Architectural Overview
Unlike legacy Bedrock configurations where a single UDP port (typically 19132) handled discovery, authentication, and packet replication, the NetherNet framework separates connection establishment from gameplay transport:
- TCP Signaling: Handles HTTP session discovery, server list status ping (MOTD), and WebRTC ICE candidate exchange.
- UDP WebRTC: Carries real-time gameplay packets (chunk loading, entity movement, interactions) with high throughput and low packet serialization delay.
signaling.mode: builtin, two dedicated secondary ports are strongly recommended to prevent port collisions with Java's primary listener.
Understanding the Dual-Port Mechanism
In our recommended separate-port architecture, two secondary ports are assigned alongside the Java gameplay port:
1. Signaling Port (TCP)
Acts as the rendezvous server. When a player taps "Join Server" in Bedrock, the client opens a TCP socket to this port to perform session discovery and exchange WebRTC ICE candidates.
Example: node.azioncloud.com:25675 (TCP)
• Entered by Bedrock players in the server list.
2. WebRTC Port (UDP)
Transmits gameplay state, chunk transfers, entity movements, and voice/audio packets. This port is never typed directly by users in the Minecraft server list.
Example: node.azioncloud.com:25633 (UDP)
• Advertised dynamically to the client during TCP signaling.
25675 and 25633 are examples:
Every server is assigned unique port numbers by Pterodactyl. Check your actual port allocations in your Pterodactyl Panel → Network tab before configuring your plugins.
How to Allocate Secondary Ports on Pterodactyl
To inspect or request extra ports on your Azion Cloud server:
- Open your Pterodactyl Panel (dash.azioncloud.com).
- Select your Minecraft server.
- Click the Network tab on the left navigation bar.
- Inspect your assigned ports:
- The port marked Primary (e.g.
25565) is used by Java Edition. - You need two additional allocations: one for Bedrock TCP signaling (e.g.
25675) and one for Bedrock UDP WebRTC (e.g.25633).
- The port marked Primary (e.g.
- Click Create Allocation to instantly generate a secondary port, or open a ticket if your plan’s allocation limit has been reached.
How Docker & Wings Expose Ports
Pterodactyl’s daemon (Wings) automatically translates every allocated port into container port bindings in Docker:
- Wings instructs Docker to forward incoming traffic for both
TCPandUDPon every assigned allocation. - If an allocation has not been attached in the Network tab, Wings will not expose it to Docker, and any packets arriving at that port will be rejected at the host layer.
Firewall & Anti-DDoS Considerations
Azion Cloud’s 12+ Tbps Anti-DDoS shield operates at Layers 3, 4, and 7 to protect your game server:
- TCP Signaling (25675): Protected by TCP SYN-proxy and rate-limiting filters to prevent handshake exhaustion attacks and SYN floods.
- UDP WebRTC (25633): Filtered through our custom Game L7 scrubbing engine, inspecting UDP packet headers to drop malformed or amplified reflection attacks (e.g. NTP, DNS, Memcached).
play.yourdomain.com), create an SRV record pointing to the TCP Signaling Port (25675), not the UDP WebRTC port. Bedrock clients query the SRV record to find the TCP signaling service.
Need help assigning or routing your ports?
Our support team can allocate and bind your secondary ports in under 3 minutes.