Host a Minecraft Server Behind CGNAT: No Port Forwarding Required

You’ve set up a Minecraft server on your PC. It works great on your local network. You and anyone on your Wi-Fi can hop in and play. But when you send your IP to a friend, they can’t connect. You’ve tried port forwarding, triple-checked the firewall, and nothing works.

If this sounds familiar, your ISP most likely uses CGNAT. You’re not alone, either. Millions of players around the world hit this same wall when trying to host a Minecraft server from home. As IPv4 addresses run out, more and more ISPs roll out CGNAT, making traditional port forwarding impossible.

The usual fix? Rent a VPS, set up iptables rules, and maintain a server you don’t actually need. Or give up and pay for a Minecraft hosting service where you lose control over mods, plugins, and performance. Neither option is great.

What Is CGNAT?

CGNAT stands for Carrier-Grade NAT. In simple terms, it means your ISP shares a single public IP address among dozens (or hundreds) of households. Your router thinks it has a public IP, but it’s actually behind another layer of NAT controlled by your ISP.

The result: port forwarding doesn’t work. Your router doesn’t have a real public IP, so there’s no way for outside traffic to reach your Minecraft server. This is different from a firewall issue, and no amount of router configuration will fix it. If you want to dig into the technical side, Tailscale has a great explainer on CGNAT.

The HomeGate Solution

HomeGate gives your Minecraft server a public address without opening any ports. You install a lightweight agent on your machine and HomeGate handles the rest: provisioning a public endpoint, routing traffic, and keeping your home IP hidden.

Traffic flows through HomeGate’s infrastructure, so anyone connecting to your server sees our IP, not yours. Your home network stays private. And since HomeGate supports both TCP and UDP proxying, it works with Java Edition and Bedrock Edition out of the box.

The whole process takes about 5 minutes. No VPS, no firewall rules, no reverse proxy setup.

Step-by-Step Guide

Step 1: Make Sure Your Minecraft Server Is Running

Before doing anything, verify your server works locally.

Java Edition uses TCP port 25565 by default. Start your server and connect from the Minecraft client on the same machine using localhost or 127.0.0.1 as the server address.

Bedrock Edition uses UDP port 19132 by default. Connect from another device on the same LAN to confirm it works.

If you can’t connect locally, fix that first. HomeGate routes traffic to your server, so the server needs to be running and reachable on your local network.

Step 2: Install Tailscale on Your Machine

HomeGate connects to your home server through Tailscale, a lightweight mesh VPN. Install it on the same machine running your Minecraft server.

Linux (one-liner):

curl -fsSL https://tailscale.com/install.sh | sh

Windows / macOS: Download from tailscale.com/download.

Once installed, authenticate:

tailscale up

Follow the link it gives you to sign in. That’s it. Your machine is now on your Tailscale network.

Step 3: Create a HomeGate Account

Head to homegate.sh and sign up. You’ll need the Dedicated+ plan, which includes TCP and UDP proxying for game servers and other non-HTTP services.

Step 4: Add Your Minecraft Server as a Service

From the HomeGate dashboard, create a new service:

Give it a name (e.g., “Minecraft Java” or “Minecraft Bedrock”)
Select the protocol: TCP for Java Edition, UDP for Bedrock Edition
Enter your Minecraft server port (25565 for Java, 19132 for Bedrock)
HomeGate provisions the proxy and gives you a connection string

You’ll get an address like your-server.homegate.sh:25565. This is what your friends will use to connect.

Send your friends the connection string. In Minecraft:

Java Edition: Add Server → paste the address (e.g., your-server.homegate.sh:25565)
Bedrock Edition: Add Server → enter the hostname and port separately

That’s it. They connect, you play. Your home IP is never visible to anyone joining your server.

Bonus: Java AND Bedrock at the Same Time

If you run both a Java and a Bedrock server (or use a proxy like GeyserMC), you can create two services in HomeGate, one TCP and one UDP. Each gets its own port and connection string, so friends on either platform can connect to the right one.

Why Not Use…?

Ngrok or Cloudflare Tunnels

These tools are designed for HTTP traffic: web apps, APIs, webhooks. TCP and UDP support is limited, unreliable, or nonexistent. Game server traffic isn’t HTTP, so they’re not the right tool for the job.

A Paid Minecraft Host

You lose control. Want to install custom mods or plugins? Good luck with the host’s file manager. Want to tweak JVM flags for better performance? Maybe, if the control panel allows it. And for the same monthly cost, you could have better hardware running it yourself. Hosting a Minecraft server at home lets you customize everything and upgrade on your own terms.

A VPS with iptables Forwarding

It works, but now you’re maintaining a VPS, writing firewall rules, and paying for compute you don’t need. If the VPS goes down, your server is unreachable. If you forget to update it, it’s a security risk. HomeGate handles the proxying for you so you can focus on your server, not your infrastructure.

Playit.gg

A similar concept, and a solid tool for game servers specifically. HomeGate offers a broader platform: HTTP reverse proxying, custom domains with automatic SSL, DDoS protection, and a REST API for automation. If you host more than just Minecraft, HomeGate covers everything in one place.

Conclusion

Hosting a Minecraft server from home shouldn’t require a networking degree. With HomeGate, you go from “my friends can’t connect” to “everyone’s online” in about 5 minutes. No port forwarding, no exposing your home IP, and no CGNAT headaches.

It works just as well for other game servers. Valheim, Terraria, Factorio, Palworld: if it listens on a port, HomeGate can proxy it.

Ready to make your server accessible? Sign up at homegate.sh and start playing with your friends tonight.