Networking and Firewall

Networking and Firewall

The whole point of proxyforward is that only the gateway needs to be reachable. This page says exactly what to open, and where.

Who needs what

Gateway (Server B) — inbound

Two kinds of TCP port, both bound to gateway.bind_addr (default 0.0.0.0, i.e. every interface):

Port	Default	Who connects	Required?
Control port	8474	your agent, once	Yes — without it the tunnel can't form
Public port	25565	Minecraft players	Yes — one per enabled tunnel

If you run several tunnels, each enabled tunnel's public_port must be reachable. Change the control port with gateway.control_port — see Configuration.

Agent (Server A) — outbound only

• One TCP connection to gateway_host:8474. That's it.
• No inbound ports. No port forwarding. No firewall rule. This is the entire reason the project exists.
• Locally, the agent dials your Minecraft server at the tunnel's local_addr (127.0.0.1:25565 by default).

Optional outbound HTTPS (either role)

Only if you leave the relevant features on — see Analytics and Privacy:

• api.minecraftservices.com, sessionserver.mojang.com — resolving player names to UUIDs and skins. Turn off with analytics.mojang_lookups = false.
• mc-heads.net, crafatar.com — avatar images.
• github.com — the creator's avatar on the About screen.

Nothing else. There is no telemetry, no update check, no phone-home.

Opening the ports

You usually need to do this in two places, and forgetting the second is the most common reason "it doesn't work".

1. The router / cloud firewall (in front of the gateway). Forward TCP 8474 and TCP 25565 to the gateway machine's LAN address. On a VPS there is no router, but there is almost always a cloud firewall — AWS security groups, Hetzner firewall, Oracle Cloud ingress rules — and it is usually the thing silently dropping your packets. Check it before you check anything else.

2. Windows Firewall (on the gateway itself). proxyforward adds a single program-scoped inbound allow rule, named proxyforward, via netsh advfirewall. Program-scoped is deliberate: the rule allows the executable to accept connections, so when you later change a port, add a tunnel, or move the control port, no new rule and no new UAC prompt is needed.

From the GUI: Settings → System → Firewall rule → Add rule. That triggers exactly one UAC prompt, ever.

From the command line:

proxyforward firewall status     # no elevation needed
proxyforward firewall add        # elevates
proxyforward firewall remove     # elevates

If you'd rather do it yourself, the equivalent is an inbound allow rule scoped to the program path, not to a port.

Verify, don't guess

The agent's Tunnels → Test player path (also on Overview) walks the entire chain the way a player does — DNS resolution, the router, the gateway's public port, the tunnel, and the final hop to your Minecraft server — and reports the hop that failed. Use it before you start changing settings at random.

DNS and dynamic IPs

Give players a hostname, not an IP address. This matters more than people expect.

Minecraft's JVM caches DNS aggressively. If the gateway's public IP changes, clients that are already running keep dialing the old IP until the player restarts the game — and there is nothing you can do server-side to fix that. A hostname with a low TTL lets the change actually propagate.

So:

• Register a stable, low-TTL hostname and point players at that. Ideally publish a _minecraft._tcp SRV record, which also lets you hide a non-standard port so players can type just mc.example.com.
• On a dynamic residential IP, use DDNS and put the DDNS hostname in the gateway's public_host.

The tunnel itself is already built for this: the agent re-resolves the gateway's DNS name on every reconnect attempt, so a gateway whose IP moves is reconnected to automatically without re-pairing. You can even change the gateway address later, in Settings, without generating a new pairing code.

Ports already in use

If something else already holds the port, proxyforward doesn't just say bind: address already in use — it names the culprit:

Port 25565 is in use by java.exe (PID 1234)

That is usually your Minecraft server itself, if you accidentally set the gateway's public port on the machine that's also running Minecraft. See Troubleshooting.