Hytale firewall error
The firewall error means something between Hytale and the network refused to let traffic through. That "something" is one of three things, and this page walks them in the order they're actually the culprit.
What the error means
The full in-game message is usually: "Failed to connect to any available address. The host may be offline or behind a strict firewall." It means traffic between Hytale and the host never completed a path — blocked by software on your PC, security software, or the router. The game client reporting it when connecting to a server is the common case; server owners also hit it when players outside the local network can't reach their server.
Read the message literally
"Host may be offline or behind a strict firewall" puts two possibilities first for a reason: before fighting your own firewall, confirm the host's world is actually up — a dead host produces the identical error.
First check: Windows Defender Firewall
Windows asks "allow this app through the firewall?" the first time a program opens a network connection. Clicking cancel — or a popup appearing behind the game — creates the block.
- Open Windows Security → Firewall & network protection → Allow an app through firewall.
- Find the Hytale entries (there may be more than one, including Java-related entries).
- Tick both Private and Public networks for each.
- If no Hytale entry exists, use "Change settings → Allow another app" and add the game's executable directly.
- Relaunch the game and retry the connection.
Why both networks
If your current network is classified "Public" and you only allowed "Private", the block persists. This single checkbox is responsible for a remarkable share of "I allowed it and it still fails" reports.
After game updates
Updates can change the executable path or add components that need their own firewall rules — a firewall that "used to work" isn't proof of anything after a patch.
Second check: third-party antivirus
Security suites (Avast, Norton, Bitdefender and the like) run their own firewall on top of Windows'. If you have one, Windows Defender's rules aren't the ones in charge:
- Find the equivalent "application permissions" or "firewall rules" section in your suite.
- Allow the Hytale executable — for outbound, and inbound if you host.
- Some suites block specific ports rather than apps; check its blocked-connections log if the app rule looks fine.
Third check: the router (mainly for hosts)
Playing on servers needs no router changes. Hosting friend worlds and servers does:
- UPnP first. Hytale uses UPnP to open its port automatically. Log into your router's admin page, enable UPnP, restart the router, then regenerate the share code (Online Play → Save). This single step fixes many friend-join failures.
- Manual port forwarding when UPnP isn't available. The port Hytale uses is shown in the Online Play settings for your session — check it each time, because the game can assign different ports per session (the commonly cited default is 5520 UDP). Forward that UDP port to your PC's local IP; make sure the protocol is UDP, not TCP. Then regenerate the share code so the forwarded port is included in it.
- NAT type. A "Strict" NAT setting on the router blocks inbound players; setting NAT to Open (where the router exposes it) resolves it without disabling the firewall.
- Router-level firewalls. SPI firewall and strict NAT filtering are separate settings from forwarding — disabling SPI filtering is a legitimate fix, unlike disabling your PC's firewall.
CGNAT — the one you can't fix in the router
If port forwarding and UPnP both fail, your ISP may be running Carrier-Grade NAT: the router's WAN IP is a private-range address (10.x, 192.168.x, 172.16–31.x) or differs from your public IP. Inbound IPv4 connections then can't reach you at all. Workarounds: use IPv6 if your ISP provides it, have a different player host, use a peer-to-peer VPN like Tailscale (Hytale detects its virtual addresses and includes them as high-priority candidates in the share code), or move the world to a dedicated server.
Two things that look like firewall errors but aren't
- The server is down. A dead or misconfigured server produces a connection error on your end. Check the broader diagnosis on failed to connect to server.
- Version mismatch. An outdated client or server refuses the connection — verify both are current before fighting your firewall for an hour.
Which error text you're seeing matters
"Firewall error" is the community shorthand; the actual message narrows the cause considerably:
| Message shape | Most likely meaning |
|---|---|
| Blocked / refused by firewall (client-side wording) | Your machine's software firewall — the Windows Defender and antivirus sections above |
| Connection timed out | Traffic never reached the server: router filtering, NAT, or a dead server — the failed-to-connect checklist separates the three |
| Blocked only for outside players (host's view) | Port forwarding or router-level filtering — the router section below |
| Error appears after a game update | Version mismatch pretending to be a network problem — check versions before touching any firewall |
If none of that worked
- Temporarily disable the firewall as a test only, then retry. If it works with the firewall off, the problem is a rule you haven't found — re-enable immediately and keep hunting rather than playing unprotected.
- Test from a different network (mobile hotspot). If it works there, your PC's rules are clean and the problem is the local network.
- If you're the server owner, re-read your server guide checklist — the console output on boot tells you which side is failing.
Don't leave firewalls off
Disabling a firewall permanently to play is trading a five-minute fix for a real security problem. It's a diagnostic step, not a solution.
Related errors
- Failed to connect to server — the broader checklist when the firewall fix didn't end it.
- Multiplayer not working — version, NAT and invite problems that masquerade as firewall trouble.
- Server failed to boot — for hosts: when the problem is upstream of any connection attempt.
Spotted an error, or a patch changed something this page relies on? Report it on this page.