The full text is io.netty.channel.AbstractChannel$AnnotatedConnectException: Connection timed out: no further information, and it is the most precise error Minecraft gives you. It means your client sent a TCP handshake to the address and port you asked for, waited, and received nothing at all. Not a refusal. Silence.
What silence rules out ¶
This distinction does most of the diagnostic work, so it is worth being exact about it.
- Connection timed out: nothing answered. A firewall dropped the packet without replying, the host is off, or the address does not lead anywhere.
- Connection refused: something answered, and said no. The machine is up and reachable; nothing is listening on that port.
A refusal is a conversation. A timeout is an absence. If you are seeing a timeout, the server process being crashed is only one of several explanations, and usually not the first one to check.
1. The port is not open to the internet ¶
By far the most common cause for a self-hosted server, and the one people spend longest not checking. Minecraft Java listens on TCP 25565 by default. For anyone outside your network to reach it, that port must be forwarded from your router to the machine running the server, and allowed through that machine's own firewall.
Two separate barriers, and a working configuration needs both. On Windows, the server usually needs an inbound rule for the Java executable, not merely for the port. On Linux, check ufw status or firewall-cmd --list-all.
The definitive test is from outside your network entirely: a friend on another connection, or your phone on mobile data with Wi-Fi off. Testing from inside your own LAN proves nothing, because the traffic never crosses the router.
2. Carrier-grade NAT: you have no public address to forward ¶
If you have forwarded the port correctly and it still times out, check whether your ISP has given you a public address at all. Many home connections, and nearly all mobile broadband and Starlink connections, put you behind carrier-grade NAT: you share one public address with thousands of other subscribers, and nobody can reach you directly no matter what your router says.
Compare the WAN address shown in your router with what a "what is my IP" page reports. If they differ, port forwarding cannot work, and no amount of router configuration will change that. The options are a tunnelling service, a VPS, or asking the ISP for a static or public address, usually as a paid add-on.
3. The wrong address, or a stale one ¶
Residential addresses change. A server address written down last month may now belong to someone else's connection entirely, which produces a timeout rather than an error, because that address is a real destination that simply ignores you.
If the server uses a domain, confirm what it currently resolves to with our DNS lookup, and compare against the server's actual address. Dynamic DNS clients fail quietly more often than anyone expects.
4. SRV records pointing at the wrong place ¶
A custom address like play.example.com with no port usually relies on an SRV record telling the client which host and port to use. If that record is missing, expired, or points at an old host, the client falls back to port 25565 on the base domain, and times out if nothing is there.
Test by connecting with the explicit host and port instead: host.example.com:25566. If that works and the short address does not, the SRV record is your problem, not the server.
5. The server is genuinely down or overwhelmed ¶
Last, because it is the assumption people start with. A server that is starting up, mid-restart, or thrashing on garbage collection accepts the TCP connection but never completes the handshake, which surfaces as a timeout rather than a refusal.
Check the server list ping from outside your network: our checker queries the server's own protocol and reports MOTD, player count and latency if anything answers. A successful ping while your client times out is strong evidence the fault is between you and it. Nothing at all means the server is not answering anyone.
The order that saves time ¶
- Ping the address from outside your network. This alone splits "server problem" from "my problem".
- Confirm the address resolves to what you expect.
- Try host and port explicitly, to rule out SRV.
- Check the WAN address against your public address, for CGNAT.
- Only then start on port forwarding and firewalls.
Most guides start at step five. It is the most work and the least likely to be the answer if you have never had the server working at all from outside.
If it worked yesterday and not today ¶
Three things change on their own: a residential address after a router reboot, a dynamic DNS record that stopped updating, and an ISP moving you behind CGNAT during a network change. All three produce exactly this error with no configuration change on your side, which is why "I did not change anything" is usually true and rarely helpful.