If your Bedrock server is up but friends get "Multiplayer Connection Failed" or simply cannot join since late October, NetherNet is almost always the reason. Bedrock 26.60, released on 27 October 2026, is the version where clients stopped connecting over RakNet, so a server still listening on the old setup looks online while nobody can get in. You need three things: an updated Bedrock Dedicated Server (BDS), the line transport=nethernet in server.properties, and TCP 19132 plus a separate UDP port range opened for gameplay.
Why old port rules stopped working
RakNet was the old Bedrock connection method and used a single UDP port. NetherNet works in two steps: the game first contacts the server over TCP for signalling (an introduction), and the server replies with an address and a UDP port for the actual game session. Mojang made NetherNet the default for BDS from 26.50 and calls RakNet deprecated. That is why a server with only UDP forwarded no longer works: the initial handshake never happens and the player just sees a generic connection error. Switching back to RakNet does not rescue current clients either.
The first step is updating the server program itself, because a Bedrock server does not update itself and a restart does not fetch a new build. In your host panel, make a backup, confirm under Startup that the version is set to latest, run the reinstall, and only then start the server. Your world, allowlist and player permissions stay in place, so this part is safe.
What to put in server.properties
In server.properties you want transport=nethernet, server-port=19132 (under NetherNet this is the TCP signalling port) and a server-udp-ports line for the gameplay ports. The syntax is [IP:]external:internal, for example YOUR_PUBLIC_IP:19140-19149:19140-19149 if you need port translation. The budget is simple: one TCP port plus one UDP port per player, so max-players=10 means ten UDP ports. Remember that the Bedrock file is not the Java file: there is no simulation-distance, and view-distance defaults to 32, so pasting Java values is a bad idea. On current BDS builds the allowlist is usually enabled by default.
Before inviting the whole group, test the signalling path from outside, for example with curl --fail --max-time 10 http://YOUR_IP:19132/v1/join. Then confirm that your router and firewall pass both protocol types, TCP and UDP — opening only one is not enough. A player joining for the first time sees a "trust this server" prompt; that is normal, not an error. There are limits too: console-style connector tools such as BedrockConnect are not all NetherNet-compatible yet, and Docker setups need the TRANSPORT and SERVER_UDP_PORTS environment variables.
Check the connection before inviting everyone
A short order that works: backup, update BDS to 26.60 or newer, transport=nethernet, server-port as the TCP signalling port, a UDP range sized to max-players, firewall and router rules for both protocols, a test request to /v1/join, and only then the invite. If the server runs but feels laggy afterwards, lower view-distance first for chunk loading and bandwidth, and tick-distance for CPU-bound stutter; Bedrock is a native program, so Java heap flags do not apply here.
Illustrations generated with AI. Sources: setupmc.com · cakehosting.net · www.gameserverkings.com · gameserverhosting.co.uk