Players Can’t Connect to My Minecraft Server

Direct answer

Test the connection from the inside out. First make sure the server reaches Done in its console and that the server machine can join with localhost or 127.0.0.1. Then test the server’s LAN address from another device on the same network. Only after those work should you troubleshoot firewall rules, port forwarding, CGNAT, DNS, or a public address.

1. Confirm the server is actually listening

A server that crashed during startup, is still loading, or is listening on a different port cannot accept players. Check logs/latest.log and confirm the configured server-port. Leave server-ip blank unless you deliberately need to bind to one local interface.

server-ip=
server-port=25565

2. Use the right address for each test

Same computer as the server: localhost or 127.0.0.1.
Another device on the same home network: the server machine’s private/LAN IP, such as 192.168.x.x.
A friend on another network: your public address or domain, plus the port if it is not the default.

Do not treat a failed public-IP test from inside your own LAN as definitive. Some routers do not support NAT loopback even though outside players can connect.

3. If LAN works but outside players cannot join

Forward the Minecraft TCP port to the server machine’s current LAN IP.
Allow the server/Java process or the selected TCP port through the host firewall.
Confirm your router is not behind another router, carrier-grade NAT (CGNAT), or an ISP service that blocks inbound connections.
Test from a genuinely external network, such as a phone hotspot, rather than only from the same Wi-Fi.

4. Match the error to the next check

Connection refused: the address was reached but nothing accepted the connection on that port, or a device actively rejected it.
Connection timed out: the connection attempt received no usable response before the timeout; firewalls, forwarding, routing, or CGNAT are common places to check.
Unknown host: troubleshoot the hostname/DNS first.
Failed to verify username / invalid session: the network path worked far enough to reach login; troubleshoot authentication instead.

Avoid these common “fixes”

Do not disable security just to make the symptom disappear.

Do not permanently disable your firewall, set online-mode=false on a normal internet-facing server, or put your public IP into server-ip. Those changes either reduce security or solve the wrong layer of the problem.

Run the checks in network order

First confirm the Java process is listening and a local client can join. Then test the server’s LAN address from a second device.
For public access, test from another network and compare DNS address, router forwarding, firewall and public/CGNAT WAN status. A DNS record alone cannot expose a port blocked upstream.
For Velocity networks, test the proxy entry point and private backend separately; never “fix” routing by exposing an offline-mode backend publicly.

Official references

These references were checked while preparing this fix. Version-specific behavior can change, so use the project documentation for your exact release when a detail differs.

Was this article helpful?

Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.