Port reference
Port 25565 (TCP) – Minecraft (Java Edition server)
Default listening port for Minecraft Java Edition multiplayer servers, handling the game protocol and server-list pings.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on self-hosted and rented Minecraft Java servers, very commonly exposed directly to the internet.
What is port 25565 used for?
Port 25565 is the default port for Minecraft Java Edition multiplayer servers. When you host a Minecraft server — whether using the official server software, Spigot, Paper, or a modpack launcher — players connect to it on this port. It carries the game itself (logins, world updates, chat) and answers the server-list ping that shows player counts. Server admin tools sometimes use a separate RCON console on port 25575.
When would you open it?
The classic reason to forward this port is to host a Minecraft server at home so friends can join over the internet. Set up a port forward for 25565 on your router to the machine running the server, and only while you actually run it. Many people instead use a hosting provider or a service like Minecraft Realms and never touch their router.
Is it safe to open?
The main risks are griefing and denial-of-service traffic; use a whitelist, keep the server software updated, and leave the RCON port closed to the internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :25565
nmap -p 25565 <target>netstat -ano | findstr :25565
Test-NetConnection <host> -Port 25565lsof -i :25565
nmap -p 25565 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 25565 to your device's local IP, internal port 25565, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 25565/tcpsudo firewall-cmd --permanent --add-port=25565/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 25565 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 25565" -Direction Inbound -Protocol TCP -LocalPort 25565 -Action AllowSecurity & risks
Common attacks
- Volumetric and application-layer DDoS against the server
- Log4Shell RCE on modded/plugin servers running vulnerable Log4j
- Exposed RCON (25575) abuse for remote console access
- Bot/join floods and griefing of unprotected servers
Hardening
- Patch/upgrade Log4j and the server software to mitigate Log4Shell
- Never expose RCON (25575); bind it to localhost and use a strong password
- Front the server with a DDoS-filtering proxy and rate-limit connections
- Use a whitelist and online-mode authentication to block unauthorized joins
- Run the server as an unprivileged user in an isolated container
How to block this port
sudo ufw deny 25565/tcpsudo firewall-cmd --permanent --remove-port=25565/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 25565 -j DROPNew-NetFirewallRule -DisplayName "Block 25565" -Direction Inbound -Protocol TCP -LocalPort 25565 -Action Blocknmap snippet
nmap -p25565 --script minecraft-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is port 25565 safe to expose to the internet?
- Only with care. It is a common DDoS target, and modded or plugin servers have faced critical RCE such as Log4Shell. Patch Log4j, keep RCON closed, enable a whitelist, and front it with DDoS filtering.
- What is the risk of RCON on port 25575?
- RCON gives full remote console control of the server. If exposed with a weak or default password, attackers take over the server. Bind RCON to localhost and never expose 25575 to the internet.