Direct answer
Keep Windows Defender Firewall enabled. Allow the Java process used by the server or create an inbound rule for the Minecraft server's listening port. For a default Java server that is 25565; if you changed server-port, use the new port instead.
Use the allowed-app prompt when available
When Windows first asks whether Java should communicate through the firewall, allow it only for the network profiles you actually need. For a home LAN, the Private profile is normally relevant. Internet-hosted inbound traffic may require an explicit inbound rule depending on your network profile and setup.
Create a port rule in the GUI
- Open Windows Defender Firewall with Advanced Security.
- Choose Inbound Rules → New Rule.
- Select Port.
- Select TCP and enter the server port, such as
25565. - Allow the connection for the profiles that match your setup.
- Name the rule clearly, such as
Minecraft Java Server 25565.
Firewall vs port forwarding
They solve different problems. The Windows firewall decides whether the server PC accepts traffic. Port forwarding tells the router where to send traffic arriving from the internet. A remote friend usually needs both to be correct for a home-hosted server.
Do not “fix” it by turning the firewall off
If LAN works but internet does not
The Windows firewall may already be correct. Check the router forwarding rule, the destination LAN IP, your public address, and possible CGNAT before repeatedly changing firewall settings.
Official references
These references were checked while preparing this guide. Version-specific behavior can change, so use the project documentation for your exact release when a detail differs.
Related guides
Help us improve this article
Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.