Ports, why one server can host a game, a website, and email at the same time

Field note. Why your friend's router blocks 25565 and your office firewall doesn't, why your panel runs on 8080 and the game runs on 25565, all comes down to ports.

A single server with a single IP address can handle a website, a game server, an email service, and a database simultaneously, all on the same physical machine, with separate connections to each. How? Ports.

If IP addresses are like the street address of a building, ports are like apartment numbers inside that building. The full delivery address is both together.

The basics

A port is a 16-bit number, so values from 0 to 65535. Every TCP or UDP connection involves four pieces of information:

• Source IP (your computer)
• Source port (a randomly chosen number on your side)
• Destination IP (the server)
• Destination port (the specific service on the server)

That four-tuple uniquely identifies a connection. Two connections are different if they differ in any of those four. This is how a server can handle thousands of simultaneous connections to the same port: each connection has a different source IP and source port combination.

Well-known ports

Certain port numbers are conventional. They aren't enforced by anything; they're agreed-upon defaults so clients know where to find services.

A few you'll see often:

Port	Service	Notes
22	SSH	Remote terminal access
25	SMTP	Sending email
53	DNS	Name lookups (mostly UDP)
80	HTTP	Unencrypted web
443	HTTPS	Encrypted web
587	SMTP submission	Email sending for clients
993	IMAPS	Receiving email (encrypted)
3306	MySQL	Database
5432	PostgreSQL	Database
25565	Minecraft Java	Game server default
27015	Source engine (Valve games)	CS, TF2, etc.
19132	Minecraft Bedrock	Mobile / console Minecraft
42420	Vintage Story	Game server default
2456-2458	Valheim	Game server uses three consecutive ports

When you type https://example.com in a browser, the browser implicitly knows to connect to port 443 because that's the default for HTTPS. If you wanted port 8080 instead, you'd type https://example.com:8080.

When you give players a Minecraft server address like play.myserver.com, their client implicitly tries port 25565 unless an SRV DNS record points elsewhere.

Three port ranges

The 65,536 possible ports are divided by convention:

0 to 1023: well-known ports. Allocated by IANA for specific services. On most operating systems, you need administrative privileges to listen on these. Reserved for "important" services.

1024 to 49151: registered ports. Allocated by IANA for specific applications but anyone can use them. Most game servers fall here (25565, 27015, etc.).

49152 to 65535: dynamic / ephemeral ports. Used by client programs as their source port when initiating a connection. When you load a website, your browser picks an unused port in this range to use as the "from address" for the connection.

Source ports in practice

When your computer makes a TCP connection to a web server:

You: source 192.168.1.5:51234, dest 198.51.100.10:443
Server: receives connection

Your computer chose port 51234 randomly from the ephemeral range. The server connects back to that port for the duration of the conversation.

When you make a second connection (loading another page), your computer picks a different ephemeral port, like 51235. The server now sees two distinct connections:

Connection 1: 192.168.1.5:51234 <-> 198.51.100.10:443
Connection 2: 192.168.1.5:51235 <-> 198.51.100.10:443

Same client, same server, same destination port. Different connections because the source ports differ.

This is also why a server can handle thousands of simultaneous users on port 443. Each user's source IP+port combination is different. The server tracks each connection in a table keyed by the four-tuple.

Listening vs connecting

A server listens on a port. It tells the operating system: "When connections come in for port 25565, give them to me." The OS accepts incoming connections on that port and hands them off.

A client connects to a port. It tells the OS: "Make a connection to IP X on port Y." The OS picks an ephemeral source port and initiates the connection.

A given port number can have only one process listening at a time. If you try to start a second Minecraft server on the same port, you get "Address already in use." This is one of the most common server-admin frustrations.

Why 25565 (a small digression)

Minecraft's default port, 25565, isn't random. Markus Persson (Notch) picked it for the prerelease in 2009. The number itself isn't meaningful. It just happened to be chosen, registered with IANA later, and is now traditional.

This is true of many "default" ports. They were chosen by someone, usually because the obvious one was already taken. The numbers stuck because changing them would break compatibility.

Firewalls and ports

A firewall decides which ports can accept connections from where. A typical configuration:

• Allow incoming connections on 22 (SSH) only from specific IPs.
• Allow incoming connections on 80 and 443 (web) from anywhere.
• Allow incoming connections on 25565 (Minecraft) from anywhere.
• Block everything else.

When players can't connect to your server, the question is often "is the port open in the firewall?" Many self-hosting frustrations come down to a forgotten firewall rule.

On Linux:

sudo iptables -L -n
sudo ufw status

Show the current rules. To open Minecraft's port:

sudo ufw allow 25565/tcp

For UDP services (like Bedrock or Valheim), use /udp.

Port forwarding (home hosting)

If you self-host on a home network, your home router is doing NAT. The router has the public IP; your computer has a private IP. By default, incoming connections to the public IP have no idea which inside computer to go to.

Port forwarding tells the router: "Incoming connections to port 25565 on the public side, send them to my computer at 192.168.1.5 port 25565."

Most home routers have a port-forwarding configuration page. You enter:

• External port: 25565
• Internal IP: your computer's private IP
• Internal port: 25565
• Protocol: TCP (or UDP, or both, depending)

After this, players connecting to your public IP on port 25565 are routed to your server.

Common gotcha: your home computer's private IP can change (DHCP). If it does, port forwarding still points at the old IP. Solution: give your server a "static lease" in DHCP, so it always gets the same private IP.

Common port problems

"Address already in use."

A program is already listening on that port. Find it: sudo lsof -i :25565 (Linux/Mac), netstat -ano | findstr 25565 (Windows). Kill it or change your port.

"Connection refused."

Server is not listening on that port (or firewall is blocking outbound on the client side). See the connection-refused article.

"Connection timed out."

Something between client and server is dropping packets. Often a firewall on the path, often the server's host firewall.

"Cannot bind to port" with permission denied.

You tried to listen on a well-known port (under 1024) without admin privileges. Either run as admin, or use a higher port and proxy.

A specific subtlety: TCP and UDP ports are separate

Port 53 TCP and port 53 UDP are two different ports. Different protocols, same number. A server can listen on UDP 53 (for DNS queries) while a different service listens on TCP 53. The OS distinguishes them.

This matters because some services use both protocols. DNS uses UDP for small queries and TCP for large ones (zone transfers, queries over 512 bytes). When you allow port 53 in a firewall, you may need to allow both protocols.

What ports tell you about a server

Curiosity: you can probe a server's open ports with nmap. This reveals which services it's running.

nmap example.com

Most modern servers expose only the ports they need. A well-configured Minecraft server might show:

• 22 (SSH, admin access)
• 25565 (Minecraft)
• 443 (web panel, optional)

A poorly-configured one might expose a database directly, an admin panel without auth, or services the operator forgot. Most attackers run port scans against ranges of IPs looking for misconfigurations. Exposing only what you need is basic security hygiene.

What's coming

You now understand the two main pieces of an address: the IP (which computer) and the port (which service on that computer). Together they uniquely identify a service on the internet.

Next we'll cover TCP and UDP: the two protocols that run on top of IP and ports, and that handle the actual data delivery. They have very different personalities. Understanding when each is used (and why games use both) is the next building block.