Until 26.50, Bedrock players reached dedicated servers through RakNet. On October 27, 2026, Mojang released Minecraft Bedrock 26.60, whose changelog states that this transport is now deprecated. The official dedicated server, Bedrock Dedicated Server (BDS), now shows an error, rather than a simple warning, when it does not use NetherNet, the WebRTC-based transport that replaced it as the default.
Here is what it means for your server, whether on our game panel or a VPS.
RakNet, Bedrock's longtime transport
RakNet is a cross-platform C++ networking library built for games. It runs on UDP, a fast protocol with no delivery guarantee, and adds what UDP lacks, automatically resending lost packets and putting them back in order.
Published as open source under a BSD license, its code has not changed since its GitHub repository was archived on January 13, 2022.
In Minecraft, RakNet remained the default Bedrock Dedicated Server transport until 26.50. The whole connection then ran over UDP, by default on port 19132 for IPv4 and 19133 for IPv6.
From 26.50 to 26.60
Mojang carried out the transition over two releases.
| Version | Date | Change |
|---|---|---|
| 26.50 | September 15, 2026 | NetherNet becomes the default transport for dedicated servers, serveridentity command added |
| 26.60 | October 27, 2026 | RakNet is deprecated, the warning suggesting NetherNet becomes an error |
The transport setting in server.properties still accepts raknet, but nethernet is now the default. Mojang has published neither an official explanation for this change nor a timeline for removing RakNet.
NetherNet, a two-stage connection
Where RakNet only needed UDP, NetherNet needs both TCP and UDP, and the connection happens in two stages.
- Signaling. The game first contacts the server over HTTP, on its
server-portTCP port, to get its name, version and number of connected players. It then sends its connection request, and the server answers with what is needed to set up the link. - The game session. The game then opens a WebRTC connection that runs entirely over UDP, secured by a DTLS handshake. From that point on, signaling is no longer involved.
The server therefore has to be reachable over both TCP and UDP.
Signaling has another advantage. The server can reject an unauthorized player there, before the game session even opens.
Mojang's NetherNet guide adds two details. Without a valid answer to its first request, the game does not attempt the connection, and it sends only one request per attempt, with no retry. When it fails, it shows the Door error code.
To join a remote server, outside the local network, a player must always be signed in to their Xbox Live account.
The server identity key
NetherNet also gives each server an identity key. The game trusts this key, not the IP address or host name.
- With HTTP signaling, the game asks the player to confirm the key the first time it sees it.
- With HTTPS signaling, with a valid certificate, the game relies on the certificate and does not show this prompt.
Since BDS only handles HTTP signaling, your players will see this prompt on their first connection.
BDS reads its key from keys/server_identity_key.pem. If that file does not exist, it generates a key on the fly without saving it. The server then gets a new identity at every start, and your players have to accept the prompt every time.
| Command | Effect |
|---|---|
serveridentity save |
Saves the key currently in use |
serveridentity status |
Shows whether a saved key is available |
serveridentity delete |
Deletes the saved key, without changing the running identity |
You can also provide your own key, a P-384 (secp384r1) private key in unencrypted PEM format. If you run several servers, a shared key spares your players from confirming each one. However, any key change forces your players to accept it again.
On our game servers
On our Bedrock Dedicated Server game servers, NetherNet is already set up. Your server stays reachable on a single port, the one shown in the panel, and its identity key is kept automatically, so your players only accept it once. All you need are three steps.
- Update your server to 26.60 or newer with the MCBE Version Changer tool.
- Check the transport. In the Startup tab, the Transport variable must be set to
nethernet, its default. - Restart the server.
Do not change server-port, server-udp-ports or server-ip in server.properties. These settings are managed automatically.
The same applies to our PowerNukkitX and Altay servers. Use the port shown in the panel, without touching the network settings in pnx.yml or pocketmine.yml. If your players cannot connect, open a ticket and our team will handle it.
BDS on a VPS
On a VPS, configuring BDS is up to you.
| Property | Role |
|---|---|
transport |
nethernet (default) or raknet |
server-port |
TCP signaling port, on a dual-stack IPv6 and IPv4 socket when the system allows it |
server-portv6 |
Ignored with NetherNet |
server-ip |
Local listen address, empty for all interfaces |
server-udp-ports |
UDP gameplay ports, optionally with the address advertised to players |
In the server.properties shipped with 26.60, server-udp-ports is set to 19132. All players then share that UDP port, and port 19132 serves both signaling over TCP and the game session over UDP. If the line is missing or empty, BDS draws from the system's ephemeral port range.
You can also set a range. Connections are then spread over its ports, which are reused once the range is full.
server-udp-ports=19140-19149
Finally, you can set the address advertised to players, using the IP:public port:local port format. Both ports are mandatory, even when they are the same, and an IPv6 address goes in brackets ([IPv6]:public port:local port).
server-udp-ports=203.0.113.42:19132:19132
This format is mainly for servers behind NAT, such as a home router, whose local address cannot be reached from the Internet. A public IP assigned directly to the machine does not need to be set.
If your server.properties comes from an earlier version, check the server-udp-ports line. In 26.50 it was commented out by default and documented with a different syntax.
Once the ports are set, restart the server, then save its identity by typing serveridentity save in the BDS console, not in the VPS shell.
For an Internet-facing server, Mojang recommends putting a reverse proxy (nginx, HAProxy or a managed edge service) in front of server-port. It terminates connections, enforces request and rate limits, and absorbs abusive traffic. Only signaling goes through this proxy, UDP gameplay traffic stays direct.
PowerNukkitX 3.0.6
Among community server software, PowerNukkitX 3.0.6, released on October 28, 2026, is the first stable release compatible with 26.60. It is built on CloudburstMC's NetherNet network library and requires Java 21. RakNet is gone, along with the transport setting, and the old RakNet settings are automatically removed from pnx.yml during the update.
The NetherNet settings live in the network-settings > nethernet section of pnx.yml.
| Key | Role |
|---|---|
udpPort |
UDP gameplay port, 0 by default. A fixed port is shared by all players. A value equal to the server port is treated as 0 |
identityFile |
Identity key file, keys/identity.pem by default, generated on first start |
signalingMode |
builtin by default, or nxs, hybrid, plugin |
signalingPort |
TCP signaling port, 0 to use the server port |
The Query protocol, enabled by default (enableQuery), occupies the server's UDP port. With udpPort set to 0, each player therefore gets an ephemeral UDP port, and a console message asks you to set network-settings.nethernet.udpPort. On a VPS, set a udpPort distinct from the server port.
Unlike BDS, PowerNukkitX offers no command to manage the identity. Keep the key file, since any replacement would force your players to accept it again.
PocketMine-MP, no NetherNet
The official PocketMine-MP repository is archived, and its last release, 5.44.3 of July 6, 2026, does not support NetherNet. A server running official PocketMine-MP can therefore no longer accept players on current versions.
On our game panel, PocketMine-MP servers have already been migrated to Altay. On a VPS, back up your server and check your plugins' compatibility before switching to Altay. Our article "PocketMine-MP Shuts Down, What Alternatives for Your Bedrock Server?" covers this shutdown and the alternatives in detail.
Altay 5.45.1
Altay, a PocketMine-MP fork, has supported 26.60 since version 5.45.0, released October 27, 2026, NetherNet only and with no support for earlier game versions. Its developers strongly recommend 5.45.1, released on October 31, which brings several fixes and improvements.
- Authentication tokens whose audience is a list are no longer rejected with the "Invalid JWT audience" error.
- Signaling connections time out properly, and sessions are no longer interrupted while the player is loading.
- Gameplay traffic shares the server port by default, Query protocol included.
- IPv6 connections are supported when
enable-ipv6is on. - Performance is improved.
The NetherNet settings live in the network.nethernet block of pocketmine.yml.
| Key | Role |
|---|---|
udp-port |
0 (default) shares the server port, or gives each player its own port if that one is taken. -1 gives each player its own port. A value from 1 to 65535 sets one port shared by all |
udp-port-range |
Range in first-last format, at least 100 ports wide |
signalling-port |
TCP signaling port, 0 to use the server port |
advertise-addresses |
Reachable addresses advertised to players |
identity-domain |
Name shown in the trust prompt, the MOTD if empty |
The identity key is kept in the identity.key file, created on first start in the data folder. Changing identity-domain does not force players to accept the key again.
With require-identity set to auto, Altay rejects unsigned connections whenever Xbox authentication is on, which can block some local network clients. The configuration file then advises setting it to false.
NXS and Warden
With NXS (NetherNet External Signaling), signaling is no longer handled by the server itself but by an external provider. This open specification is maintained by CloudburstMC, and Mojang does not mention it in its documentation.
Warden, at warden.cloud, is the NXS provider configured by default in PowerNukkitX, Geyser and WaterdogPE. It is developed and operated by Ziax, the creators of CubeCraft. According to its website, it does not relay game traffic and does not hide the server's IP address. The service, in active development, primarily targets personal servers, with no SLA or uptime guarantee. For commercial use, contact Ziax.
| Software | Default signaling | NXS |
|---|---|---|
| Bedrock Dedicated Server | Built-in | Not supported |
| PowerNukkitX | Built-in | Optional, with Warden as the default provider. Requires a fixed UDP port, so a fixed udpPort when Query is on |
| Altay | Built-in | Not supported |
| Geyser | Built-in | As a plugin or mod, switches automatically to Warden when its port is already used by the Java server |
| WaterdogPE | Built-in | Optional, with Warden as the default provider |
STUN and TURN
STUN lets a machine discover its public address, and TURN relays traffic when no direct path exists. On the player side, the game uses neither, and BDS offers no STUN or TURN setting in server.properties.
PowerNukkitX, on the other hand, lets you declare them (ice-servers), and by default queries two public STUN servers to discover its address as soon as a fixed udpPort is set. Mojang nevertheless advises against declaring STUN or TURN servers with HTTP signaling, because each one then has to be contacted before the answer goes back to the player, which delays the connection.
Frequently asked questions
Why do my players get the Door error?
The NetherNet connection failed. Check that the server runs 26.60 or newer, that the transport is set to nethernet and that the server has been restarted. On a VPS, also check that the server port is reachable over TCP and the gameplay ports over UDP.
Why do my players have to accept the trust prompt after every restart?
On a VPS, BDS generates a new key at every start as long as none is saved. Type serveridentity save in the BDS console, then check with serveridentity status. On our game servers, the key is kept automatically.
What happens if BDS stays on RakNet?
Since 26.60, BDS shows an error when it does not use NetherNet. On our game servers, set the Transport variable back to nethernet. On a VPS, replace transport=raknet with transport=nethernet in server.properties. Then restart the server.
Is RakNet going away?
RakNet has been deprecated since 26.60, but Mojang has announced no removal date. Switching to NetherNet now keeps you from being caught off guard.
Can my PocketMine-MP server accept 26.60 players?
No, official PocketMine-MP does not support NetherNet. Switch your server to Altay.
Do I need an NXS provider such as Warden?
No. BDS, PowerNukkitX, Altay, Geyser and WaterdogPE all use their built-in signaling by default. Only Geyser, as a plugin or mod, switches to Warden on its own when its port is already used by the Java server.
If your server is still unreachable after these checks, open a ticket with the Technical department from your client area at billing.winheberg.com, select your server in the Related Product field, and attach a console excerpt.
Sources, the official Minecraft Bedrock 26.60 and 26.50 changelogs, Mojang's NetherNet guide, the documentation shipped with Bedrock Dedicated Server, the Microsoft Learn server.properties page, the RakNet repository, the PowerNukkitX 3.0.6 release, the Altay releases, the PocketMine-MP repository, the Geyser and WaterdogPE repositories, and the Warden website.
Enjoy the switch to NetherNet 🎮
