Bedrock on Java servers: Geyser and NetherNet

Your Java server has run for months, and your friends on phones, tablets and Windows have been joining through Geyser the whole time. Then a Bedrock update changes how the game knocks on the door, and a setup that only ever opened UDP suddenly looks like a house without a doorbell.

The short answer

How do Bedrock players keep joining a Java server through Geyser after Bedrock 26.60? Update Geyser to a current build, set transport: nethernet in its config, and make the Geyser port reachable over TCP and UDP, not just UDP [1][2]. According to GeyserMC and Open Collaboration, Bedrock 26.60 is planned for 27 October 2026, and from that version on Bedrock clients stop connecting over RakNet, the old connection method (as of 25 Oct 2026) [1][9]. If you cannot open a TCP port, external signaling such as Warden needs only a reachable UDP port [1][9][12]. Geyser lets Bedrock players in at all; Floodgate also lets them join without a paid Java account [2][5].

What changes with NetherNet

Until now, a Bedrock client sent UDP packets straight to the server's address and port. That is RakNet, and it is why the classic Geyser setup could share one port number with Java: Java uses TCP, RakNet used UDP, and the two never collided [1][9].

NetherNet adds a step in front, called signaling. Before joining, the client sends an HTTP or HTTPS request over TCP and asks whether the server supports NetherNet. Mojang's onboarding guide spells it out: the client calls GET /v1/join, and only if the server answers with a success status does it send its connection offer with POST /v1/join/{networkId} [10]. The game itself then runs over WebRTC, the open standard browsers use for video calls, on UDP [9][10]. The MOTD and player count in the server list also come through signaling now [1].

Three consequences matter for you:

• Geyser needs a TCP port for signaling in addition to the UDP port for gameplay. By default, both use 19132 [1][2].
• The Geyser port can no longer be the Java server's port, because Java already uses TCP there. The clone-remote-port option, which many hosts relied on, only works with external signaling [1].
• Players who connect by IP address, or by a domain without HTTPS, see a "trust on first use" prompt on their first join [1][10].

Dates and versions (as of 25 Oct 2026)

We found no Mojang page that names 27 October as the end of RakNet. Mojang's 26.50 changelog only says that NetherNet is now the default transport for dedicated servers [11]. The date comes from GeyserMC and Open Collaboration, and both tie it to the 26.60 release: if the release moves, the date moves with it.

How it works: switching Geyser to NetherNet

1. Get the latest build. Download it from the GeyserMC download page. Any build from 1237 supports NetherNet, but GeyserMC recommends the newest one because later builds contain fixes [1].
2. Pick the file for your platform. Geyser-Spigot goes into plugins on Paper or Spigot, Geyser-Fabric into mods together with Fabric API, Geyser-NeoForge into mods, Geyser-Velocity or Geyser-BungeeCord onto the proxy only, and Geyser Standalone runs as a separate program next to the Java server [2]. Geyser imitates a Java 26.3 client: a Paper or Spigot server on an older version needs ViaVersion, and Geyser-Spigot itself needs at least 1.20.5 and Java 21. Below 1.20.5, GeyserMC points to a proxy, Geyser Standalone or ViaProxy instead. Geyser-Fabric and Geyser-NeoForge run only on a 26.3 server [2][3].
3. Switch the transport. Open the config (Paper: plugins/Geyser-Spigot/config.yml, Fabric: config/Geyser-Fabric/config.yml, NeoForge: config/Geyser-NeoForge/config.yml, Velocity: plugins/Geyser-Velocity/config.yml), find bedrock: and change these lines [2]:

bedrock:
  port: 19132
  transport: nethernet

4. Open TCP and UDP. Forward the Geyser port for both protocols, in the router and in the server's firewall. GeyserMC's setup guide puts it plainly: players use TCP to find your server and UDP to play on it, so without TCP your server will not show up [2]. No other program may use the port, neither a UDP voice chat mod or Query nor a TCP web map or website [2].
5. Restart and read the console. GeyserMC names typical messages. "Built-in signaling cannot use port … because the Java server already uses it" means Bedrock and Java share a port. "… is a loopback address" means address is set to 127.0.0.1 instead of 0.0.0.0 [1]. Since a change of 16 Oct 2026, Geyser logs an error with a link to the NetherNet post while NetherNet is off [8].
6. Test from outside your network. From a phone on mobile data, open http://YOUR-PUBLIC-IP:19132/v1/join. A NetherNet server answers that capability check with JSON that holds its name, version and player count [10]. Then join from a Bedrock client on 26.40 or newer, as GeyserMC suggests [1].

The transition: NetherNet and RakNet side by side

If some players still run versions older than 26.40, transport: both accepts both methods. They cannot share a UDP port, so NetherNet gets its own through webrtc-port, which you also open for UDP [1][2]:

bedrock:
  port: 19132
  webrtc-port: UDP_PORT
  transport: both

Replace UDP_PORT with a free port other than port [2]. GeyserMC's reasoning: NetherNet is fully supported from 26.50, while versions such as 26.40 still fetch the MOTD and player count over RakNet [2]. Once 26.60 is out and everyone has updated, switch to nethernet and close the old RakNet port [1]. GeyserMC also announced that support for 26.30 ends as soon as 26.60 support arrives [1].

At home, at a host, behind CGNAT

• At home with your own public IPv4 address: Java stays on its TCP port, 25565 by default. Geyser gets its own port, open for TCP and UDP. GeyserMC's port forwarding page still showed UDP-only commands when we retrieved it, and the setup guide now asks for both protocols [2][7]. Applied to the page's ufw example, that means two rules, our derivation from both pages: sudo ufw allow 19132/tcp and sudo ufw allow 19132/udp. In Docker, publish the port twice in the same way, as 19132:19132/tcp and 19132:19132/udp.
• At a hosting provider: ask for a second port that is open for TCP and UDP, or use external signaling [1]. If Geyser detects that the Java server already uses its port, it falls back to Warden by itself, and the console shows where players can join. Players then use that address instead of your Java address, unless you register a custom domain on Warden [1]. GeyserMC describes Warden as a free service run by Ziax, the company behind CubeCraft; Warden itself says it does not relay game traffic and does not hide your server's IP. It also calls itself in active development, intended mainly for personal servers, with no SLA and no uptime guarantee [1][12]. Hosts can preconfigure Geyser with startup properties such as -DgeyserTransport=nethernet [1]. GeyserMC has removed its list of "supported hosting providers"; a host missing from the new list does not mean Geyser fails there [1].
• Behind CGNAT or DS-Lite: your connection has no public IPv4 address of its own, so no forwarding rule reaches your server. External signaling saves you the TCP port, but the server still needs a UDP port that players can reach [9]. What remains is a tunnel or a VPS. GeyserMC names playit.gg and links a separate page for NetherNet on it; Ngrok does not work because it does not carry UDP [2].
• In containers or behind NAT: if the server does not hold its public address itself, -DgeyserAdvertiseAddresses tells players which address to use [1]. A change in Geyser's code of 20 Oct 2026 lets Geyser look up its public address via STUN and merges the two advertise-addresses lists into one, bedrock.signaling.advertise-addresses; existing configs are migrated automatically [8]. Guides written before that date may still show two separate lists.

Velocity or BungeeCord networks

Install Geyser only on the proxy. Floodgate can go on all servers, which helps with skins and makes the Floodgate API available network-wide [2]. Every server in the network must accept Java 26.3 clients, so backends on older versions need ViaVersion [2][3]. One gap remains: HAProxy headers work for RakNet and built-in signaling, but not yet for NetherNet gameplay over WebRTC; GeyserMC says that support will follow [1].

Floodgate

Floodgate lets Bedrock players join with their Bedrock account, without buying Java Edition. It runs on Spigot and Paper, BungeeCord, Velocity, and as a mod on Fabric [5]. NeoForge is not on that list (as of 25 Oct 2026) [5]. GeyserMC's NetherNet post names no separate Floodgate step, and the transport switch does not replace your authentication settings [1]. With Geyser Standalone, set auth-type to floodgate in its config and copy Floodgate's key.pem from the Java server into the Geyser Standalone folder. Never share that key: it lets Bedrock accounts skip Java authentication [15]. We do not recommend switching the Java server to offline mode; Floodgate is the intended route.

HTTPS and the trust prompt

Mojang's guide explains the prompt. Over HTTPS, the certificate is the trust anchor and the player never sees a dialog. Over plain HTTP, the client asks once per operator key and then accepts silently. The key is trusted, not the address, and a new key makes every returning player confirm again [10]. Geyser offers two ways to HTTPS: a certificate in its built-in signaling config, or a reverse proxy in front of the signaling port. Warden provides HTTPS as well [1]. Back up Geyser's whole config folder, so a reinstall does not hand your players a new key.

Console players

Minecraft on Xbox, PlayStation and Switch has no field for your own server. GeyserMC's wiki points to BedrockConnect, a third-party project that you reach by changing the console's DNS [6]. Its latest release, 1.71.0 from 15 Sep 2026, adds support for 26.50; no release mentions NetherNet or 26.60 (as of 25 Oct 2026) [13]. Whether the DNS route still works after 26.60 is unconfirmed. Tell console players before the update, so nobody is surprised on the day.

Still open (as of 25 Oct 2026)

• The 26.60 date is a plan, not a release [1][9].
• No Geyser build supports Bedrock 26.60 yet. The newest build stops at 26.52, so after the release you update Geyser a second time [3][4].
• Whether the build for 26.60 really makes NetherNet the default is announced, not shipped [9].
• The console route through BedrockConnect after 26.60 is unconfirmed [13].
• A single user comment on bug report BDS-23108 from 19 Oct 2026 describes an iPhone on 26.52 that failed to join a Bedrock Dedicated Server over plain HTTP and joined through HTTPS. The cause is not confirmed, and the test did not involve Geyser [14].
• With external signaling (NXS), the MOTD and player count update periodically instead of live [1].

A worked example

This is a plan, not a report from our systems. Assume Paper 26.3 on a mini PC at home, eight friends, three of them on phones, one on a Switch. Put Geyser-Spigot and Floodgate into plugins, set transport: nethernet with port 19132 and restart. In the router, forward 25565 TCP to the Java server and 19132 TCP and UDP to the same machine. Before that, check your connection: with DS-Lite or CGNAT, no forwarding rule helps, and a tunnel or a VPS takes its place. From a phone on mobile data, open http://YOUR-PUBLIC-IP:19132/v1/join and expect JSON, then join from Bedrock and confirm the trust prompt once. The phones work. For the Switch friend, the honest answer on 25 Oct 2026 is "unclear after 26.60", until BedrockConnect publishes a NetherNet release.

Checklist

• Download the latest Geyser build and make sure it is 1237 or newer.
• Set transport: nethernet under bedrock:, or both with its own webrtc-port during the transition.
• Give Geyser a port that the Java server does not use.
• Open that port for TCP and UDP in the router and the firewall, or ask your host for it.
• Read the console after the restart and fix every NetherNet warning.
• Test GET /v1/join and a real join from outside your network.
• Tell your players a new port, if Geyser used to share the Java port.
• Back up Geyser's config folder before you reinstall or move the server.
• Check the GeyserMC download page again on 27 Oct 2026 and update once a build supports 26.60.

Related pages: Hosting a Minecraft server at home; Running a Minecraft server on a VPS; What to look for in Minecraft server hosting; Port forwarding: what it is and how it works; Game server behind CGNAT or DS-Lite: 5 ways; Whitelist (Minecraft); TCP; Reverse proxy for a homelab.