Your router drops unsolicited inbound traffic — that's its job. Port forwarding pokes exactly one hole in that shield so friends can reach the Minecraft server on your machine. Here's how to do it properly, and the honest list of ways it fails.
Step 1: Give your machine a fixed LAN IP
A forwarding rule points at a local address like 192.168.1.42. If your PC gets a different address after the next reboot, the rule silently points at nothing. Fix it first: set a static IP in your OS network settings, or better, a DHCP reservation in the router so the router always hands your machine the same address.
Step 2: Open your router's admin page
Browse to your gateway address — usually 192.168.1.1 or 192.168.0.1 (run ipconfig / ip routeto check). The login is on the router's sticker if you never changed it. Look for "Port Forwarding", sometimes hiding under NAT, Virtual Server, or Advanced.
Step 3: Create the rule
- External + internal port: 25565 (Java) — Bedrock uses 19132 instead
- Protocol: TCP for Java, UDP for Bedrock (both if unsure)
- Device / internal IP: the static address from step 1
Save; some routers want a reboot to apply.
Step 4: Allow it through the OS firewall
Windows Defender often blocks Java's inbound connections even after the router forwards them. Allow Java (or port 25565) through the firewall on the server machine — this is the most-skipped step in every "it still doesn't work" thread.
Step 5: Test from outside
Find your public IP (search "what is my IP"), then have a friend — or your phone on mobile data, not Wi-Fi — join your.public.ip:25565. An open-port checker site pointed at 25565 confirms the path without needing Minecraft.
When port forwarding can't work
Two cases no router setting fixes. CGNAT: many ISPs (most mobile/fiber providers) share one public IP across many customers — you never had a forwardable address. Double NAT:an ISP modem-router in front of your own router means forwarding through both, and the ISP box often doesn't allow it.
Also worth saying plainly: everyone who gets your server address gets your home IP. For a close friend group that's fine; posted anywhere public, it's an invitation for DDoS harassment.
The zero-port-forwarding route
Hosted servers sidestep the entire page: the server runs in a datacenter with a real public address, your home network stays closed, and CGNAT is irrelevant. That single fact is why most friend-group servers end up hosted — the game is the fun part; the router page is not.