NAT and game hosting, why your friend can't connect to your home server

You set up a Minecraft server on your computer. You give your friend your IP. They can't connect. Or you set up Valheim and want to host for buddies; they get "connection failed." Or you play a P2P game and matchmaking shows "Strict NAT" and you can't host lobbies.

The culprit is almost always NAT in some form. This article is the specific guide for game hosting and connecting, with the gotchas that bite gamers most.

Quick NAT recap

Your home router does Network Address Translation. Inside your home, devices have private IPs (192.168.x.x or similar). Outside, your router has one public IP (or shares one via CGNAT). The router translates between them.

For outbound connections (you connecting to a website), NAT works transparently. The router rewrites source addresses, tracks state, forwards responses.

For inbound connections (someone connecting to you), NAT has a problem: it doesn't know which inside device the connection is meant for. So it drops the packet.

This is why hosting from home requires extra work.

How NAT blocks inbound connections

The fix is to TELL the router which internal device should receive a specific port: that's port forwarding. The exception is CGNAT, where an upstream layer also NATs and there's no rule you can set.

The three categories of game networking

Different games make this easier or harder:

Dedicated server hosted on hosting infrastructure. You rent a server somewhere with a real public IP. Players connect to it. NAT isn't your problem; the server is on the public internet.

Dedicated server you run at home. You're the host. Players connect to your home. NAT is the friction.

Peer-to-peer matchmaking. No one hosts in the traditional sense. Players connect to each other directly. NAT on both sides matters.

Most of this article is about the second case, with notes on the third.

Port forwarding, the standard solution

For "I want to host a Minecraft server at home and have friends connect":

1. Set your server's internal IP to be stable. Either set a static IP on the server itself, or configure your router's DHCP to always assign the same private IP to that device (DHCP reservation). Otherwise, your server's IP might change and break the port forwarding.

2. Log into your router's admin panel. Usually 192.168.1.1 or 192.168.0.1 in a browser.

3. Find port forwarding settings. Different routers use different names: "Port Forwarding," "Virtual Server," "NAT Forwarding," "Applications & Gaming."

4. Add a rule:

   • External port: 25565 (or your game's port).
   • Internal IP: your server's private IP.
   • Internal port: 25565.
   • Protocol: TCP for Minecraft Java. UDP for Bedrock, Valheim, VS.

5. Save and apply.

6. Give friends your public IP (Google "what is my IP" to find it).

If everything is set up, friends connecting to your-public-ip:25565 reach your server.

The CGNAT problem

If your ISP uses Carrier-Grade NAT, the above doesn't work. Even with perfect port forwarding on your router, the ISP's NAT layer blocks inbound traffic.

Signs you're behind CGNAT:

• Your router's WAN IP is in 100.64.0.0/10 (the CGNAT range).
• Your router's WAN IP differs from what "what is my IP" shows.
• Port forwarding tests fail despite correct configuration.

Common on:

• Most mobile carriers.
• Many budget cable broadband.
• Many fiber providers' basic tiers.
• Almost universal in some countries.

If you're behind CGNAT, you have several options (covered later in this article).

Game-specific port ranges

Common ports for popular games:

Minecraft Java: TCP 25565. Minecraft Bedrock: UDP 19132 (and 19133 for IPv6). Valheim: UDP 2456, 2457, 2458 (three consecutive). Vintage Story: UDP 42420. Source-engine games (CS, TF2): UDP 27015 (and several others depending on game). Project Zomboid: UDP 16261 (default). Rust: UDP 28015, 28016. ARK: Survival Evolved: UDP 7777, 7778, 27015. Terraria: TCP 7777.

Many games use UDP. Make sure to open the right protocol. TCP-forwarding rules don't help UDP-based games.

The Steam Datagram Relay alternative

For some Steam games, Valve provides Steam Datagram Relay (SDR). Players' game traffic goes through Valve's network to the server, bypassing direct connection. Server's IP isn't directly exposed.

When SDR is used:

• Players don't need your IP. They connect via Steam.
• Your NAT issues are mitigated (Valve handles the relay).
• Some latency added by the relay.

This is great for hosting from home behind NAT, when the game supports it. Source-engine games, some others.

P2P games and NAT type

For games that use peer-to-peer connections (many console games, some PC games):

NAT Type 1 / Open NAT: roughly Full Cone NAT. Other players can connect to you directly. Best for hosting.

NAT Type 2 / Moderate NAT: roughly Restricted Cone. Connections work for many situations, may fail for some.

NAT Type 3 / Strict NAT: roughly Symmetric NAT, or fully blocked. P2P is heavily limited.

You can sometimes improve NAT type with:

• Port forwarding for the game's specific ports.
• DMZ (placing your console outside the home network's NAT entirely). Less secure but maximally permissive.
• UPnP enabled on your router. Lets games request port forwards automatically.

CGNAT customers are usually stuck at Type 3 regardless of router settings.

UPnP for games

Universal Plug and Play lets applications request port forwards from the router programmatically. Designed for games and other apps.

When working:

• A game console says "open UDP 27015 to me."
• Router does it.
• Other players can connect.

When not working:

• Router doesn't support UPnP.
• UPnP is disabled (often for security).
• ISP CGNAT blocks inbound anyway.

UPnP has a security history. A malicious app inside your network can request port forwards. Default-on UPnP increases attack surface, slightly. Many security-conscious users disable it.

For gaming: UPnP usually helps. Decide based on your threat model.

Workarounds for CGNAT

If you're CGNAT'd and need to host:

Pay your ISP for a public IP. Cleanest fix. $5-20/month typical. Cancel CGNAT for your line.

Use a VPN with port forwarding. Some VPN services (Mullvad, AirVPN, Mullvad, etc.) offer port forwarding. You connect to the VPN; it gives you a public-facing IP and forwards specified ports to you. Your traffic goes through them but works publicly.

Use a cloud VPS as a reverse proxy. Rent a $5/month VPS. Set up an SSH or WireGuard tunnel from your home server to the VPS. The VPS's public IP forwards to your home server. Players connect to VPS IP; traffic gets routed to home.

Cloudflare Tunnel and similar. Free for some use cases. Reverse-tunnel from your home server to a public-facing endpoint. Cloudflare or similar handles the public-facing IP. Good for non-game traffic (websites); limited for arbitrary TCP/UDP.

Pay for game hosting. Honestly often the right answer. $5-10/month for a real game server with a real public IP. Avoids all CGNAT-and-home-network complications.

IPv6 as a fix

If both your home and the destination support IPv6, the NAT problem disappears. Every device has its own globally-routable IPv6 address. No NAT in the path.

In 2026:

• Most ISPs offer IPv6 (at least optionally).
• Most game clients support IPv6 (Minecraft Java fully, Bedrock partial, Valheim partial).
• IPv6-only paths work for many use cases.

If your ISP gives you IPv6, enable it. Configure your server to listen on IPv6 too. Players with IPv6 can connect directly without NAT issues.

This isn't a complete fix (some players have IPv4-only), but it's a partial win that's easy.

Testing your setup

Tools and methods:

Port checkers (canyouseeme.org or similar). Online services that try to connect to a specified port on your public IP. If they can, your forwarding works.

Friends in a different network. Have them try to connect. Most direct test.

telnet your-public-ip 25565 (Linux/Mac): tries to connect to your port. If it works, you're reachable. If it hangs, you're not.

nc -zv your-public-ip 25565: similar.

If external tests fail but internal tests succeed, NAT or firewall is the issue.

The home-hosting reality

For most casual game-server admins, paid hosting is the realistic option. Reasons:

• No NAT issues.
• No CGNAT.
• Real public IP and ports.
• Stable uptime (your home power flickering doesn't drop the server).
• Better network paths in most cases.
• Cost is modest ($5-15/month for small servers).

Home hosting is fun as a hobby. Production game hosting is rarely worth the friction.

If you're determined to home-host:

• Use a dedicated machine (not your gaming PC, which restarts).
• Have a non-CGNAT ISP plan.
• Set up port forwarding once, document it.
• Consider a backup public-IP service for failover.

A specific scenario: hosting Minecraft for friends

Most-common case. Step by step:

1. Decide hosting location: home or paid.
2. If home: confirm you have a non-CGNAT public IP.
3. Install Minecraft server on stable host.
4. Configure server.properties (port, motd, etc.).
5. If home: set up port forwarding for TCP 25565.
6. Get a domain (optional but recommended): point an A record at your IP.
7. Set up an SRV record (covered in the DNS articles) so players use the friendly name.
8. Test from outside.
9. Share the hostname with friends.

For Valheim:

• UDP ports 2456-2458.
• Set the password in start_server.bat / start_server.sh.
• Valheim doesn't use SRV; share IP:port or hostname:port.

For Vintage Story:

• UDP port 42420.
• Configure server config first.
• Add players to whitelist via UID.

Conclusion

NAT is the friction between "I want to host" and "my friends can connect." Home routers' NAT is solvable via port forwarding. ISP CGNAT is harder and often requires changing your hosting model.

For casual game hosting, paid hosting bypasses these issues. For determined home hosting, plan around your network's reality (CGNAT or not), set up port forwarding correctly, and test from outside before announcing.

If you're frustrated trying to host from home, the issue is almost always one of: wrong protocol forwarded, wrong port, server not on the IP you forwarded to, CGNAT in the way, or firewall on the server.

Run through that list before assuming "this game's networking is broken."

Coming up

Next: UPnP and port forwarding, in more depth. The consumer-grade solutions and their limitations.