How to set up Geyser and Floodgate for Bedrock players

Geyser lets Bedrock players on phones, tablets, consoles and Windows join your Java server by translating between the two editions, and Floodgate lets them in without owning a Java account. Install both on your Paper server or on your Velocity proxy, set Geyser's transport to both, open the Bedrock port for TCP and UDP, and then check from outside your network that a Bedrock player can really get in.

That last step is the one most owners skip. Our pinger sends a Bedrock ping every minute to every crossplay listing that publishes a Bedrock address, and in the last 30 days 21 of the 93 listings that were playable on Java never answered one, while only 52 answered at least 90% of the time. When we wrote this on 18 October 2026, that was 94 listings, of which 20 never answered on Bedrock and 53 answered reliably. The owner of a broken crossplay setup usually has no idea, because nobody on Java notices.

One date matters right now. Bedrock 26.60 is planned for 27 October 2026, and from that version on, Bedrock clients stop connecting over RakNet, the transport Geyser still uses by default. GeyserMC's NetherNet notice is blunt about it: after that date, Bedrock players cannot join servers that have not made the switch. Every step below already includes the switch.

How Geyser and Floodgate work

Geyser sits between the Bedrock client and your Java server. It accepts the Bedrock connection, opens a Java connection on the player's behalf and translates everything in between: chunks, entities, inventories, chat, sounds. Your server sees one more Java client. Because Geyser imitates the current Java client, your server has to accept that version, which is Java 26.3 as of this writing. An older server needs ViaVersion installed so it accepts the newer client.

Floodgate solves the account problem. A Bedrock player has a Microsoft account and an Xbox gamertag, not a Java profile, so a normal online-mode server would turn them away. With Floodgate, Geyser vouches for the player using a shared key file called key.pem, and Floodgate admits them under a generated Java identity: the gamertag with a prefix (a dot by default, so .Steve) and a UUID built from their Xbox user ID, in the form 00000000-0000-0000-xxxx-xxxxxxxxxxxx.

A small aside: because that UUID comes from the Xbox user ID, a Bedrock player who renames their gamertag keeps their inventory and permissions. Plugins that store players by name will not be so forgiving.

What NetherNet changes

NetherNet is Bedrock's new transport, built on WebRTC. A client first sends a small web request over TCP asking how to connect, a step called signaling, and only then plays over UDP. Signaling also carries the MOTD and player count that the Bedrock server list shows. That is why a Bedrock port that only ever needed UDP now needs TCP as well, and why your server can vanish from players' Bedrock server list even while the game port is wide open. Clients from 26.40 on can use NetherNet, fully from 26.50, and from 26.60 they must. Geyser supports it from build 1237 onward, but RakNet is still its default.

Plugin, proxy or standalone: which install

On a network, Geyser goes on the proxy and nowhere else. Bedrock players connect to the proxy like everyone else, and the proxy moves them between backends.

Install on Paper

Checked against the GeyserMC docs for a Paper 26.3 server. Purpur and other Paper forks follow the same steps.

1. Check that the server accepts Java 26.3 clients. If it runs an older version, install ViaVersion first.

2. Download Geyser-Spigot and Floodgate-Spigot from geysermc.org/download, put both jars in plugins, start the server once so they create their folders, then stop it.

3. Open plugins/Geyser-Spigot/config.yml and set the Bedrock section:

   bedrock:
     address: 0.0.0.0
     port: 19132
     transport: both
     webrtc-port: 19134

4. In the same file, set auth-type: floodgate. It lives in the section about the Java server, which current builds call java: and older ones remote:.

5. Open the ports as described below, start the server and read the console. Geyser prints the ports it bound and names most NetherNet problems in plain words.

Why both and not nethernet? NetherNet alone is enough for current clients. both also lets in players still on 26.30 to 26.34, which only speak RakNet, serves 26.40 clients that still read the MOTD over RakNet, and keeps Geyser's RakNet listener running, which is what our Bedrock check talks to (more on that under checking from outside). The cost is one extra UDP port: webrtc-port must be free and must differ from port, and 19134 is only an example. GeyserMC's own advice is to switch to nethernet and close the RakNet port once 26.60 is out and your players have updated.

Install on Velocity

1. Make sure Velocity and every backend accept Java 26.3 clients. Geyser joins the proxy as a Java client of that version, and Velocity passes the version on, so one outdated backend without ViaVersion is a backend Bedrock players cannot reach.
2. Put Geyser-Velocity and Floodgate-Velocity in the proxy's plugins folder, start Velocity once, stop it.
3. Configure plugins/Geyser-Velocity/config.yml exactly as in the Paper example, including auth-type: floodgate.
4. Open the Bedrock ports on the proxy machine, not on the backends.
5. Keep modern forwarding as you already run it: player-info-forwarding-mode = "modern" in velocity.toml, and on each backend, proxies.velocity.enabled: true in config/paper-global.yml with the secret from Velocity's forwarding.secret file.

Geyser's own commands, such as /geyser version and /geyser dump, run on the proxy, so grant their permissions there, for example with LuckPerms for Velocity.

Floodgate on the backends

Floodgate only has to be on the proxy. Add it to the backends when a backend plugin needs the Floodgate API, for example to open native Bedrock forms or to check whether a player is on Bedrock.

1. Install Floodgate-Spigot on each backend.
2. In the proxy's Floodgate config, set send-floodgate-data: true.
3. Copy key.pem from the proxy's Floodgate folder into each backend's Floodgate folder.
4. Restart the backends, then the proxy.

Treat key.pem like a password. Anyone holding it can get past Java authentication for any Bedrock account on your server, so it never goes into a public repository, a support screenshot or a shared plugin pack.

Ports: 19132 over TCP and UDP, and your host

Bedrock's default port is 19132. With NetherNet and Geyser's built-in signaling, the Geyser port has to be open for both TCP and UDP, so it can no longer share a number with your Java port, which already holds TCP. With transport: both, the webrtc-port also needs UDP.

• Home router or VPS. Forward the Geyser port as TCP and UDP (many routers call this "Both"), and the webrtc-port as UDP. Then open the same ports in the operating system firewall. With ufw that is sudo ufw allow 19132 (both protocols) and sudo ufw allow 19134/udp.
• Docker. Publish each protocol explicitly: 19132:19132/tcp, 19132:19132/udp and 19134:19134/udp. A plain 19132:19132 publishes TCP only.
• Oracle Cloud. Open the ports in the cloud security list and in the instance's own firewall. Either one alone is not enough.
• OVH and SoYouStart. GeyserMC's port forwarding page notes that the GAME firewall's Bedrock rules do not handle NetherNet yet. Use the Other rule for the Geyser ports.
• Game hosts with one port. The old trick, clone-remote-port, reused your Java port number for Bedrock over UDP. It does not work with built-in signaling, because signaling needs TCP on that port and your Java server already holds it. Geyser then falls back on its own to Warden, a free external signaling service run by Ziax, the company behind CubeCraft. With Warden only UDP is needed on your side, but players join with the address and port Geyser prints in the console, unless you register a custom domain on Warden. Ask your host for a second port, or check whether the host already configures Geyser through startup flags.
• Tunnels. ngrok only tunnels TCP, so it cannot carry Bedrock play. GeyserMC's playit.gg guide was written for RakNet and points to playit's own NetherNet status page, so check that before you rely on a tunnel.

Custom ports go wrong more often in our data. Over the last 30 days, 6 of 18 listings on a non-default Bedrock port never answered a Bedrock ping, against 15 of 75 on 19132 (on 18 October 2026: 6 of 18, against 14 of 76). The sample is small, but a custom port is one more number to get right in two places.

Geyser's built-in signaling uses plain HTTP by default, so on first join Bedrock asks each player whether to trust the server. Pointing the certificate setting in the HTTPS part of Geyser's signaling config at a TLS certificate removes the prompt, and Warden handles HTTPS for you.

Floodgate names and your plugins

A Bedrock player called Steve arrives as .Steve, and that dot reaches every plugin you run.

• The prefix. It is the username-prefix setting in Floodgate's config, "." by default. Floodgate recommends a prefix without letters or numbers, so no Bedrock name can collide with a Java name. Avoid *: commands may then need the name in quotes.
• Spaces. Gamertags may contain spaces, Java names may not. With replace-spaces: true (the default), Cool Steve becomes .Cool_Steve.
• LuckPerms. Set allow-invalid-usernames: true in the LuckPerms config so names with a dot are accepted, or target players by UUID.
• Whitelist. /whitelist add asks Mojang for a Java profile and fails for Bedrock players. Use /fwhitelist add Steve instead (the prefix is optional) or the player's Floodgate UUID. The permission is floodgate.command.fwhitelist.
• "Failed to verify username" on Paper. Paper rejects names it considers invalid. Installing Floodgate on the backend mitigates it, and Floodgate's known-issues page gives the full fix: set perform-username-validation to false under unsupported-settings in config/paper-global.yml.
• Players with both editions. Global linking, on by default, lets a player link Java and Bedrock accounts once and arrive as their Java identity on every server that has it enabled.
• Votes. Votifier delivers a username, and reward plugins pay the online or offline player whose name matches. A Bedrock player has to vote as .Steve, not Steve, or the reward goes nowhere. Our vote form recognizes the common Floodgate prefixes, checks the name against Bedrock accounts and delivers it as typed. In the last 30 days, 6% of all votes on serverlist.net were for Bedrock names, and 97% of those carried the default dot (6% and 97% on 18 October 2026). If you changed the prefix, say so in your /vote message. The NuVotifier guide covers the rest of the vote path.

Bedrock players cannot click links in chat, a limit Geyser cannot fix. A vote message that only says "click here" does nothing for them. Print the vote address as plain text, short enough to type on a phone.

Check it from outside

Joining from your own phone on your own Wi-Fi proves very little, because the phone may reach the server over your local network and never touch the router rules you just wrote. Check like a stranger would.

1. Turn Wi-Fi off on a phone, add the server in Bedrock with the public address and port, and join over mobile data. The Bedrock joining guide shows the player side of this.

2. Run the Bedrock address and port through the server status tool, which checks it once from our side:

   Check a server right now

   JavaBedrockJava and Bedrock

   Server address

   The address players type in Multiplayer. Labels like IP: and spaces are cleaned up.

   Port optional

   Check nowPingingCheckedNot checked

   The answer shows up here as the row you would see in Multiplayer, with players, version and ping.

3. Add your server or edit your listing, switch on "Bedrock players can join too" and enter the Bedrock address and port. From then on our pinger checks the Bedrock port every minute, and the Bedrock mark on your listing and your place in the Bedrock server list come from those answers, not from the switch.

4. Repeat after every Geyser update and every Bedrock release. A Geyser build that is too old for a new Bedrock version is a common reason Bedrock players are suddenly locked out on an update day.

A note on how we check, since it affects what you see. Our Bedrock ping is the RakNet ping that Bedrock clients used before NetherNet. Geyser in both mode answers it, Geyser in nethernet mode does not. Until our check also speaks NetherNet, a server on nethernet alone shows as not answering on Bedrock here even when Bedrock players can join, so both is the setting that keeps your listing's Bedrock mark accurate for now. How we measure is on the methodology page.

Here is how listings split by platform right now:

• Java onlyNo Bedrock address on the listing367% of players
• Bedrock answersPublishes a Bedrock address that answered our Bedrock ping7290% of players
• Bedrock silentPublishes a Bedrock address that never answered213% of players

Of 129 servers that were playable, 72 also answered on Bedrock and 21 publish a Bedrock address that never answered.

Measured 19 Oct 2026, 22:55 UTCHow we measure

What Bedrock players will miss

Geyser cannot change the Bedrock client. GeyserMC keeps a current limitations page, and these are the items from it that most often matter on a typical server:

• Clickable chat links. They do not work on Bedrock, which hits vote links, store links and Discord invites.
• Left and right clicks in inventory menus. Bedrock cannot tell them apart, so chest GUIs that do different things on each click break. Floodgate forms are the Bedrock-native alternative.
• Custom enchantments do not display, and non-vanilla levels such as "Silk Touch 2" cannot be shown.
• Command arguments and tab completion work only for commands registered the modern (Brigadier) way.
• Glowing, and banners with more than six layers.

Two related limits are not on that page. Java resource packs do not load on Bedrock, so Geyser has to send a Bedrock pack instead, and custom items need a Geyser mapping before Bedrock players see them properly. The GeyserIntegratedPack that Geyser ships fixes a few gaps of its own, such as offhand animations and armor stand poses.

Combat also feels different. Bedrock has no attack cooldown of its own, so Geyser draws a stand-in indicator, on the crosshair by default (the cooldown-type option in the gameplay section, called show-cooldown in older configs), and touch players aim differently from mouse players. If your server is built around Java PvP timing, say so on your listing.

Advertise it right on your listing

A working Bedrock setup is wasted if players cannot see it or type it.

• Address and port in their own fields. Bedrock does not read SRV records, so players type the port by hand. Put the port in the port field, not after a colon in the address. If Geyser fell back to Warden, use the address Geyser prints. If Geyser used to share your Java port, your Bedrock port has changed, so update the listing and tell players to edit their saved server.
• Say what Bedrock players get. One or two lines in your description: the prefix they will see, which menus or minigames do not work on Bedrock, and how to vote with their name. The server description guide shows where that fits.
• Name the edition range. "Bedrock 26.50 and newer" tells a player more than "crossplay".
• Console players need more help. Phones and Windows can add any server, but Xbox, PlayStation and Switch players need third-party workarounds, so a Bedrock address alone does not reach them.

The player-side view of all this is in can Java and Bedrock players play together.

Troubleshooting table

When the table runs out, /geyser dump produces a debug report that GeyserMC's support asks for. Once Bedrock works, the next job is making sure votes from both editions land, which the NuVotifier setup guide walks through.