Networking without the jargon
Understand LAN, WAN, NAT, CGNAT, ports, tunnels, DNS and firewalls.
On this page
The whole tripThe simple meaningsNAT and CGNATDNS and tunnelsFirewallsTroubleshoot in orderAdvanced detailsThe whole trip#
Minecraft client → Internet → router or tunnel → home server → Minecraft process
Every failed connection is somewhere on that path. Test from the inside out: server console, same PC, LAN, then internet.
The simple meanings#
LAN is your home network. WAN is the wider internet. A private IP such as 192.168.1.50 works inside the LAN. A public IP represents your internet connection outside it.
A port is a numbered doorway at an address. Java Minecraft commonly listens on TCP 25565. Bedrock commonly uses UDP 19132, though software and hosts can choose other ports.
TCP prioritizes an ordered, reliable stream. UDP sends individual datagrams with less built-in coordination. The protocol matters: opening TCP does not also open UDP.
NAT and CGNAT#
Your router uses NAT so many private devices can share a public address. A port-forwarding rule tells the router which local device receives unexpected incoming traffic on one port.
CGNAT means the internet provider performs another layer of address sharing outside your home. Normal router port forwarding often cannot cross it. A tunnel such as Playit can work because the connection starts outbound from your server.
DNS and tunnels#
DNS maps human-friendly names to connection information. DNS does not host or relay the Minecraft server.
A tunnel is an outbound connection from your server to a public relay. Players connect to the relay, which carries traffic through the established tunnel to Minecraft.
A web reverse proxy normally handles HTTP/HTTPS sites. It is not automatically a Minecraft proxy and does not make arbitrary game traffic work.
Firewalls#
A firewall decides which network traffic may reach a process. You can have a rule on the server, router, cloud provider and tunnel service. All relevant layers must agree.
Open only the game port and protocol you use. Do not expose ZimaOS, Crafty, a Docker API, database or SSH merely because Minecraft needs public access.
Troubleshoot in order#
- 1Confirm the server console says it finished starting.
- 2Confirm the process listens on the expected local port.
- 3Join from another device on the LAN using the server’s private IP.
- 4Confirm the tunnel/forward points to that same private IP and port.
- 5Test from a genuinely different network, such as a friend’s home.
- 6Read the exact error and the server/tunnel logs.
Friends time out but LAN works
The Minecraft process is probably healthy. Focus on the tunnel, public hostname, port/protocol, router rule, firewall and CGNAT—not Java or world files.
LAN does not work
Stop troubleshooting the internet. Confirm the server address, local IP, firewall, game version and console first.
Advanced details#
IPv4 and IPv6 are different address systems. An A DNS record points to IPv4; AAAA points to IPv6. Some homes have usable IPv6 even when IPv4 is behind CGNAT, but firewalling and player connectivity still need careful testing.
Network latency is only one kind of “lag.” Low TPS or high MSPT is a server simulation problem; rubber-banding can involve either server tick time or networking. Measure before changing things.