[{"data":1,"prerenderedAt":986},["ShallowReactive",2],{"\u002Fguides\u002Fnethernet-https-ios-ipados\u002F":3,"guides:en":797,"published-guide-paths":956},{"id":4,"title":5,"author":6,"body":7,"category":756,"date":757,"description":758,"excerpt":759,"extension":760,"faq":761,"featured":771,"featuredOrder":759,"indexOrder":772,"localeGroup":773,"meta":774,"navigation":775,"path":776,"primaryTool":777,"published":775,"related":778,"seo":782,"slug":773,"sources":783,"stem":795,"updated":757,"__hash__":796},"guides\u002Fguides\u002F29.nethernet-https-ios-ipados.md","NetherNet on iPhone and iPad: HTTPS for BDS and Geyser","setupmc.com Team",{"type":8,"value":9,"toc":738},"minimark",[10,15,43,56,78,82,85,128,131,141,144,152,177,180,184,251,258,262,274,285,288,292,299,307,316,320,331,337,346,354,368,379,383,394,401,407,421,428,434,444,454,458,463,471,474,477,483,486,490,498,507,531,535,547,562,565,569,572,578,600,670,677,681,686],[11,12,14],"h2",{"id":13},"windows-joins-but-your-iphone-or-ipad-cannot-connect","Windows joins, but your iPhone or iPad cannot connect",[16,17,18,19,23,24,27,28,31,32,37,38,42],"p",{},"Record the full error, client version, server build and whether the test uses Wi-Fi, mobile data or VPN. ",[20,21,22],"code",{},"InitialConnection-13",", ",[20,25,26],{},"Door"," and ",[20,29,30],{},"NetherNet"," alone do not identify a certificate problem. First check the setup for ",[33,34,36],"a",{"href":35},"\u002Fguides\u002Fnethernet-bedrock-server\u002F","vanilla BDS"," or ",[33,39,41],{"href":40},"\u002Fguides\u002Fnethernet-geyser\u002F","Geyser",".",[16,44,45,49,50,42],{},[46,47,48],"strong",{},"Documented:"," NetherNet separates HTTP\u002FHTTPS signaling from UDP gameplay. TLS protects signaling; it does not replace the UDP path. Mojang documents HTTP signaling, so do not assume that all iOS and iPadOS versions universally require HTTPS. See the ",[33,51,55],{"href":52,"rel":53},"https:\u002F\u002Fmojang.github.io\u002Fbedrock-protocol-docs\u002Fguides\u002Fnether-net-onboarding-guide\u002F",[54],"nofollow","protocol guide",[16,57,58,61,62,67,68,73,74,77],{},[46,59,60],{},"Reported workaround:"," In ",[33,63,66],{"href":64,"rel":65},"https:\u002F\u002Fbugs.mojang.com\u002Fbrowse\u002FBDS-23108",[54],"BDS-23108",", an iOS 26.52 client failed against BDS 1.26.52.3 over direct HTTP, then joined through HTTPS with the gameplay endpoint unchanged. The test also changed the signaling hostname and path, so it did not isolate the root cause. ",[33,69,72],{"href":70,"rel":71},"https:\u002F\u002Fgithub.com\u002Fitzg\u002Fdocker-minecraft-bedrock-server\u002Fissues\u002F680",[54],"itzg #680",", still open on ",[46,75,76],{},"29 October 2026",", reports TLS alert 40 on ARM64\u002FBox64 with BDS 1.26.51.1 and iOS 26.51. These reports do not prove the same defect affects every 26.60 client.",[11,79,81],{"id":80},"find-your-public-ip-without-renting-a-server","Find your public IP without renting a server",[16,83,84],{},"If Minecraft runs on your PC or NAS at home, you do not need a rented server to have a public IP: your internet connection determines that. If you only want to play on someone else's server, ask its operator for the join address; you do not need your own IP.",[86,87,88,102,125],"ol",{},[89,90,91,92,95,96,101],"li",{},"On a device on the ",[46,93,94],{},"same home network as the Minecraft machine",", open ",[33,97,100],{"href":98,"rel":99},"https:\u002F\u002Fapi.ipify.org",[54],"ipify's IPv4 display",". Do not use a VPN\u002Fproxy exit or mobile hotspot for this comparison. The result is the outgoing IPv4 seen by that service.",[89,103,104,105,108,109,112,113,116,117,120,121,124],{},"Compare it with the router's ",[46,106,107],{},"WAN\u002Finternet IPv4",". On a FRITZ!Box, look under ",[46,110,111],{},"Internet → Online Monitor",", then ",[46,114,115],{},"Connection Details"," depending on FRITZ!OS. Your PC's LAN address from ",[20,118,119],{},"ipconfig",", such as ",[20,122,123],{},"192.168.178.20",", is different.",[89,126,127],{},"If both match and the router address is public, use it for the IPv4 examples. Then configure the required TCP\u002FUDP forwarding and test a complete join from outside the network.",[16,129,130],{},"Alternatively, on Linux\u002FmacOS or in a shell with curl:",[132,133,139],"pre",{"className":134,"code":136,"language":137,"meta":138},[135],"language-bash","curl -4 --fail --max-time 10 https:\u002F\u002Fapi.ipify.org\n","bash","",[20,140,136],{"__ignoreMap":138},[16,142,143],{},"Windows PowerShell also supports:",[132,145,150],{"className":146,"code":148,"language":149,"meta":138},[147],"language-powershell","Invoke-RestMethod -Uri 'https:\u002F\u002Fapi.ipify.org'\n","powershell",[20,151,148],{"__ignoreMap":138},[16,153,154,157,158,161,162,23,165,27,168,171,172,42],{},[46,155,156],{},"Seeing an IP does not prove inbound reachability."," Different addresses can indicate another router, a VPN or provider NAT. A router WAN address in ",[20,159,160],{},"100.64.0.0–100.127.255.255"," indicates CGNAT; private ranges such as ",[20,163,164],{},"10.x.x.x",[20,166,167],{},"172.16.x.x–172.31.x.x",[20,169,170],{},"192.168.x.x"," are not public IPv4 addresses either. DS-Lite often lacks a dedicated public IPv4. Ask your provider about an address accepting inbound connections, or use a suitable tunnel\u002FIPv6 route. See the ",[33,173,176],{"href":174,"rel":175},"https:\u002F\u002Fuk.fritz.com\u002Fservice\u002Fknowledge-base\u002Fdok\u002FMyFRITZ-App\u002F1089_Identifying-the-address-range-of-the-IPv4-address-for-the-internet-connection\u002F",[54],"FRITZ! router diagnostic",[16,178,179],{},"When your public IP changes, update DNS\u002FDDNS and the advertised UDP address. A hostname alone does not update a literal IP in the server configuration. Another device's public IPv6 or the router's WAN IPv6 is not automatically the Minecraft machine's correct IPv6. With hosting or tunnels, use the provider's assigned endpoints instead of your home connection's IP.",[11,181,183],{"id":182},"choose-how-to-provide-https","Choose how to provide HTTPS",[185,186,187,203],"table",{},[188,189,190],"thead",{},[191,192,193,197,200],"tr",{},[194,195,196],"th",{},"Setup",[194,198,199],{},"Suitable approach",[194,201,202],{},"What remains necessary",[204,205,206,218,229,240],"tbody",{},[191,207,208,212,215],{},[209,210,211],"td",{},"Geyser with certificate files",[209,213,214],{},"Built-in HTTPS",[209,216,217],{},"Reachable gameplay UDP and certificate renewal",[191,219,220,223,226],{},[209,221,222],{},"Self-hosted Geyser or BDS",[209,224,225],{},"HTTPS reverse proxy in front of signaling",[209,227,228],{},"Correct upstream, certificate hostname and separate UDP route",[191,230,231,234,237],{},[209,232,233],{},"Geyser with Warden",[209,235,236],{},"External HTTPS signaling",[209,238,239],{},"Working gameplay connectivity; verify an actual join",[191,241,242,245,248],{},[209,243,244],{},"Private Tailscale group",[209,246,247],{},"Tailnet connectivity, optionally a ts.net certificate",[209,249,250],{},"Players need access to the tailnet and advertised gameplay destination",[16,252,253,254,257],{},"The examples below use a domain certificate: players enter ",[20,255,256],{},"play.example.com",", not the server IP. Point its DNS records at the HTTPS endpoint. Publish an AAAA record only if the IPv6 path works too.",[11,259,261],{"id":260},"what-caddy-does-here","What Caddy does here",[16,263,264,269,270,273],{},[33,265,268],{"href":266,"rel":267},"https:\u002F\u002Fcaddyserver.com\u002Fdocs\u002Fquick-starts\u002Freverse-proxy",[54],"Caddy"," is a web server used here as a ",[46,271,272],{},"reverse proxy",": it accepts the game's HTTPS request and forwards it internally over HTTP to Geyser or BDS. Clients still connect directly to the Minecraft server for UDP gameplay.",[16,275,276,277,280,281,284],{},"Caddy can obtain and renew the certificate for your hostname automatically. Your domain and certificate validation must be configured as described below. Install Caddy as a separate service on the server machine; players do not install anything extra. The ",[46,278,279],{},"Caddyfile"," is its configuration file, usually ",[20,282,283],{},"\u002Fetc\u002Fcaddy\u002FCaddyfile"," with a Linux package installation.",[16,286,287],{},"Choose one HTTPS approach: if you already have certificate files for Geyser, use the next section. To let Caddy manage certificates, follow the Caddy example for Geyser or BDS. If you use Geyser with Warden, Warden provides HTTPS signaling, so you do not need Caddy for that.",[11,289,291],{"id":290},"geyser-use-a-certificate-directly","Geyser: use a certificate directly",[16,293,294,295,298],{},"Merge this into the existing ",[20,296,297],{},"bedrock.signaling"," configuration, retaining the NetherNet transport and reachable UDP advertisement from the main guide:",[132,300,305],{"className":301,"code":303,"language":304,"meta":138},[302],"language-yaml","bedrock:\n  signaling:\n    mode: builtin\n    builtin:\n      https:\n        certificate: \u002Fpath\u002Fto\u002Ffullchain.pem\n        private-key: \u002Fpath\u002Fto\u002Fprivkey.pem\n        password: ''\n","yaml",[20,306,303],{"__ignoreMap":138},[16,308,309,310,315],{},"Obtain a trusted certificate for the hostname before setting these paths. The Geyser process must be able to read the chain and key; container paths must exist inside the container. Keep the private key private. Restart after configuring it, and arrange certificate renewal plus restart or certificate reload after renewal. See the ",[33,311,314],{"href":312,"rel":313},"https:\u002F\u002Fgeysermc.org\u002Fwiki\u002Fgeyser\u002Fnethernet-https\u002F",[54],"official Geyser HTTPS instructions"," for issuance and platform details.",[11,317,319],{"id":318},"geyser-put-caddy-in-front-of-http-signaling","Geyser: put Caddy in front of HTTP signaling",[16,321,322,323,326,327,330],{},"For Caddy and Geyser on the ",[46,324,325],{},"same host\u002Fnetwork namespace",", use public TCP 19132 for Caddy, private TCP 19133 for signaling and UDP 19132 for gameplay. Replace ",[20,328,329],{},"YOUR_PUBLIC_IP"," before saving. Merge these settings into the existing file, preserving authentication:",[132,332,335],{"className":333,"code":334,"language":304,"meta":138},[302],"bedrock:\n  address: 0.0.0.0\n  port: 19133\n  clone-remote-port: false\n  transport: nethernet\n  webrtc-port: 19132\n  signaling:\n    mode: builtin\n    advertise-addresses:\n      - \"YOUR_PUBLIC_IP:19132\"\nadvanced:\n  bedrock:\n    signaling-trusted-proxies:\n      - 127.0.0.1\n",[20,336,334],{"__ignoreMap":138},[16,338,339,340,345],{},"Use this Caddyfile after ",[33,341,344],{"href":342,"rel":343},"https:\u002F\u002Fcaddyserver.com\u002Fdocs\u002Finstall",[54],"installing Caddy",":",[132,347,352],{"className":348,"code":350,"language":351,"meta":138},[349],"language-text","{\n    servers {\n        protocols h1 h2\n    }\n}\n\nplay.example.com:19132 {\n    reverse_proxy 127.0.0.1:19133\n}\n","text",[20,353,350],{"__ignoreMap":138},[16,355,356,357,360,361,364,365,42],{},"Keep TCP 19133 inaccessible externally. Leave Geyser's bind address at ",[20,358,359],{},"0.0.0.0","; restrict access through firewall rules or container publication. If Caddy runs in another container, ",[20,362,363],{},"127.0.0.1"," is not Geyser: use its service address and trust only the actual proxy source address. Do not trust every sender of ",[20,366,367],{},"X-Forwarded-For",[16,369,370,371,374,375,378],{},"Validate with ",[20,372,373],{},"caddy validate --config \u002Fetc\u002Fcaddy\u002FCaddyfile",", restart Geyser and reload Caddy using your service manager. Permit public TCP 19132 and gameplay UDP 19132. The ",[20,376,377],{},"protocols h1 h2"," setting prevents HTTP\u002F3 from competing for gameplay UDP on that port. Certificate issuance\u002Frenewal also needs a working ACME challenge: make TCP 80 reachable for the HTTP challenge, or configure a supported DNS challenge. DNS validation does not create a gameplay route through CGNAT.",[11,380,382],{"id":381},"bds-https-proxy-with-a-separate-udp-range","BDS: HTTPS proxy with a separate UDP range",[16,384,385,386,389,390,393],{},"For BDS, use the ",[33,387,388],{"href":35},"BDS configuration"," with ",[20,391,392],{},"transport=nethernet",", internal signaling TCP 19132 and a reachable advertised UDP range, for example 19140–19149 for ten connections.",[16,395,396,397,400],{},"For ",[46,398,399],{},"Caddy running on the Docker host",", publish BDS signaling only on host loopback and retain the gameplay publications in the existing BDS Compose service:",[132,402,405],{"className":403,"code":404,"language":304,"meta":138},[302],"ports:\n  - \"127.0.0.1:19132:19132\u002Ftcp\"\n  - \"19140-19149:19140-19149\u002Fudp\"\n",[20,406,404],{"__ignoreMap":138},[16,408,409,410,27,413,416,417,420],{},"Keep ",[20,411,412],{},"SERVER_UDP_PORTS: \"YOUR_PUBLIC_IP:19140-19149:19140-19149\"",[20,414,415],{},"MAX_PLAYERS: \"10\""," in that service, replacing the IP. Preserve the data volume. Recreate the service after changing publications with ",[20,418,419],{},"docker compose up -d bds",", using your actual service name.",[16,422,423,424,427],{},"Use this ",[46,425,426],{},"alternative"," Caddyfile, not the preceding Geyser block:",[132,429,432],{"className":430,"code":431,"language":351,"meta":138},[349],"play.example.com:443 {\n    reverse_proxy 127.0.0.1:19132\n}\n",[20,433,431],{"__ignoreMap":138},[16,435,436,437,439,440,443],{},"Players add ",[20,438,256],{}," with port ",[46,441,442],{},"443",". Allow\u002Fforward TCP 443 to Caddy and UDP 19140–19149 to BDS, plus the challenge path required for certificate renewal. The HTTPS port and gameplay ports do not need to match. For native BDS, restrict access to its upstream TCP listener with the host firewall. If Caddy is containerized, adapt the upstream network instead of using host loopback.",[16,445,446,447,27,450,453],{},"This topology applies HTTPS termination to signaling. It does not rewrite SDP\u002FICE candidates or relay gameplay: if BDS advertises an unreachable address, fix the BDS advertisement and UDP mappings. Forward both ",[20,448,449],{},"GET \u002Fv1\u002Fjoin",[20,451,452],{},"POST \u002Fv1\u002Fjoin\u002F{networkId}"," with bodies intact, without browser login, CAPTCHA or redirects.",[11,455,457],{"id":456},"warden-cloud-playitgg-and-tailscale","Warden Cloud, playit.gg and Tailscale",[459,460,462],"h3",{"id":461},"warden-cloud-https-signaling-for-geyser","Warden Cloud: HTTPS signaling for Geyser",[16,464,465,470],{},[33,466,469],{"href":467,"rel":468},"https:\u002F\u002Fwarden.cloud\u002F",[54],"Warden Cloud"," is an external service for the initial contact between Bedrock and Geyser. Geyser registers with it; players enter the assigned Warden address in Minecraft and need no extra app. Warden provides and renews the HTTPS certificate.",[16,472,473],{},"Gameplay then connects directly to the Geyser server. Warden does not tunnel this traffic or hide the server IP. UDP port forwarding is preferred; assisted connections through NAT can help without forwarding, depending on both networks. Test a full join. For vanilla BDS, use the HTTPS proxy from the preceding section.",[16,475,476],{},"For Geyser, merge this into the existing configuration:",[132,478,481],{"className":479,"code":480,"language":304,"meta":138},[302],"bedrock:\n  transport: nethernet\n  signaling:\n    mode: nxs\n",[20,482,480],{"__ignoreMap":138},[16,484,485],{},"Keep your UDP settings. Fully restart and use the Warden hostname and port printed in the console, commonly 443. Successful registration alone does not prove a successful game connection; test from the actual player network.",[459,487,489],{"id":488},"playitgg-a-public-tunnel-to-your-home-server","playit.gg: a public tunnel to your home server",[16,491,492,497],{},[33,493,496],{"href":494,"rel":495},"https:\u002F\u002Fplayit.gg\u002F",[54],"playit.gg"," forwards connections from a public address to your Minecraft machine. Install the playit agent on the server machine; players need no extra app. This is an option when you cannot forward ports on your router.",[16,499,500,501,506],{},"Choose a tunnel covering the required TCP and UDP paths. Geyser needs one gameplay UDP port; BDS needs its configured UDP range. A plain TCP\u002FUDP tunnel does not provide an HTTPS certificate. The ",[33,502,505],{"href":503,"rel":504},"https:\u002F\u002Fplayit.gg\u002Fsupport\u002Fhttps-tunnel\u002F",[54],"HTTPS tunnel guide"," describes local TLS termination with Caddy and requires Premium. The playit website currently lists NetherNet as a Premium feature too. Check the appropriate tunnel type and plan before setting up.",[16,508,509,510,515,516,519,520,523,524,527,528,42],{},"The older ",[33,511,514],{"href":512,"rel":513},"https:\u002F\u002Fplayit.gg\u002Fsupport\u002Fminecraft-bedrock-nethernet\u002F",[54],"Bedrock instructions"," still recommend switching back to RakNet. This does not work for clients from 26.60 onward. With Geyser, you can combine Warden for HTTPS signaling and a suitable playit UDP tunnel for gameplay. Set ",[20,517,518],{},"bedrock.signaling.advertise-addresses"," to the public UDP hostname or IP and external port assigned by playit. The local tunnel destination must match Geyser’s ",[20,521,522],{},"webrtc-port","; with ",[20,525,526],{},"webrtc-port: 0",", this is ",[20,529,530],{},"bedrock.port",[459,532,534],{"id":533},"tailscale-a-private-network-for-your-player-group","Tailscale: a private network for your player group",[16,536,537,542,543,546],{},[33,538,541],{"href":539,"rel":540},"https:\u002F\u002Ftailscale.com\u002Fdocs\u002Fconcepts\u002Fwhat-is-tailscale",[54],"Tailscale"," connects devices through a private VPN network called a ",[46,544,545],{},"tailnet",". In the simple setup, both the server operator and players install Tailscale on their devices and receive access to that network. This suits a fixed group on supported devices; it does not give the server a public join address for arbitrary players.",[16,548,549,550,557,558,561],{},"Players use a reachable Tailscale address of the server machine. The UDP address advertised by NetherNet must also be reachable through that network. VPN encryption does not replace an HTTPS certificate: ",[33,551,554],{"href":552,"rel":553},"https:\u002F\u002Ftailscale.com\u002Fdocs\u002Fhow-to\u002Fset-up-https-certificates",[54],[20,555,556],{},"tailscale cert"," can obtain one for the machine's full ",[20,559,560],{},"*.ts.net"," name. If you install the files in Geyser yourself, arrange renewal and certificate reloads.",[16,563,564],{},"If joining works through Tailscale but fails through the public address, compare both network paths. The successful VPN test alone does not identify whether TLS or routing caused the public connection failure.",[11,566,568],{"id":567},"test-the-certificate-signaling-and-game-in-order","Test the certificate, signaling and game in order",[16,570,571],{},"From outside the server network, test the actual player hostname and port:",[132,573,576],{"className":574,"code":575,"language":137,"meta":138},[135],"curl --fail --max-time 10 https:\u002F\u002Fplay.example.com:443\u002Fv1\u002Fjoin\nopenssl s_client -connect play.example.com:443 -servername play.example.com -verify_hostname play.example.com -verify_return_error \u003C\u002Fdev\u002Fnull\n",[20,577,575],{"__ignoreMap":138},[16,579,580,581,584,585,587,588,590,591,594,595,599],{},"For Geyser’s built-in HTTPS and the Geyser\u002FCaddy example, use ",[20,582,583],{},"19132"," instead of ",[20,586,442],{},". For Warden, use its assigned hostname and port; for the BDS\u002FCaddy example, use your hostname with port ",[20,589,442],{},". Do not bypass certificate verification with ",[20,592,593],{},"curl -k"," as proof that TLS works. Then use the ",[33,596,598],{"href":597},"\u002Fbedrock-connection-test\u002F","connection test"," and make a full Minecraft join on the affected iPhone or iPad. Compare the same client over mobile data and Wi-Fi, then another platform. For BDS, also test a second simultaneous player.",[185,601,602,612],{},[188,603,604],{},[191,605,606,609],{},[194,607,608],{},"Symptom",[194,610,611],{},"Next check \u002F evidence",[204,613,614,622,630,638,646,654,662],{},[191,615,616,619],{},[209,617,618],{},"Certificate name mismatch or untrusted issuer",[209,620,621],{},"Player hostname, complete chain, validity and DNS target",[191,623,624,627],{},[209,625,626],{},"HTTP browser test works but iOS join never reaches signaling",[209,628,629],{},"Compare TLS logs and the hostname used",[191,631,632,635],{},[209,633,634],{},"HTTPS returns HTML, redirect, 404 or authentication screen",[209,636,637],{},"Reverse-proxy route and any access layer in front of the signaling paths",[191,639,640,643],{},[209,641,642],{},"GET succeeds but joining fails",[209,644,645],{},"Check the join POST and server logs, then gameplay UDP; GET alone is insufficient",[191,647,648,651],{},[209,649,650],{},"Server listed, join times out",[209,652,653],{},"Advertised ICE address, full UDP path and any HTTP\u002F3 port conflict",[191,655,656,659],{},[209,657,658],{},"Only the second BDS player fails",[209,660,661],{},"UDP range capacity and forwarding for every allocated port",[191,663,664,667],{},[209,665,666],{},"Geyser cannot start HTTPS after renewal",[209,668,669],{},"File paths, permissions, key\u002Fchain match, password and application reload",[16,671,672,673,676],{},"For Geyser-specific HTTP 500, native-library and data-channel errors, see the ",[33,674,675],{"href":40},"versioned troubleshooting reports",". Keep your existing world and identity files while diagnosing network failures.",[11,678,680],{"id":679},"sources","Sources",[16,682,683,684,42],{},"Sources checked: ",[46,685,76],{},[687,688,689,695,701,707,713,719,725,731],"ul",{},[89,690,691],{},[33,692,694],{"href":312,"rel":693},[54],"Geyser HTTPS setup",[89,696,697],{},[33,698,700],{"href":52,"rel":699},[54],"Mojang signaling protocol",[89,702,703],{},[33,704,706],{"href":64,"rel":705},[54],"BDS-23108: reports and HTTPS comparison",[89,708,709],{},[33,710,712],{"href":70,"rel":711},[54],"itzg #680: ARM64\u002FBox64 and iOS TLS report",[89,714,715],{},[33,716,718],{"href":467,"rel":717},[54],"Warden integration",[89,720,721],{},[33,722,724],{"href":503,"rel":723},[54],"playit HTTPS tunnel",[89,726,727],{},[33,728,730],{"href":552,"rel":729},[54],"Tailscale certificates",[89,732,733],{},[33,734,737],{"href":735,"rel":736},"https:\u002F\u002Fwww.ipify.org\u002F",[54],"ipify API documentation",{"title":138,"searchDepth":739,"depth":739,"links":740},2,[741,742,743,744,745,746,747,748,754,755],{"id":13,"depth":739,"text":14},{"id":80,"depth":739,"text":81},{"id":182,"depth":739,"text":183},{"id":260,"depth":739,"text":261},{"id":290,"depth":739,"text":291},{"id":318,"depth":739,"text":319},{"id":381,"depth":739,"text":382},{"id":456,"depth":739,"text":457,"children":749},[750,752,753],{"id":461,"depth":751,"text":462},3,{"id":488,"depth":751,"text":489},{"id":533,"depth":751,"text":534},{"id":567,"depth":739,"text":568},{"id":679,"depth":739,"text":680},"networking","2026-10-29","Fix NetherNet issues on iOS and iPadOS: set up HTTPS for BDS or Geyser and choose between Warden Cloud, playit.gg and Tailscale.",null,"md",[762,765,768],{"question":763,"answer":764},"Does NetherNet always require HTTPS on iOS and iPadOS?","A universal requirement is not confirmed. Reports on iOS Bedrock 26.51\u002F26.52 describe failed signaling and successful HTTPS workarounds. Retest your current client and server versions.",{"question":766,"answer":767},"Does Warden provide a certificate for vanilla BDS?","Warden provides HTTPS external signaling for its documented Geyser integration. This is not a documented drop-in integration for vanilla BDS.",{"question":769,"answer":770},"Does Tailscale generate HTTPS certificates?","Yes. tailscale cert can obtain a certificate for the machine's full ts.net name. This alone does not make the server publicly reachable.",false,8,"nethernet-https-ios-ipados",{},true,"\u002Fguides\u002Fnethernet-https-ios-ipados","bedrock-connection-test",[779,780,781],"nethernet-bedrock-server","nethernet-geyser","geyser-floodgate-crossplay",{"title":5,"description":758},[784,785,786,788,790,792,793],{"title":694,"url":312},{"title":700,"url":52},{"title":787,"url":64},"BDS connection reports",{"title":789,"url":70},"itzg ARM64 and iOS report",{"title":791,"url":467},"Warden",{"title":724,"url":503},{"title":794,"url":552},"Tailscale HTTPS certificates","guides\u002F29.nethernet-https-ios-ipados","-j_8rZraNk1ojM7tOzoSFqqejCcTfkbcTIZg-SJG4Nk",[798,799,804,808,815,821,826,831,838,844,849,854,859,864,870,875,881,886,891,896,902,908,914,920,926,932,938,944,950],{"path":776,"title":5,"description":758,"excerpt":759,"author":6,"date":757,"category":756,"localeGroup":773},{"path":800,"title":801,"description":802,"excerpt":759,"author":6,"date":803,"category":756,"localeGroup":779},"\u002Fguides\u002Fnethernet-bedrock-server","Fix NetherNet connections on your Bedrock server","Friends cannot join after an update? Check the new port rules and the address they can reach.","2026-10-13",{"path":805,"title":806,"description":807,"excerpt":759,"author":6,"date":803,"category":756,"localeGroup":780},"\u002Fguides\u002Fnethernet-geyser","Set up NetherNet on your Geyser server","Set up the newer connection method for Bedrock players and find out why joins fail.",{"path":809,"title":810,"description":811,"excerpt":759,"author":6,"date":812,"category":813,"localeGroup":814},"\u002Fguides\u002Fvelocity-proxy-docker-compose-itzg-mc-proxy","Set up Velocity and Paper with Docker Compose","Connect your proxy and server while keeping Paper ports isolated from the internet.","2026-08-01","getting-started","velocity-proxy-docker-compose",{"path":816,"title":817,"description":818,"excerpt":759,"author":6,"date":812,"category":819,"localeGroup":820},"\u002Fguides\u002Fvelocity-modern-forwarding-paper-docker","Configure Velocity modern forwarding with Paper","Match forwarding settings, protect the shared secret, and block direct backend access.","security","velocity-modern-forwarding-paper",{"path":822,"title":823,"description":824,"excerpt":759,"author":6,"date":812,"category":756,"localeGroup":825},"\u002Fguides\u002Fvelocity-proxy-cannot-connect-backend-docker","Velocity cannot reach Paper: check the Docker connection","Check container state, the shared network, service name, and backend port.","velocity-backend-unreachable-docker",{"path":827,"title":828,"description":829,"excerpt":759,"author":6,"date":812,"category":756,"localeGroup":830},"\u002Fguides\u002Fgeyser-floodgate-velocity-proxy-docker","Set up Geyser and Floodgate on Velocity with Docker","Install Geyser on the proxy, configure NetherNet, and check Bedrock player authentication.","geyser-floodgate-velocity-proxy",{"path":832,"title":833,"description":834,"excerpt":759,"author":6,"date":835,"category":836,"localeGroup":837},"\u002Fguides\u002Fupdate-minecraft-server-docker-compose-rollback","Update and roll back Minecraft with Docker Compose","Back up configuration and data before updating, then restore both together if you need to roll back.","2026-07-18","docker-operations","docker-minecraft-update-rollback",{"path":839,"title":840,"description":841,"excerpt":759,"author":6,"date":835,"category":842,"localeGroup":843},"\u002Fguides\u002Finstall-paper-plugins-docker-compose","Install Paper plugins with Docker Compose","Install plugins from a source directory or Modrinth and test updates before using them.","mods-plugins","paper-plugins-docker-compose",{"path":845,"title":846,"description":847,"excerpt":759,"author":6,"date":835,"category":842,"localeGroup":848},"\u002Fguides\u002Fmodrinth-modpack-itzg-minecraft-server-docker","Run Modrinth modpacks with Docker Compose","Pin the pack version and Java runtime, then match the server and client before the first start.","modrinth-modpack-docker",{"path":850,"title":851,"description":852,"excerpt":759,"author":6,"date":835,"category":836,"localeGroup":853},"\u002Fguides\u002Fmigrate-existing-minecraft-server-to-docker","Move an existing Minecraft server to Docker","Transfer your world, configuration, and extensions while keeping the original server available for rollback.","migrate-minecraft-server-to-docker",{"path":855,"title":856,"description":857,"excerpt":759,"author":6,"date":835,"category":836,"localeGroup":858},"\u002Fguides\u002Fminecraft-container-keeps-restarting-docker-compose","Find why your Minecraft container keeps restarting","Capture the container state and first startup error before interrupting the restart loop.","docker-minecraft-restart-loop",{"path":860,"title":861,"description":862,"excerpt":759,"author":6,"date":835,"category":842,"localeGroup":863},"\u002Fguides\u002Fcurseforge-modpack-itzg-minecraft-server-docker","Run CurseForge modpacks with Docker Compose","Configure AUTO_CURSEFORGE, pin the pack file, and handle the API key and manual downloads.","curseforge-modpack-docker",{"path":865,"title":866,"description":867,"excerpt":759,"author":6,"date":835,"category":868,"localeGroup":869},"\u002Fguides\u002Fminecraft-docker-exit-code-137-oomkilled","Minecraft exit code 137: check OOMKilled and memory limits","Exit code 137 means SIGKILL. Check OOMKilled, Java heap, and container limits to identify memory exhaustion.","performance","minecraft-docker-exit-137-oom",{"path":871,"title":872,"description":873,"excerpt":759,"author":6,"date":835,"category":819,"localeGroup":874},"\u002Fguides\u002Fsecure-minecraft-server-docker-compose","Secure a Minecraft server in Docker","Configure authentication, the whitelist, RCON access, file permissions, and published ports.","minecraft-docker-security-hardening",{"path":876,"title":877,"description":878,"excerpt":759,"author":6,"date":835,"category":879,"localeGroup":880},"\u002Fguides\u002Fset-up-automatic-minecraft-backups-docker-mc-backup","Set up automatic Minecraft backups with itzg\u002Fmc-backup","Add a backup container, set retention periods, and verify the resulting archives.","backups","docker-mc-backup-setup",{"path":882,"title":883,"description":884,"excerpt":759,"author":6,"date":835,"category":879,"localeGroup":885},"\u002Fguides\u002Frestore-minecraft-world-backup-docker","Restore a Minecraft world from a Docker backup","Stop the server, preserve the current data, and restore the selected backup.","docker-minecraft-restore-runbook",{"path":887,"title":888,"description":889,"excerpt":759,"author":6,"date":835,"category":879,"localeGroup":890},"\u002Fguides\u002Fhetzner-snapshots-minecraft-world-volumes","Hetzner snapshots and Minecraft data on volumes","Hetzner snapshots exclude attached volumes. Check where your world is stored and back it up separately.","hetzner-snapshots-volumes",{"path":892,"title":893,"description":894,"excerpt":759,"author":6,"date":895,"category":756,"localeGroup":781},"\u002Fguides\u002Fminecraft-crossplay-geyser-floodgate","Set up Geyser and Floodgate on Paper","Let Bedrock players join a Java server: install the plugins, configure NetherNet, and test the connection.","2026-04-04",{"path":897,"title":898,"description":899,"excerpt":759,"author":6,"date":900,"category":813,"localeGroup":901},"\u002Fguides\u002Fpaper-vs-vanilla-vs-fabric-vs-forge","Paper vs Fabric: Which Minecraft server should you choose?","Paper for plugins or Fabric for mods? Compare compatibility, performance and Vanilla behavior, then build your Minecraft Docker Compose file.","2026-04-03","minecraft-server-software-choice",{"path":903,"title":904,"description":905,"excerpt":759,"author":6,"date":906,"category":868,"localeGroup":907},"\u002Fguides\u002Fpaper-view-distance-vs-simulation-distance","Configure view distance and simulation distance in Paper","Compare viewing distance and active simulation, then measure their effect on server load.","2026-04-02","paper-view-distance-simulation-distance",{"path":909,"title":910,"description":911,"excerpt":759,"author":6,"date":912,"category":868,"localeGroup":913},"\u002Fguides\u002Fspark-profiler-paper-docker","Investigate lag with Spark Profiler in Paper and Docker","Record a profile while lag occurs and identify costly plugins, tasks, and server activity.","2026-04-01","spark-profiler-paper-docker",{"path":915,"title":916,"description":917,"excerpt":759,"author":6,"date":918,"category":868,"localeGroup":919},"\u002Fguides\u002Fminecraft-server-lag-tps-mspt-cant-keep-up","Investigate Minecraft lag: TPS, MSPT, and “Can’t keep up”","Check tick times and investigate CPU, chunk, entity, and plugin problems.","2026-03-31","minecraft-lag-tps-mspt",{"path":921,"title":922,"description":923,"excerpt":759,"author":6,"date":924,"category":836,"localeGroup":925},"\u002Fguides\u002Ffix-permission-denied-itzg-docker-minecraft-server","Fix permission denied errors for Minecraft in Docker","Match data-directory ownership to the container UID and GID.","2026-03-09","itzg-permission-denied",{"path":927,"title":928,"description":929,"excerpt":759,"author":6,"date":930,"category":836,"localeGroup":931},"\u002Fguides\u002Fadminister-docker-minecraft-server-rcon-console","Manage Minecraft in Docker with RCON and the console","Run server commands, manage the whitelist, and stop the server without exposing RCON publicly.","2026-03-08","docker-minecraft-rcon-console",{"path":933,"title":934,"description":935,"excerpt":759,"author":6,"date":936,"category":756,"localeGroup":937},"\u002Fguides\u002Fminecraft-domain-without-port-srv-record","Set up a Minecraft domain without a port using SRV","Connect a domain to your Java server and check its SRV and A\u002FAAAA records.","2026-03-07","minecraft-srv-record-domain",{"path":939,"title":940,"description":941,"excerpt":759,"author":6,"date":942,"category":756,"localeGroup":943},"\u002Fguides\u002Fopen-port-25565-minecraft-server-hetzner-linux","Open Minecraft port 25565 on Hetzner and Linux","Check Docker port publishing and firewalls when your server runs but players cannot connect.","2026-03-05","open-port-25565-hetzner-linux",{"path":945,"title":946,"description":947,"excerpt":759,"author":6,"date":948,"category":813,"localeGroup":949},"\u002Fguides\u002Fdetermining-correct-java-version-for-operating-minecraft-server","Minecraft Java version: Java 25, 21, 17 and class-file errors","Find the Java version for your Minecraft server. Fix class-file errors 69.0, 65.0 and 61.0 and choose the right itzg Docker image tag.","2025-01-31","java-version-minecraft-server",{"path":951,"title":952,"description":953,"excerpt":759,"author":6,"date":954,"category":813,"localeGroup":955},"\u002Fguides\u002Fminecraft-server-with-docker-on-hetzner-cloud","Set up a Minecraft server on Hetzner with Docker Compose","Set up a Java server on Hetzner Cloud: Debian, SSH access, Docker Compose, and the first server start.","2025-01-28","hetzner-docker-setup",[957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,951,915,909,903,897,892,832,839,845,850,855,945,860,865,871,809,816,822,827,800,805,776,939,933,927,921,876,882,887],"\u002Fde\u002Fguides\u002Fminecraft-server-with-docker-on-hetzner-cloud","\u002Fde\u002Fguides\u002Fminecraft-server-lag-tps-mspt-cant-keep-up","\u002Fde\u002Fguides\u002Fspark-profiler-paper-docker","\u002Fde\u002Fguides\u002Fpaper-view-distance-vs-simulation-distance","\u002Fde\u002Fguides\u002Fpaper-vs-vanilla-vs-fabric-vs-forge","\u002Fde\u002Fguides\u002Fminecraft-crossplay-geyser-floodgate","\u002Fde\u002Fguides\u002Fupdate-minecraft-server-docker-compose-rollback","\u002Fde\u002Fguides\u002Finstall-paper-plugins-docker-compose","\u002Fde\u002Fguides\u002Fmodrinth-modpack-itzg-minecraft-server-docker","\u002Fde\u002Fguides\u002Fmigrate-existing-minecraft-server-to-docker","\u002Fde\u002Fguides\u002Fminecraft-container-keeps-restarting-docker-compose","\u002Fde\u002Fguides\u002Fdetermining-correct-java-version-for-operating-minecraft-server","\u002Fde\u002Fguides\u002Fcurseforge-modpack-itzg-minecraft-server-docker","\u002Fde\u002Fguides\u002Fminecraft-docker-exit-code-137-oomkilled","\u002Fde\u002Fguides\u002Fsecure-minecraft-server-docker-compose","\u002Fde\u002Fguides\u002Fvelocity-proxy-docker-compose-itzg-mc-proxy","\u002Fde\u002Fguides\u002Fvelocity-modern-forwarding-paper-docker","\u002Fde\u002Fguides\u002Fvelocity-proxy-cannot-connect-backend-docker","\u002Fde\u002Fguides\u002Fgeyser-floodgate-velocity-proxy-docker","\u002Fde\u002Fguides\u002Fnethernet-bedrock-server","\u002Fde\u002Fguides\u002Fnethernet-geyser","\u002Fde\u002Fguides\u002Fnethernet-https-ios-ipados","\u002Fde\u002Fguides\u002Fopen-port-25565-minecraft-server-hetzner-linux","\u002Fde\u002Fguides\u002Fminecraft-domain-without-port-srv-record","\u002Fde\u002Fguides\u002Fadminister-docker-minecraft-server-rcon-console","\u002Fde\u002Fguides\u002Ffix-permission-denied-itzg-docker-minecraft-server","\u002Fde\u002Fguides\u002Fset-up-automatic-minecraft-backups-docker-mc-backup","\u002Fde\u002Fguides\u002Frestore-minecraft-world-backup-docker","\u002Fde\u002Fguides\u002Fhetzner-snapshots-minecraft-world-volumes",1793280545878]