Direct answer

Which timeout is this?

This is the initial connection attempt timing out before login completes. If you already joined/login began and the client later says “Timed Out,” use the disconnect or login-timeout guides.

A connection timeout means the client did not complete the connection before its timeout. Unlike a clean “connection refused,” this often points to traffic being dropped or never reaching the correct service. Test locally first, then LAN, then externally so you know which network boundary is failing.

Run three tests

  1. Join from the server machine with localhost.
  2. Join from another device on the same LAN with the server’s private IP.
  3. Join from a different internet connection with the public IP/domain.

If step 1 fails, this is not a port-forwarding problem. If steps 1 and 2 work but step 3 fails, focus on router/firewall/ISP configuration.

Common external causes

  • Port forwarding points to the wrong LAN IP after the server machine received a new DHCP address.
  • The host firewall or cloud/VPS firewall drops inbound TCP traffic.
  • There are two routers/NAT layers and only one is forwarded.
  • The connection is behind CGNAT, so your router does not own a directly reachable public IPv4 address.
  • The domain resolves to an old address or an IPv6 record that does not reach the server.

If only one player times out

Targeted diagnosis: Timeouts differ from an immediate refusal: check routing, host firewall, NAT/CGNAT, server availability and whether the client uses the right public address. Test from outside the local network, not only from the same router.

Compare that player on another network and another device. If everyone else joins normally, changing server RAM or port forwarding is unlikely to fix a single-client routing problem. Check the server log to see whether the failed attempt appears at all.

Fix and verify: For Java Edition, inspect TCP listener and forwarding rules; for Bedrock/Geyser, inspect UDP separately. Compare one reachable friend on a different ISP to determine whether the failure is network-specific.

Do not disable the watchdog or authentication

Timeouts happen before or during networking; disabling the server watchdog or switching to offline mode does not repair a broken route. Make one networking change at a time and retest from the same external network.

Official references

These references were checked while preparing this fix. Version-specific behavior can change, so use the project documentation for your exact release when a detail differs.

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000