Original PortalMine editorial illustration. This page is maintained as practical server-owner documentation.
Quick answer: Java usually uses TCP; Bedrock commonly uses UDP. Opening the right number with the wrong protocol still leaves the server unreachable.
A port is a service endpoint
One IP address can host many services because each listens on a port. The game process must bind to the assigned port, the host firewall must allow it, and any upstream firewall or security group must also permit the same protocol.
TCP and UDP are not interchangeable
Minecraft Java server traffic normally uses TCP. Bedrock server traffic normally uses UDP. Some control panels display an allocation without emphasizing the protocol, so firewall rules must be checked explicitly. A TCP port checker cannot prove that a UDP Bedrock service is working.
Bind address and container mappings
A process listening only on localhost is not reachable externally. In containers, the allocation must be mapped to the container and the server configuration must use the injected port. Hardcoding a default port can make the process listen somewhere different from the panel allocation.
Home networks and NAT
Self-hosted servers behind a router need port forwarding from the public interface to the correct internal device. Carrier-grade NAT can prevent inbound forwarding even when router settings look correct. Hosted servers usually avoid home NAT but still have provider firewalls.
Test from outside
Testing from the same machine or Wi-Fi may use local routing and hide a public failure. Test from a mobile network or an external probe appropriate to TCP or UDP. Confirm the public DNS answer and port together.
Keep the attack surface small
Open only the game allocation and required management services. Restrict SSH by key and source where possible. Do not expose databases or panel internals publicly. Rate limits and DDoS protection are separate from basic firewall rules.
A layered troubleshooting checklist
Confirm the server is online; verify the listening address and protocol; inspect container allocation; check host firewall; check provider firewall; verify NAT or forwarding; resolve DNS; then test externally. Each layer has a distinct failure mode.
Editorial review notes
This article is written for small Minecraft communities and self-service hosting users. Exact commands, limits, APIs, and compatibility can vary by edition, software build, node configuration, and installed extensions. Test changes on a copy, keep backups, and consult the current project documentation for version-specific requirements.