ports to open for Java, Bedrock, Geyser, Velocity, or BungeeCord — plus sample UFW, firewalld, and iptables commands, with clear warnings about what not to expose.

            


    

                

            
TCP, UDP, and what not to expose

                        
Java edition commonly uses TCP 25565. Bedrock uses UDP 19132. Geyser, query, and RCON add more sockets that are easy to misconfigure. This checklist builds a table for your stack and generates firewall allow rules you can paste on a VPS.

                        
RCON and private backend ports should stay off the public internet. The tool calls those out so you do not open management ports by mistake.

                    

                

            
Presets for real server setups

                        
Choose Java only, Bedrock, both, Velocity, BungeeCord, Geyser on the Java host, or Geyser on a proxy. Add custom ports when your host assigned non-defaults. Regenerate anytime you change topology.

                        
Copy UFW, firewalld, or iptables snippets to match the firewall you actually run. Pair with the DNS generator when players should connect by hostname instead of raw IP.

                    

                

            
Verify after opening ports

                        
Restart the firewall, confirm the process is listening with your host’s tools, then join from an outside network. Mobile data is a good test that you are not only seeing LAN access.

                        
If Bedrock fails but Java works, double-check UDP rules — many panels open TCP only by default.

                    

            


        

        
Common questions

        

                        

                
Which port is Bedrock?

                
Bedrock commonly uses UDP 19132. Geyser on a Java host often listens on that port while Java remains on 25565.

            

                        

                
Should I open RCON to the world?

                
No. Keep RCON on localhost or a private network. The checklist excludes it from public allow rules on purpose.

            

                        

                
Do I need both TCP and UDP for Geyser?

                
Java traffic is TCP; Bedrock through Geyser needs the UDP Bedrock port open. Your generated table lists both when that stack is selected.