How to Open a Minecraft Server Port With UFW

Direct answer

On a Linux host using UFW, open only the port and protocol your public Minecraft listener needs: Java gameplay normally uses TCP; Geyser/Bedrock listeners normally use UDP.

Step-by-step procedure

If you administer over SSH, first ensure your SSH port is allowed; keep your provider’s recovery console available before enabling firewall rules.
For a default public Java listener use sudo ufw allow 25565/tcp; replace the number if server-port differs.
For an intentionally public Geyser listener, allow its configured UDP port separately instead of opening an entire range.
Inspect with sudo ufw status numbered and test from outside; keep Velocity backend ports restricted to proxy hosts.

Common mistakes and trade-offs

Opening UFW does not create router port forwarding, remove CGNAT or start the Minecraft process. Do not disable the whole firewall as a shortcut.

How to verify it worked

From an external connection confirm the correct listener is reachable; verify backend or SQL ports are still inaccessible from the public internet.

Version and platform differences

Cloud firewalls/security groups may need corresponding rules; never run ufw enable remotely before ensuring SSH remains allowed.

Official references

These sources were checked for the current MSH revision. Version-sensitive details should always be confirmed against the project documentation for the release you run.

Was this article helpful?

Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.