Almost every "my friends cannot join" report is the same thing. The server runs, it works from the machine it runs on, and nothing from outside the house reaches it. Funcom put it well: the biggest hurdle is reaching the machine you host on from the outside world, because your router, modem and firewall are all doing their job, which is keeping unrequested traffic out. Port forwarding tells them this traffic is wanted.
What a port actually is
A machine has one address. A port is the number saying which program on it a packet is for. A server picks a port at startup and listens there, so a packet sent to your address on that port reaches it and one on any other port does not.
At home there is a second layer. Your router holds the one public address, and every device behind it has a private address that means nothing outside your house. When a packet arrives on port 25565, the router cannot know which device wanted it. A forwarding rule is the answer: traffic on this port goes to this internal address on this port. Funcom say the sentence people skip: your friends connect on your external address, and your local address is only valid on your side of the router.
TCP or UDP, and why you cannot guess
Games use both transports. Forward exactly what the vendor names: the two are separate rules, and the wrong one looks identical to forwarding nothing.
Minecraft's server-port is documented as TCP. Factorio is UDP only. Rust runs game and query on UDP and remote console on TCP, and Facepunch add an instruction: if your router offers a "both" or "all" protocol option, avoid it. Funcom say the opposite for Conan Exiles, to forward both, because that game needs both. SCUM is the sharpest case: the game port is UDP and the query port is TCP, so one rule across a range on one protocol leaves the server invisible.
The ports, per game
| Game | Ports |
|---|---|
| Minecraft (Java) | 25565 TCP. Query, if enabled, is UDP on the same number by default. |
| Rust | 28015 UDP, plus a query port, also UDP. Both must be open and cannot be the same number. |
| Factorio | 34197, UDP only. |
| Valheim | 2456 and 2457: the port you choose and the one above it. Iron Gate give the range without naming a protocol, so follow your server tool. On the crossplay backend the server uses a relay and needs no forwarding. |
| Conan Exiles | 7777 UDP game, 7778 UDP pinger (game port plus one, not changeable), 27015 UDP query, 25575 TCP remote console. |
| Terraria | 7777 TCP by default. On a cloud provider, the Terraria Wiki advises opening 7777 on both TCP and UDP. |
| ARK: Survival Evolved | 7777 UDP game, 7778 UDP peer (always the game port plus one), 27015 UDP query, 27020 TCP remote console if you use it. The server cannot open ports on the router by itself, so forward them by hand. |
| Palworld | 8211, UDP only. Change it with -port=. |
| Project Zomboid | 16261 UDP, the default starting port, and 16262 UDP, the direct connection port. |
| 7 Days to Die | 26900 TCP and 26900 to 26903 UDP on the router. 8080 to 8081 TCP only if you administer the server remotely. |
| Satisfactory | 7777 on both TCP and UDP, plus 8888 TCP for reliable messaging. The outside and inside numbers for 7777 have to match. |
| Enshrouded | The query port, 15637 by default, plus the ports Steam itself requires. Keen give no protocol for it, so follow your server tool. |
| Garry's Mod | 27015 TCP and UDP for game traffic and remote console. 27020 UDP (SourceTV) and 27005 UDP (client port) only if you need them. |
| SCUM | 7777 UDP game, 7778 UDP raw socket, 7779 TCP query, the last two derived as game port plus one and two. |
| DayZ | 2302 UDP game, plus the query port set as steamQueryPort in the config file. |
| Arma 3 | 2302 to 2306, all UDP: game and voice, Steam query, Steam master, a reserved voice port, BattlEye. |
Every number there is from the game's own documentation or wiki, listed under Sources, and each is a default you can change. Check your config first.
The query port is the one people forget
Two ports do two jobs. The game port carries play. The query port answers "is there a server here, what is it called, how many people are on it", and that answer is what puts you in a browser. Forward only the game port and you get a server that works by direct connect and does not exist to any list. Facepunch state it for Rust: game and query both have to be open and reachable, and cannot be the same number. Bohemia's DayZ config says the same beside steamQueryPort. If your server is missing from a list rather than unreachable, our page on a server not showing in the server list goes through the rest.
Do these three things, in this order
One: pin the server's local address. Funcom explain why, and it is the failure that looks like forwarding breaking for no reason: after a reboot the machine can come back on a different address from the one your rule names. Give it a fixed address on the router.
Two: add the forwarding rule. Interfaces differ, and Funcom's summary holds for all of them: you pick some input ports and redirect them to a specific machine on your internal network. Use the same port on both sides, one rule per protocol.
Three: open those ports on the machine's own firewall. A router rule delivers the packet to the machine; the firewall decides whether the program gets it. Funcom's checklist: inbound rules for each port you use, query port and remote console included.
On Windows
Microsoft's route is the Windows Firewall with Advanced Security console. Press Start, type wf.msc, Enter. Select Inbound Rules, then Action and New rule, and take Custom on the Rule Type page, which Microsoft note shows every page of the wizard. On Protocol and Ports pick TCP or UDP; for an incoming rule you normally set only the local port. Choose Allow the connection, pick the profiles, name it. For a machine that never moves, Microsoft suggest applying it to all network location profiles, since a disconnected card is treated as public.
On Linux
Ubuntu's default tool is ufw. Canonical are upfront that it is not a complete firewall interface, just an easy way to add and remove simple rules, which is what a game server needs. It starts out disabled.
sudo ufw allow 22opens a port,sudo ufw deny 22closes onesudo ufw allow proto tcp from 192.168.0.2 to any port 22limits a rule to one addresssudo ufw status verboseshows what is in force;status numberedgives the numbers to delete bysudo ufw enableturns it on, andsudo ufw logging onmakes a blocked packet leave a trace
Open the SSH port before enabling the firewall on a remote machine.
When forwarding cannot work
Sometimes the rule is correct and traffic never arrives, because your router holds no public address at all. Carriers short of addresses add a second layer of translation, and RFC 6598 set aside 100.64.0.0/10 specifically to number the link between that carrier equipment and the customer's router, distinct from ordinary private space because it belongs to the provider's network. If your router's external address sits in that range, or does not match what a "what is my IP" page shows, your forward stops at your own router, and nothing you change at home adds a rule to the translation in front of it.
Bohemia are the bluntest vendor here. Their Arma 3 documentation states the server does not support IPv6 or DS-Lite IPv4 tunnelled over IPv6, that you must have a real IPv4 connection, and that if in doubt you should contact your internet provider. That is the right call to make: some providers hand out a public address on request, sometimes for a fee, and if yours will not, home hosting for that game is over. One more trap, from Wube's Factorio documentation: some routers randomise the source port on outbound packets, which breaks the server even when forwarding is correct, and they need extra configuration to stop.
Testing it honestly
Joining from inside your own network proves nothing: traffic between two devices in the house never touches the forwarding rule, so a working local join beside a failed remote one is exactly what a missing forward looks like. Funcom say the same in reverse, that if you cannot join your own server but others can, use the local address. Test from outside, one protocol at a time.
What renting changes, honestly
A rented server sits on a machine that already has a public address, so there is no router in front of it and no carrier translation to argue with. That removes this chore and none of the others: the config, the mods, the backups and the updates are still yours.
Where ForgeWorld Gaming fits
Prefer renting to keeping your own server machine online? ForgeWorld Gaming currently offers Minecraft Paper Standard: 8, 16, 24, 32, 40, 48, 56 player slots at CA$15.89–CA$65.99/month. Hosted in Iowa, United States. Prices are in Canadian dollars, with no setup fee and cancel any time. Your server is set up automatically after payment. Continue to secure billing, Minecraft · Paper, CA$15.89 / month (Standard, 8 slots), or compare Minecraft Paper plans.