Fix NetherNet connections on your Bedrock server

Your Bedrock server runs, but friends cannot join

After an update, friends may get “Multiplayer Connection Failed” while your server runs. RakNet is the older connection method; NetherNet is the newer one. Official Bedrock Dedicated Server (BDS) changed its default to NetherNet in 26.50. Old UDP-only port rules can therefore stop working.

For your Java crossplay installation, use the Geyser NetherNet guide.

Checked on 12 October 2026: the official BDS download is 1.26.52.3. For NetherNet, Door or details such as InitialConnection-83, record the full message and client/server versions. Check TCP signaling first, then gameplay UDP and the allowlist. Follow those checks for similar failed joins. NetherNet is also a named multiplayer error.

Configure the server and its ports

An IP address identifies a network destination. Your server's LAN address works inside your home network, often starting with 192.168. or 10.. Its public address is what friends outside that network must reach. A port is a numbered connection endpoint. TCP and UDP are different traffic types: allowing one does not allow the other.

NetherNet joining has two steps:

1. The game contacts TCP 19132 for the introduction, called signaling. The server tells it an address and UDP port for gameplay.
2. The game connects to that UDP destination. This second path must work too. An open TCP port only helps with step one.

Back up your world and settings. Enter stop and wait for native BDS to exit before editing server.properties. Replace YOUR_PUBLIC_IP with your reachable public IP before saving; BDS does not fill this placeholder automatically:

transport=nethernet
server-port=19132
server-ip=
server-udp-ports=YOUR_PUBLIC_IP:19140-19149:19140-19149
max-players=10

Reserve one UDP port per simultaneous client connection, here ten for ten players.

On your router, forward TCP 19132 and UDP 19140-19149 to the server's LAN address. Also allow them in the host firewall. A router connects your home network to the internet; forwarding tells it where incoming traffic should go. On cloud hosting, check the provider firewall too.

The advertised address is the address the server tells players to use. The bind address is a local IP where the server listens. Leave server-ip empty for all local interfaces unless you need a specific local address. Do not bind to a public IP the machine does not own.

For LAN-only play, advertise a reachable LAN IP. On a directly reachable host, a range alone such as 19140-19149 may suffice. If your public address fails from your own Wi-Fi, test externally: some routers cannot access their public address from inside the same LAN, called NAT loopback.

Port translation: external comes first

NAT means a router or hosting network translates addresses and ports. The official BDS syntax is:

[IP:]external-port-or-range:internal-port-or-range

Replace YOUR_PUBLIC_IP with your public IP before using this translated mapping:

server-udp-ports=YOUR_PUBLIC_IP:20140-20149:19140-19149

BDS listens on 19140-19149 but tells players to reach 20140-20149. Set the router translation accordingly and use equal-length ranges. Separate multiple entries with commas. Put IPv6 addresses in brackets, such as [YOUR_PUBLIC_IPV6]:20140-20149:19140-19149.

After saving, start through your usual launcher, service or hosting panel. Preserve the existing world directory.

Docker: preserve your data and recreate the container

Import your existing Compose file into the Bedrock configurator, select NetherNet and your player count, then check and adjust the TCP/UDP publications before transferring the networking settings. Keep your service name and data volume. The image resolves <public_ip> automatically in this example:

services:
  bds:
    image: itzg/minecraft-bedrock-server:latest
    environment:
      EULA: "TRUE"
      VERSION: "1.26.52.3"
      TRANSPORT: nethernet
      SERVER_UDP_PORTS: "<public_ip>:19140-19149:19140-19149"
      MAX_PLAYERS: "10"
      ALLOW_LIST: "false"
    ports:
      - "19132:19132/tcp"
      - "19140-19149:19140-19149/udp"
    volumes:
      - ./data:/data
    stdin_open: true
    tty: true

Docker containers can have private addresses. For LAN-only hosting, use a LAN IP. Recheck the advertisement after public IP changes.

Changed Docker port publications require recreation:

docker compose config
docker compose up -d
docker compose logs --tail=100 bds

Keep the data volume; do not remove it to fix networking. For the translated example, publish 20140-20149:19140-19149/udp. Router forwarding and Docker mapping must ultimately deliver public UDP 20140-20149 to container UDP 19140-19149.

Check the allowlist too

Keep ALLOW_LIST: "false" if you want players outside a friends list to join. Current BDS enables the allowlist by default; check for an empty list when joins are rejected. For a private friends server, set ALLOW_LIST: "true" in Compose and apply it with docker compose up -d. For native BDS, stop the server, set allow-list=true in server.properties, and start it again. Only then add each actual Xbox gamertag in the running server console:

allowlist add "Your Friend"

With this Docker image:

docker compose exec bds send-command 'allowlist add "Your Friend"'

Test before changing more settings

Enter your public server address in the NetherNet connection test. It checks the initial contact and shows your next steps. Then test a full join with a Bedrock client from another network.

You can view the server name, version and player count in the Minecraft server status checker. Choose Bedrock to check a NetherNet server, then join in Minecraft to verify the game connection.

From another network, test the initial connection:

curl --fail --max-time 10 http://YOUR_PUBLIC_IP:19132/v1/join

For HTML or timeout, check signaling. For server JSON, join from an external Bedrock client, for example via a mobile hotspot. That also checks the join POST and gameplay UDP.

IPv4 and IPv6 are different address formats. BDS uses one dual-stack TCP listener when available; server-portv6 does not create a second NetherNet signaling port. Check IPv6 firewalls and any AAAA DNS record separately. BDS LAN discovery uses UDP 7551 broadcasts, which normally do not cross routers or Docker bridges. Try a manual server entry if the LAN list is empty.

CGNAT means the internet provider shares a public IP between customers. Your router's forwarding cannot by itself create public IPv4 access through that provider NAT. Ask for a reachable public address, test an independent IPv6 path, or use a service explicitly supporting the required TCP and UDP paths. Even with WebRTC, the technology behind NetherNet, test a join from outside your network.

Console connectors are an additional path to test. First try a directly configurable mobile or Windows Bedrock client. Test NetherNet with a real join instead of an old RakNet-only status checker. Treat switching back to RakNet as a transition.

What to ask your host, and what providers must allocate

Send your host: “I run BDS YOUR_SERVER_VERSION. Since 26.50, NetherNet is the default. I have 10 player slots. Please confirm TCP 19132 (or my allocated initial port), a fixed range of 10 UDP ports, and the public IP and external-to-internal mapping announced to players. Are panel or startup settings overriding these values?” Replace the version and player count with yours. Ask for the fixed range ahead of time, not new panel allocations per join.

Budget one TCP port plus N UDP ports for N simultaneous connections. For 20 players, reserve UDP 19140-19159. Across 100 instances with 20 player slots each, that means 2,000 reserved UDP ports. BDS selects within each range; reflect allocations in panels, firewalls and templates. Give each instance distinct allocations on a shared IP. If you have only one UDP port, ask for more or another supported arrangement.

Check panel allocation, container publication, node firewall and provider NAT together. Check whether legacy RakNet packet filters allow WebRTC traffic.

If you use an HTTP reverse proxy, configure it to protect signaling and forward GET /v1/join and POST /v1/join/{networkId} with their bodies intact. Route gameplay UDP separately and protect that traffic too. TLS encrypts the initial HTTP exchange; if you add it, check certificate trust, name and expiry. Pass the game response without browser login pages or CAPTCHAs.

Sources

Primary sources checked on 12 October 2026. Version and build references describe that review date.

• Minecraft Bedrock 26.50 changelog
• Official BDS 1.26.52.3 archive and networking documentation
• itzg Bedrock image networking documentation
• Mojang NetherNet HTTP signaling guide
• Minecraft named error codes