You click Connect and Hytale stops on "Failed to connect to server. The host may be offline or behind a strict firewall." The host may have closed the world, the share code may have expired, a firewall or router may drop the traffic, or a dedicated server may be down, signed out or on another port. The fix depends on how you join: a friend's world through a share code, or a dedicated server by its address. The steps below follow Hypixel's own support articles and patch notes.
Quick answer: When Hytale fails to connect and says the host may be offline or behind a strict firewall, your game got no answer from the host. For a friend's world, the host reads the Connection line under Esc, Online Play, which names the problem. Add each other as Hytale friends so the game can relay the connection, send a fresh share code, allow Hytale through Windows Firewall on private and public networks, and test from a phone hotspot. A dedicated server uses QUIC over UDP port 5520 by default: it must be running and signed in (/auth status), with UDP 5520 open in its firewall and forwarded on a home router, and on the same build as its players.
What "host may be offline or behind a strict firewall" means
Since Update 6, Hytale's connection error screens give different messages for a server that can't be found, refuses you, crashes, drops the connection or can't secure it (Update 6 notes). A message about the version, for example, means your game did reach the host. The "strict firewall" message points at the connection itself, so first find your case:
| Friend's world | Dedicated server | |
|---|---|---|
| How you join | Servers, Join via Code | The server's address and port |
| Who fixes it | Usually the host | The server owner |
| Port | The one the host's Online Play screen names | UDP 5520 by default, or the port set with --bind |
| First check | The Connection line in Online Play | Running, signed in, reachable over UDP |
Both cases share one rule: the Hytale Server Manual says client and server "must be on the exact same protocol version". October's hotfixes also fixed joins to Windows-hosted worlds that timed out after 30 seconds (0.7.1) and joins that hung for 20 seconds and failed (0.7.3), per the hotfix notes. Restart the launcher on both sides before you change any network setting.
Fix it on a friend's world (share code)
To open a world, the host presses Esc while playing it, clicks Online Play, switches Allow Other Players to Join on and clicks Save. Hypixel's Joining Friends article says Hytale then finds a route with ICE, "the same standard that video calls use": it tests every pair of addresses at once, prefers the most direct route, and relays the traffic through a Hytale server when nothing direct works. That relay only works between Hytale friends. For anyone else, "Hytale can only use the addresses inside the share code".
Step 1: The host reads the Connection line
| Online Play says | What to do |
|---|---|
| Friends can join. | The host's network is fine. Go to step 2 |
| Friends outside your home need extra setup. | Try the join first, many succeed. If it fails, the detail line names the fix (step 4) |
| Only players on your home network can join. | Check the internet connection, the firewall (step 3) and a network block (step 5) |
| Your world is not open to friends. | Setup failed. Check the firewall (step 3) and try again |
Step 2: Be friends in Hytale and send a fresh code
Add each other as friends, then make a new code by saving the Online Play settings again. Hypixel calls adding each other "the single best thing you can do to make a join succeed". Codes also expire, so an old one fails even on a good network. The joiner goes to Servers, clicks Join via Code, pastes the code, enters the password if it isn't embedded and clicks Connect.
A share code contains the host's IP addresses, so send it privately, never in a public chat or on stream.
Step 3: Allow Hytale through Windows Firewall
Hypixel's fix for a firewall that blocks Hytale is to allow it "for both private and public networks". On the host's PC, open Windows Security, Firewall & network protection, Allow an app through firewall, Change settings, and tick Private and Public for each Hytale entry. If Hytale is missing, choose Allow another app and pick the game's program in the Client folder under %appdata%\Hytale\install\release\package\game\latest. An antivirus with its own firewall needs Hytale added as an exception too.
One trap: if someone clicked Cancel when Windows first asked about Hytale, Windows created block rules, and Microsoft's documentation says "explicit block rules take precedence over any conflicting allow rules". This PowerShell line lists them, including any for Java, which a dedicated server runs on:
Get-NetFirewallRule -Direction Inbound -Action Block | Where-Object DisplayName -match 'hytale|java|openjdk' | Format-Table DisplayName, Profile
Delete what it finds under Firewall & network protection, Advanced settings, Inbound Rules, start Hytale again and allow it when Windows asks.
Step 4: Fix the router problem the detail line names
| Detail line says | Fix |
|---|---|
| Your router does not forward ports | Forward the UDP port the screen names to the host's PC, switch on UPnP so Hytale can do it, or use Tailscale |
| Your router blocks friends from joining (symmetric NAT) | Forward the named port or use Tailscale. Otherwise Hytale relays between friends, with slightly higher ping |
| Your connection goes through two routers | Forward the port on both routers, switch on UPnP on both, or put the provider's box in bridge mode |
| Your internet provider shares one IP among many homes (CGNAT) | Port forwarding cannot work. Use Tailscale or ask your provider for a public IP |
| Your router opened a port, but the game found no public IP | Check the internet connection, or use Tailscale |
Don't forward 5520 by habit. Hypixel says to read the port from the Online Play screen, and the example share code in its article uses port 52102. Forward that UDP port to the host PC's local IP address, then save the Online Play settings again.
To check for CGNAT, compare the WAN address in your router's admin panel with what a "what is my IP" search shows: if they differ, you are behind CGNAT. A WAN address from 100.64.0.0 to 100.127.255.255 gives it away too, since RFC 6598 reserves that block for carrier-grade NAT.
Step 5: Rule out a network that blocks Hytale
Some workplace, school and public Wi-Fi networks block the traffic Hytale needs, and no setting on your side fixes that. Join once from a phone hotspot: if that works and home or work doesn't, the network is the block. If you run that network, allow outbound UDP on port 3478, which Hytale uses to coordinate friend connections.
Still failing?
- Click Copy Network Report in Online Play on the host's PC. Hypixel says it "names the exact cause", and it contains no IP addresses, so it is safe to post or send to Player Support.
- Install Tailscale on both PCs and sign in, and have the host save Online Play again for a new code. Hytale adds the Tailscale route itself and only uses it when a normal connection fails.
- Swap roles. One network often allows what the other doesn't, so Hypixel suggests letting the friend host. Your worlds are under
Savesin the User Data folder (launcher settings cog, Open Directory, User Data).
Fix it on a dedicated server (UDP 5520)
As a player, check the address and port first. Hytale doesn't support SRV records yet, so a domain name cannot carry a port: if the server isn't on 5520, type the port too. If nobody else can join either, the owner works through the checks below. Mobile data on your side should be fine: the manual says players behind carrier-grade NAT "should connect fine as clients".
1. Is the server running and listening?
Once the server has finished starting, check the UDP port. On Linux:
sudo ss -ulpn | grep 5520
In PowerShell on Windows:
Get-NetUDPEndpoint -LocalPort 5520
No result means nothing listens there: the server didn't start, crashed, or uses another port. The default bind is 0.0.0.0:5520, every IPv4 address of the machine, while a bind to 127.0.0.1 only takes connections from the machine itself. The manual changes the port with --bind, as in java -jar HytaleServer.jar --assets Assets.zip --bind 3500. On an older Linux system, run ldd --version too: the server's QUIC networking library needs glibc 2.28 or newer, down from 2.38 before hotfix 0.7.3.
2. Is the server signed in?
"Once authenticated, your server can accept player connections," says the manual. Run /auth status in the console. If the server isn't signed in, run /auth login device, open accounts.hytale.com/device, enter the code and wait for the console to report success with Mode: OAUTH_DEVICE. Hypixel's authentication guide shows the startup message of a server whose sign-in failed:
Token validation failed. Server starting unauthenticated.
Use /auth login to authenticate.
If the server loses its sign-in at every restart, /auth persistence shows how it stores credentials, and /auth persistence Encrypted switches to encrypted storage instead of Memory. A server that was off for more than 30 days has to sign in again.
3. Is UDP 5520 open in the firewall?
"Hytale uses the QUIC protocol over UDP (not TCP)", so a TCP rule does nothing. The manual's commands for Windows (PowerShell as administrator), ufw and iptables:
New-NetFirewallRule -DisplayName "Hytale Server" -Direction Inbound -Protocol UDP -LocalPort 5520 -Action Allow
sudo ufw allow 5520/udp
sudo iptables -A INPUT -p udp --dport 5520 -j ACCEPT
Without -Profile, the Windows rule covers every network profile, but a Java block rule from a cancelled prompt still wins (step 3 above). With firewalld, the first line opens the port now and the second keeps it after a reload or reboot:
sudo firewall-cmd --add-port=5520/udp
sudo firewall-cmd --permanent --add-port=5520/udp
Changed the port with --bind? Open that one instead. On a VPS, check your provider's network firewall too, if it has one.
4. Is UDP 5520 forwarded on your router?
At home, the manual says to "forward UDP port 5520 (or your custom port) to your server machine. TCP forwarding is not required." Find the server's local IP with ipconfig on Windows or ip -4 addr on Linux, and reserve that address in the router so the forward keeps pointing at the right machine. Players in your home use the local IP, everyone else your public IP. Test from outside, such as a phone hotspot: from inside, a join through your own public address only works if the router supports NAT loopback.
The manual warns that symmetric NAT "may cause issues" and suggests a VPS or dedicated server, and behind CGNAT no forward reaches you, so outside players can't join a server at home. Our Hytale hosting runs the server in a data center instead, in nine regions, with DDoS protection on every plan and full access to the server files.
5. Do server and players run the same build?
"When we release an update, servers must update immediately or players on the new version cannot connect," says the manual. Run /update status to see the server's version and /update check to look for a newer one, and have players restart the launcher. Update 8 has been on the pre-release patchline since 22 October, so ask anyone who switched to it to go back to release before joining a release server. The Chapter I server guide covers updating step by step.
On a rented server
Use the exact address and port your host gives you, which may not be 5520, and still check the sign-in (check 2) and the build (check 5) in the console. If the server is one of ours, our support team answers from 08:00 to 20:00 UTC on live chat, Discord and email.
FAQ
What port does Hytale use?
A dedicated server uses UDP port 5520 by default, over QUIC, and --bind changes it. TCP isn't used. A world you open to friends from the game uses the port its Online Play screen names.
Do I need to port forward to play Hytale with friends? Usually not with a share code: Hytale sets up the connection itself, uses UPnP when the router allows it, and relays between friends when no direct route works. Forward a port only when a join fails and Online Play names one. A dedicated server at home does need UDP 5520 forwarded.
Why can my friend join me but I can't join them? The host's network decides whether others get in, and theirs blocks you while yours lets them in. Have them follow their Connection line, or keep hosting yourself, as Hypixel suggests.
Can I host a Hytale server behind CGNAT? Not one that players reach by address, because no forwarded port reaches you. Share code joins can still work through Hytale's relay between friends or Tailscale. For a dedicated server, ask your provider for a public IP or rent one.
Should I turn off Windows Firewall to fix it? No. Allow Hytale on private and public networks, or add the manual's UDP rule for a dedicated server. Microsoft prefers allowed apps over open ports because "an allowed app opens the required ports only when needed", and a firewall that is off protects nothing on the PC.
Sources
All opened on 1 November 2026:
- Hypixel Studios support: Hytale Server Manual (updated 12 October 2026), Joining Friends (updated 12 October 2026), Server Provider Authentication Guide, How to Find Your Hytale Logs
- Hytale patch notes: Update 6, Update 6 hotfixes, Chapter I: Out of the Breach, Update 7 hotfixes, Update 8 pre-release notes
- Microsoft: Windows Firewall rules, Risks of allowing apps through Windows Firewall, New-NetFirewallRule, Get-NetFirewallRule, Get-NetUDPEndpoint
- Linux: ss(8), firewalld: open a port or service
- IETF: RFC 6598, Shared Address Space for carrier-grade NAT