Minecraft Server Without Port Forwarding: playit.gg, ngrok and VPN Options

If you want to run a Minecraft server without port forwarding, you've got three real routes: a tunnel like playit.gg (only you install anything), a mesh VPN like Tailscale, ZeroTier or NetBird (everyone installs a client), or skipping the home-hosting thing altogether. Which one wins depends on why you can't forward a port in the first place.

The usual reasons: your ISP puts you behind CGNAT (it shares one public IP between many customers, so there's no public address to forward to), you don't have the router login, or the network belongs to someone else. If forwarding is possible and you just want the steps, that's all in my guide to how to make a Minecraft server. This page is for when it isn't.

Which option fits your situation

How to host a Minecraft server with playit.gg

playit.gg is the one I'd try first. A small program (the playit agent) runs on the PC hosting your server and makes an outbound connection to playit's relay. Your friends connect to the public address playit gives you, and nobody touches your router. Only the host installs anything. As of November 2026 the free plan is $0 and covers Minecraft, with a random but static address that doesn't change.

1. Get the server running locally first

From playit's own Java walkthrough: install Java, download server.jar from minecraft.net/en-us/download/server, put it in its own folder, and start it with java -Xmx1024M -Xms1024M -jar server.jar nogui. The first run stops and creates eula.txt. Set eula=true, run it again, and test with direct connect to 127.0.0.1:25565. If that works, the server is fine and the rest is just getting people to it. Which Java you need depends on your Minecraft version, and the table in my main server guide has it.

2. Install the agent

Download the playit program from playit.gg/download or the official GitHub releases, and nowhere else. It's open source (BSD-2-Clause), with a Windows installer, a winget package, an apt repo for Debian and Ubuntu, and a Docker image. Run it on the same machine as the server.

3. Claim the agent and add a tunnel

The agent prints a claim link. Open it, log in, and add the agent to your account. Then in the dashboard go to Tunnels, add a tunnel, pick Minecraft Java, and set the local address to 127.0.0.1 and the local port to 25565. That port has to match server-port in server.properties. Share the address the tunnel shows with your friends and they join like any other server. If you've never done that part, how to join a Minecraft server covers it.

Free plan limits

Free gets you 4 ports and 2 agents. Premium is $3 a month and bumps that to 16 ports and 10 agents, adds the choice of datacenter, and adds all tunnel types, including HTTPS and TCP. Free tunnels use Global Anycast routing, which isn't always optimal: playit's own docs say a North American player can end up routed through Singapore. If a laggy route is your problem, the paid regional tunnel is the fix. Prices and limits move, so check the pricing page before you commit.

Bedrock through playit

Microsoft's Bedrock Dedicated Server can't talk to playit on its own. Playit's current docs have you run WaterdogPE (a free proxy that needs Java 17 or newer) next to it and create a Minecraft Bedrock (NetherNet) tunnel. You need playit program 1.1.0 or newer, and the doc flags NetherNet as experimental. The Bedrock server moves to port 19142 with online-mode=false and allow-list=false in server.properties, WaterdogPE listens on 19132, and players add the tunnel address with port 19132. Keep the tunnel token private, because anyone holding it can attach a server to your tunnel.

The other way: run a Java server with Geyser and Floodgate so Bedrock players can join it, with a NetherNet tunnel for them plus a second Minecraft Java tunnel for your Java players. Bedrock hosting in general is in my Bedrock server guide. Check which tunnel types your plan shows before you build around either method.

Is playit gg safe?

Short answer: it's a reasonable choice for a game server, and it's not magic. Here's what's actually going on.

• What it hides. Traffic goes through playit's relay, so players see playit's address, not your home IP. That's a real plus if you don't want strangers holding your IP.
• What it doesn't hide. The game port is still reachable by anyone who has the tunnel address. Community admins describe playit as giving only limited protection to the server itself. Treat it as a public server.
• The agent. It's open source on GitHub, but I haven't found an independent security audit of it. Some people see antivirus warnings on it, so only grab it from the official sources above.
• The rules. Playit's prohibited-uses page bans malware, botnet-style traffic, scanning and obfuscated tunnels, and says it can disable tunnels that cause abuse reports. Game servers, SSH, RDP, VPN servers and dashboards like Dynmap and BlueMap are allowed. It also points private peer-to-peer use toward Tailscale.
• Reliability. It's a free third-party relay. Players have reported outages and ping complaints, so it can have a bad day.

So lock down the server itself. Keep online-mode=true so Mojang verifies your players, turn on the whitelist (white-list=true, then /whitelist add <username>), and op only yourself. On Java, whitelist entries are Java profile names, not Xbox gamertags. Don't share your tunnel token. (The Bedrock setup above needs online-mode=false on the Bedrock server behind the proxy, which is one more reason to keep that token private.)

ngrok for a Minecraft server

ngrok can tunnel Minecraft too: ngrok tcp 25565 hands you an address like tcp://1.tcp.ngrok.io:12345. The free-plan terms trip people up, and older tutorials get them wrong. As of November 2026:

• You have to add a valid credit or debit card to your account before TCP endpoints work on the free tier. It isn't charged.
• The address isn't permanent. Restart the agent and you send everyone a new one. Reserving an address needs a paid plan.
• Free data transfer out is 1 GB a month. Go over and players can't connect.

That makes it fine for a one-evening test and a poor home for a world you play on every week. Compare that with playit's static free address and it's not close.

Tailscale, ZeroTier and NetBird

A mesh VPN skips the public internet entirely. You and your friends join one private network, and they connect to your server over it. Nothing is exposed to strangers, which is a genuine safety upgrade. The cost is friction: every player installs the client and joins your network. With kids or relatives who struggle to install anything, that gets old fast.

NetBird's own guide says the client route works behind CGNAT and needs no whitelist, because being on the network is the permission. That guide is vendor content, so read it as such. If you use a mesh, set access rules so friends' devices reach the server and nothing else on your network.

No-tunnel options

Sometimes the right answer is not hosting from home. If you're playing on the same Wi-Fi, LAN play needs no tunnel at all. For friends elsewhere without any networking, free Minecraft server hosting compares the free hosts, Aternos alternatives covers what to try when one of them doesn't suit, and Minecraft Realms pricing shows what the official route costs. Not sure what the best way to get everyone in the same world is? How to play Minecraft with friends lays out every option.

Planning a specific kind of server? The same setup applies to a skyblock server or a lifesteal server. The tunnel doesn't care what's running behind it.

School, work and parent-run networks

If the network isn't yours, the router and its rules aren't either. Running a server may break a school's or workplace's policy, and a parent may simply say no. Ask whoever owns or manages the network before you set anything up. If they say yes, they may be able to forward the port for you, and then you don't need a tunnel at all. If they say no, a no-tunnel option from the section above is your answer.

So, which one should you use?

Java server and friends who won't install anything: playit.gg, with the whitelist on. Small private group that doesn't mind an app: a mesh VPN, and it's the safer of the two. Just testing for an evening: ngrok. And if all of it sounds like more work than the game is worth, a free host skips the networking completely.