Host a Minecraft Server Behind CGNAT (No Port Forward)

Updated October 2026. Pricing and plan details checked on the playit.gg, Tailscale and Oracle Cloud sites on 22 October 2026.

Short answer: if your ISP puts you behind CGNAT, port forwarding 25565 on your router will never work, because your router doesn't have a public IP address to forward from. The easiest fix is a tunnel service like playit.gg, which is free for Minecraft Java and Bedrock and gives friends an address to join. If your friends are a small, trusted group on PC, Tailscale also works and costs nothing. If you want full control, rent or use a free cloud server and tunnel through it, or just host the whole thing there.

Below is how to confirm you're actually behind CGNAT, then each option with its catches.

Jump to:

• Why port forwarding fails
• Step 1: Check for CGNAT
• Step 2: Get the server running locally
• Step 3: playit.gg
• Step 4: Tailscale instead
• Other options
• Which one I'd pick
• FAQ

Why port forwarding fails behind CGNAT

Normally your router gets one public IPv4 address from your ISP, and port forwarding tells it "send anything that arrives on port 25565 to my PC". With Carrier-Grade NAT, the ISP doesn't give your router a public address at all. Lots of customers share one public IP, and your router only sees a private address from the ISP's network. Incoming connections stop at the ISP's equipment, which knows nothing about your forwarding rule.

CGNAT is very common now because IPv4 addresses ran out. Mobile hotspots almost always use it, many fibre and fixed wireless providers do, and Starlink's standard plans do too. You'll find it on plenty of Jio and Airtel connections as well. None of the fixes below need your ISP's cooperation.

Step 1: Check if you're behind CGNAT

1. Log in to your router (usually 192.168.0.1 or 192.168.1.1) and find the WAN IP or Internet IP on its status page.
2. On the same network, search "what is my IP" or visit a site like ifconfig.me.
3. Compare them.

If they match, you have a public IP, and normal port forwarding should work. Check your firewall and forwarding rule again. If they're different, or the router's WAN IP starts with 100.64 to 100.127 (the shared range reserved for CGNAT), or with 10., 172.16-31. or 192.168., you're behind some kind of NAT you can't control. That's a no for port forwarding.

I go into this check in more detail in my Tailscale vs WireGuard post, since CGNAT decides what kind of home VPN you can run as well.

Step 2: Get the server running locally first

Before tunnelling anything, make sure the server itself works. Start it, then join from the same PC using localhost, or from another device on your Wi-Fi using the PC's local IP. Java Edition listens on TCP port 25565 by default. Bedrock Dedicated Server uses UDP port 19132.

If a device on your own network can't join, no tunnel will help. Usually it's Windows Firewall blocking Java, or the server bound to the wrong address. Fix that first and save yourself a lot of confusion.

Step 3: Make it public with playit.gg

playit.gg runs a small agent on the PC hosting the server. The agent connects outwards to playit's network, and playit gives you a public address. Players connect to that address, playit relays the traffic down your existing outbound connection, and CGNAT never gets in the way. Your friends don't install anything, and your home IP isn't shared.

1. Download the playit agent for your OS from the official playit.gg site and run it.
2. The first time it runs, it gives you a link to connect the agent to a playit account. Open it and sign in or sign up.
3. Create a tunnel and pick Minecraft Java or Minecraft Bedrock, pointed at your local port (25565 or 19132).
4. Copy the address playit gives you and send it to your friends. Keep the agent running whenever the server is up.

As of October 2026, Minecraft Java and Bedrock tunnels are on the free tier. Premium is $3 a month (about ₹285 at current exchange rates, before any bank or card fees) and unlocks extra tunnel types and features. One Bedrock catch: playit lists Bedrock's newer NetherNet transport under Premium, and its support docs have a guide for switching a Bedrock server back to RakNet, which works on the free tier.

The catch: all your traffic goes through playit's servers. Pick the closest region when you set up the tunnel, because a relay on the other side of the world will add noticeable lag.

Step 4: Or use Tailscale for a private friends-only server

If you're playing with a few friends on PC, Tailscale is a neat alternative. Everyone installs Tailscale and joins your tailnet (or you share the one server machine with them). They then connect using your PC's Tailscale IP, like 100.x.y.z:25565. Traffic is end-to-end encrypted with WireGuard and usually goes direct between you, with Tailscale's relays as a fallback.

Tailscale's Personal plan is free for non-commercial use and, as of October 2026, allows up to 6 users. The downside is obvious: every player has to install Tailscale. That rules out consoles and makes it awkward for a public server. Tailscale Funnel, its public-sharing feature, only handles HTTPS-style TCP on a few ports, so it isn't a Minecraft solution.

Other options: VPS tunnel, IPv6 or asking your ISP

Tunnel through a cheap or free VPS. A cloud server has a real public IP. You set up a WireGuard tunnel (or a reverse proxy tool) from your home PC to the VPS and forward port 25565 on the VPS down the tunnel. It's what playit does, just on hardware you control. Oracle Cloud's Always Free tier includes Arm-based Ampere A1 compute, which people use for exactly this, though sign-up needs a credit or debit card for verification, and free capacity isn't always available in every region.

Host the server on the VPS itself. If you're going to rent a server anyway, running Minecraft directly on it is simpler than tunnelling. Your PC doesn't have to stay on, either.

IPv6. Many CGNAT connections do give you a public IPv6 address, and Java Edition supports IPv6. If your friends' connections also have IPv6, they can connect straight to your PC's IPv6 address once you allow the port in your router's IPv6 firewall. It's free and direct, but in practice someone in the group always ends up without IPv6, so treat it as a bonus rather than a plan.

Ask your ISP for a public IP. Some providers will move you off CGNAT on request, sometimes for free, often as a paid static IP add-on. It's worth one support call or chat, because it fixes everything at once.

Which option I'd pick

For most people hosting for friends, playit.gg. It takes minutes, works with Java and Bedrock, players don't install anything, and the free tier covers it.

For two or three PC friends who'd rather not run traffic through a third party, Tailscale. If the server needs to be online all the time, skip home hosting and run it on a VPS. That also saves your PC from running all night.

Whatever you choose, keep the server updated, use a whitelist (whitelist on in the console) if it's just for friends, and never share your router or home IP publicly. If you're also self-hosting other things at home, my Raspberry Pi Pi-hole and WireGuard guide has a section on working around CGNAT for a home VPN.

Tried a method I haven't listed, or stuck on an error? Drop it in the comments with your setup.

FAQ

Can I host a Minecraft server without port forwarding?

Yes. A tunnel service like playit.gg, a mesh VPN like Tailscale, or a VPS with a tunnel all let friends join without opening any ports on your router. They work even behind CGNAT.

How do I know if I'm behind CGNAT?

Compare the WAN IP on your router's status page with the IP a "what is my IP" site shows. If they're different, or the router's WAN IP starts with 100.64 to 100.127, you're behind CGNAT.

Is playit.gg free for Minecraft?

Yes. As of October 2026, Minecraft Java and Bedrock tunnels are on playit's free tier. Premium costs $3 a month (about ₹285) and unlocks extra features.

Is playit.gg safe?

It's widely used and hides your home IP from players. Your traffic does pass through playit's servers, so use a whitelist and keep the server software updated, as you would with any public server.

Can Bedrock and console players join through Tailscale?

Not easily. Consoles can't run Tailscale, so console players can't reach a Tailscale address. Use playit.gg or a VPS if console friends need to join.

What port does a Minecraft server use?

Java Edition uses TCP port 25565 by default. Bedrock Dedicated Server uses UDP port 19132 by default.