NetherNet (Minecraft Bedrock)

For years, a Bedrock client simply knocked on a UDP port. With NetherNet, it rings the doorbell over HTTP first and only then walks in through WebRTC.

The short answer

NetherNet is Minecraft Bedrock's peer-to-peer networking transport layer built on WebRTC [1]. Before a player joins, the client asks the server over HTTP(S) whether it supports NetherNet and exchanges connection details with it, a step called signaling; the game itself then runs over WebRTC data channels [1][2]. Open Collaboration, the organization behind Geyser, writes that Bedrock 26.60, planned for 27 October 2026, stops connecting over the old RakNet transport, so every Bedrock server has to support NetherNet [2]. Our assessment: if you run a Bedrock or Geyser server, update before that date and make sure TCP reaches it, not just UDP.

How it works

1. Capability check. The client first calls GET /v1/join on the server. A 2xx answer means NetherNet is supported, and the JSON body carries the server name, protocol, game version, level name and player counts [1].
2. One request for the handshake. The client then sends its complete WebRTC offer, a Session Description Protocol (SDP) text with all network candidates, as a single POST /v1/join/{networkId}. Trickle ICE is disabled, there is exactly one request per attempt, and the client does not retry on failure [1].
3. Game traffic over WebRTC. After the answer arrives, client and host test network paths directly and open data channels secured with DTLS. The signaling server is only involved in that first exchange [1].
4. Identity both ways. The client's offer carries an assertion of the signed-in player's identity. The server's answer carries a long-lived operator identity, and the client pins that key on first connection and checks it every time after that (trust on first use) [1]. Since 26.50, the dedicated server has a serveridentity command to save, delete and check its identity key [3].
5. New port needs. According to Open Collaboration, signaling means a server must expose an additional TCP port and provide a TLS certificate. With its NetherNet External Signaling standard, an outside provider handles signaling, and the game server only needs a reachable UDP port [2].
6. The timeline. According to Open Collaboration, Mojang has been rolling out NetherNet since 26.40 [2]. The 26.40 changelog describes the client probing a dedicated server for NetherNet support with a three-second timeout and fixes a bug so that this limit applies to the whole connection attempt [4]. In 26.50 NetherNet became the default transport of the Bedrock Dedicated Server [3]. Geyser has supported NetherNet since build 1237 [2].
7. One port per player. Open Collaboration notes that the Bedrock Dedicated Server currently needs a separate port for each player, because Google's default WebRTC implementation handles one connection per IP address and port; their library multiplexes all players onto one UDP port [2].

A practical example

You host a crossplay server at home and want to know whether NetherNet signaling is reachable. From a device outside your network, ask the endpoint that a Bedrock client calls first [1]:

curl http://<server-address>:<port>/v1/join

A NetherNet server answers with a 2xx status and JSON [1]. A timeout usually means TCP does not reach the server, so check the router and firewall rules for TCP as well as UDP. Which port you use depends on your server software; take it from its documentation. This is a generic walk-through, not a test on our own server.

Checklist

• Update Bedrock Dedicated Server to 26.50 or newer, where NetherNet is the default [3].
• Update Geyser to build 1237 or newer [2].
• Forward and allow TCP for signaling next to UDP for game traffic [2].
• Test /v1/join from outside your own network [1].
• Back up the server identity key so returning players are not asked to trust a new key [1][3].
• Leave STUN and TURN servers out of HTTP signaling, as Mojang recommends [1].