CraftHost GuideStart guide
LEVEL 3Networking

Public access options

Compare Playit, port forwarding, Tailscale and ZeroTier.

◷ About 20 min◇ OptionalReviewed Aug 18, 2026
On this pageChoose the smallest useful optionPlayitTailscale and ZeroTierPort forwardingBefore using the routerCGNAT and double NATWhich option should I use?

Choose the smallest useful option#

OptionCostSetupTypical latencyFriends install software?Public hostnameHides home IP?CGNATCustom domain
PlayitFree and paid featuresEasyRelay-dependentNoYesYesWorksPlan/feature-dependent
Port forwardingUsually no extra feeMediumDirectNoNo, unless DNS addedNoUsually blockedYes
TailscaleFree/paid plansMediumDirect when possible, relayed when neededYesPrivate MagicDNS/IPYesWorksPrivate naming, not normal public DNS
ZeroTierFree/paid plansMediumVirtual-network dependentYesPrivate addressYesWorksUsually private-network naming

Playit#

Playit is covered in the beginner tunnel guide. It starts an outbound connection from the server, so it can work through many NAT and CGNAT situations. Relay location and route affect latency, and free/paid hostname or custom-domain features can change.

Tailscale and ZeroTier#

These products create private overlay networks. They are useful for friends, administrators and dashboards because the service does not need to be public. The tradeoff is that every player normally installs a client, signs in or accepts network access.

Tailscale’s official sharing documentation supports granting a specific user access to a specific machine without making it public. Treat reusable share links like passwords and restrict access rules to the Minecraft port.

ZeroTier serves a similar private-network role with its own controller and member authorization model. Follow its official current documentation rather than copying an old network-ID tutorial.

Port forwarding#

Before using the router#

Port forwarding sends one public router port to the server’s private LAN address. It removes the tunnel hop but exposes your home public IP to the people who connect. Router screens differ, and this method may not work behind CGNAT.

  1. 1
    Confirm LAN joining works and reserve the ZimaOS local IP.
  2. 2
    Open the router’s app/admin page and find Port Forwarding, NAT, Virtual Server or Applications & Gaming.
  3. 3
    Add a rule named Minecraft Java.
  4. 4
    Use protocol TCP unless a specific mod also documents UDP.
  5. 5
    Set external port 25565, internal port 25565, and destination to the ZimaOS LAN IP.
  6. 6
    Save the rule. Do not place the server in DMZ.
  7. 7
    Find your public IP using the router’s status page.
  8. 8
    Test from cellular data or another household. Testing the public IP from inside can fail when the router lacks NAT loopback.

Private IP addresses such as 192.168.x.x work only at home. The public IP is assigned by your ISP. A changing dynamic public IP may later require a dynamic DNS name.

CGNAT and double NAT#

The forward looks right but no test reaches it

Compare the router’s WAN address with the public address shown by a public-IP service. If the WAN address is private, 100.64.0.0/10, or different because another modem/router sits ahead, you may have CGNAT or double NAT. Ask the ISP for a public IPv4 address, configure both routers, use bridge mode with care, or use Playit instead.

Sharing a public IP with trusted friends is common, but it reveals the approximate ISP/network location. Do not post it publicly, and remember it can change.

Which option should I use?#

  • Normal friends, least setup for them: Playit.
  • Small private group comfortable installing an app: Tailscale or ZeroTier.
  • Direct connection, controllable router, no CGNAT: port forwarding.
  • Public community: plan DDoS protection, abuse response and a hosting/network design beyond a casual home forward.

Test from a real outside network. Public port-check websites may test TCP only and cannot prove a Minecraft login, authentication or Bedrock UDP path works.

Was this page helpful?