Connections and ports

Bedrock 1.26.60 clients (the version VanillaMine 5.48 supports) only join over NetherNet, the WebRTC transport of newer Bedrock versions. VanillaMine serves it next to RakNet, on the same port, with a small helper program (pm-nethernet) that ships in the phar and starts by itself.

Ports to open

Port	Protocol	What for
server-port (19132)	TCP	NetherNet signalling (HTTP or HTTPS).
server-port (19132)	UDP	NetherNet game data, RakNet and Query.
80 or 443	TCP	Only with HTTPS certificates from Let's Encrypt, while a certificate is issued or renewed.

Opening only UDP is the most common mistake: the server starts, appears in the list, and nobody can join. With nethernet-udp-port in server.properties the NetherNet game data moves to a UDP port of its own: open that one too.

Hosting panels (Pterodactyl and others) usually allocate a port for UDP and TCP at once; check the firewall of the host if they are separate.

The trust prompt

Over plain HTTP, the first time a player joins the client shows a one-time prompt to trust the server, and remembers its key (nethernet_identity.pem, created on the first start). Back the file up, and copy it to every server of a network so players are only asked once. network.nethernet.domain is the name shown in the prompt.

iOS players: HTTPS

iOS clients only try HTTPS for NetherNet signalling and refuse self-signed certificates (Mojang bugs BDS-23108 and BDS-23125; Bedrock Dedicated Server has the same problem). Without HTTPS, iPhone and iPad players cannot join. Windows and Android players join without it.

The easiest way is a free certificate from Let's Encrypt, which the server gets and renews by itself:

# pocketmine.yml
network:
  nethernet:
    https:
      acme-domains: "play.example.com"   # what players type in the server list (a public IP works too)
      acme-email: "you@example.com"       # optional: expiry notices

• The name must point to this server, and players must join with that name (or that IP).
• Let's Encrypt checks the name by connecting to port 80 or 443 of the server: one of them must be open and free while a certificate is issued or renewed (the server only listens on it for that moment). If your router forwards them to other ports, set acme-http-port / acme-tls-port.
• An IP address gets a short-lived certificate, renewed every few days.

You can also use your own certificate (https.certificate and https.private-key, PEM files, reloaded when they change). With a valid certificate nobody sees the trust prompt either.

Behind NAT

Clients are given the address they typed in the server list, so most servers need nothing else. If players join through an address the server can't see (some NAT setups), list the public IPs in network.nethernet.advertise-addresses.

Transfers between servers

/transferserver and Player::transfer() send the player to another address. Since 1.26.60 the client can only join over NetherNet, so the destination must accept NetherNet on that port (TCP and UDP): VanillaMine 5.48 or newer, or Bedrock Dedicated Server with transport=nethernet. Older PocketMine-MP servers and RakNet-only proxies make the transfer fail on the client, and iOS players need HTTPS on the destination too.

For a network of servers, VanillaGate keeps the player connected and moves them between servers without a client transfer.

Bandwidth and CPU

• network.compression-level (default 1 since 5.46) compresses in about half the time of level 6, for chunks ~10-12% bigger. Existing pocketmine.yml files keep the level they had.
• network.compression-thread compresses on a thread of its own. It is off by default: with it on, players noticed a small delay on their actions.

When players can't join

1. "Unable to connect" on every device: TCP server-port is not open (only UDP is).
2. Only iPhone/iPad can't join: no HTTPS, or players join with a name the certificate doesn't cover.
3. Players on another Bedrock version can't join: VanillaMine 5.48 only accepts Bedrock 1.26.60 (1.26.52 needs VanillaMine 5.47). "Unsupported transport" on the client means NetherNet is off (enable-nethernet).
4. Look at nethernet.log in the server folder (network.nethernet.log-level: debug for more detail).