Which ports to open for a Minecraft server (25565 and Bedrock)

There is a trap here that catches a lot of people: Java and Bedrock use neither the same port nor the same protocol. If your server is Java, Bedrock will not get in no matter what you open, and vice versa.

The ports

Port	Protocol	What for	Open it?
25565	TCP	Minecraft Java	Yes, if you play Java
19132	UDP	Minecraft Bedrock (mobile, console, Windows 10/11)	Yes, if you play Bedrock
25565	UDP	Query (server lists, Discord bots)	Only with `enable-query=true`
25575	TCP	RCON	Better not exposed to the internet

The port is set in server.properties, under server-port. If you changed it, use yours.

Windows (PowerShell as administrator)

Java:

New-NetFirewallRule -DisplayName "Minecraft Java TCP 25565 (in)"  -Direction Inbound  -Protocol TCP -LocalPort 25565 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "Minecraft Java TCP 25565 (out)" -Direction Outbound -Protocol TCP -LocalPort 25565 -Action Allow -Profile Any

Bedrock:

New-NetFirewallRule -DisplayName "Minecraft Bedrock UDP 19132 (in)"  -Direction Inbound  -Protocol UDP -LocalPort 19132 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "Minecraft Bedrock UDP 19132 (out)" -Direction Outbound -Protocol UDP -LocalPort 19132 -Action Allow -Profile Any

Query, only if you enabled it in server.properties:

New-NetFirewallRule -DisplayName "Minecraft query UDP 25565 (in)" -Direction Inbound -Protocol UDP -LocalPort 25565 -Action Allow -Profile Any

Linux

# Java — Ubuntu / Debian
ufw allow 25565/tcp
# Bedrock
ufw allow 19132/udp

# AlmaLinux / Rocky
firewall-cmd --permanent --add-port=25565/tcp
firewall-cmd --permanent --add-port=19132/udp
firewall-cmd --reload

# Listening?
ss -lntup | grep -E '25565|19132'

Letting players connect without typing a port

If you use 25565 (the standard one), players just type your IP or domain. If you changed it, they have to type yourdomain.com:25566, which is ugly and gets forgotten.

The clean fix is an SRV record in your DNS, which tells the client which port to use without the player ever knowing:

_minecraft._tcp.play.yourdomain.com.  SRV  0 5 25566  yourdomain.com.

With that, players join by typing just play.yourdomain.com. Bedrock has no SRV support, so there the port has to be entered.

Still nobody can join

Java or Bedrock? The classic mistake: opening TCP 25565 and then having friends join from a phone, which is Bedrock and runs on UDP 19132.
Is it running? Check the console: it should say Done and the port. If Java ran out of memory, it never even starts listening.
Empty server-ip. In server.properties, server-ip should be blank. With a value, the server only listens on that address.
online-mode does not affect connectivity, but it does affect who may join. If your players are not premium accounts, set it to false and add an authentication plugin.
AntiDDoS filtering: the Security tab of your service in the panel.

Not sure how much RAM to give it? Try our Minecraft RAM calculator: it accounts for server type, players and view distance, which is what actually eats memory.