Skip to main content
OrynCloud Logo
OrynCloudDOCS
Connections & CrossplayNetwork Architecture

NetherNet Port Configuration (28273 & 25573)

A comprehensive reference explaining the separation between TCP signaling and UDP media streams, Pterodactyl allocation management, and DDoS mitigation rules for Minecraft Bedrock 26.60.

1. Port Separation Architecture

Unlike legacy RakNet where all data flowed over a single UDP socket, the NetherNet transport stack decouples session control negotiation from real-time gameplay streaming.

Bedrock 26.60 Client FlowNetherNet Transport
1. TCP HandshakeSignaling Port: 28273
2. ICE CandidatesPublic IP & Symmetric NAT
3. UDP Media StreamWebRTC Port: 25573

2. TCP Signaling vs UDP WebRTC

Signaling Port (TCP 28273)

  • Initial connection handshake.
  • Xbox Live token validation.
  • Exchanges SDP (Session Description Protocol) offer & answer.
  • Entered by players into the Bedrock client.

WebRTC Port (UDP 25573)

  • High-speed peer media channel.
  • Transmits entity movements, physics, and world chunks.
  • Zero ACK latency for jitter reduction.
  • Assigned dynamically via signaling; never typed manually.

3. Pterodactyl Port Allocation

To assign ports on OrynCloud:

  1. Log into the OrynCloud Game Panel.
  2. Select your server and navigate to Network in the sidebar.
  3. Note your Primary Allocation (e.g. 25565).
  4. Click Create Allocation to request an additional secondary port (e.g. 28273).
  5. Open plugins/Geyser-Spigot/config.yml and assign the ports to signaling.port and bedrock.port.

4. Firewall & Anti-DDoS Mitigation

If you run a custom VPS or dedicated server, ensure your UFW / iptables rules permit both protocols:

Ubuntu / Debian UFW Setup
# Allow TCP Signaling port
sudo ufw allow 28273/tcp comment "Minecraft Bedrock NetherNet Signaling"

# Allow UDP WebRTC media port
sudo ufw allow 25573/udp comment "Minecraft Bedrock WebRTC Media Stream"

# Reload firewall
sudo ufw reload

OrynCloud Hardware DDoS Protection

All OrynCloud nodes feature automated 12+ Tbps stateful DDoS filtering that monitors both TCP SYN floods on port 28273 and UDP amplification floods on port 25573 simultaneously without dropping active player sessions.

5. Pre-Flight Checklist

Geyser updated to build 1237 or newer.
signaling.enabled is set to true in config.yml.
TCP signaling port and UDP WebRTC port are different port numbers.
Players enter the TCP Signaling Port in their Bedrock client.
Was this documentation page helpful?
Previous
Minecraft Bedrock 26.60 NetherNet Setup
Next
Pterodactyl Panel v2 Complete Guide