Bedrock / Geyser issues

Bedrock behind Infinity-Filter needs five things to line up: a dedicated IP, Geyser backends on the right transport, the right Geyser config, the Geyser port open in TCP and UDP, and a Bedrock domain whose certificate is Active. Almost every issue comes from one of them.

For the setup itself, see Geyser (Bedrock). For domains and certificates, see Bedrock domains.

Quick check

Go through this list first — it fixes most cases:

• The Geyser (Bedrock) card on Network → Backends shows NetherNet.
• Geyser is a recent build (1280 or later) and its console shows Built-in signaling started on http://0.0.0.0:<port>.
• Geyser’s config has transport: nethernet, signaling.mode: builtin, advertise-addresses set to your dedicated IP with port 19132, and no HTTPS certificate.
• Geyser’s advanced.bedrock section has our IP list in haproxy-protocol-whitelisted-ips, and webrtc-proxy-protocol-relays / prefer-signaling-proxy-address match the NetherNet PROXY protocol (UDP) option on the Backends page (off: [] / true, on: our IP list / false).
• The Geyser port is not your Java server’s port, and is open in TCP and UDP.
• Your Bedrock domain is a CNAME to your dedicated IP hostname, DNS only (grey cloud on Cloudflare).
• The domain shows Active on Network → Domains → Bedrock domains.
• Players join with the domain, on port 19132.

Phones and tablets can’t join, PC works

Bedrock on iOS and Android only joins NetherNet servers over HTTPS, with a valid certificate for the exact name the player typed. Other platforms can fall back to an unencrypted connection, phones can’t. So when only mobile players fail, it’s almost always the certificate:

Nobody can join through NetherNet

When every platform fails, the problem is between Infinity-Filter and your Geyser server.

signaling.mode is not builtin

With nxs or hybrid, Geyser uses an external signaling service (Warden) that doesn’t go through Infinity-Filter, so players are blocked. Set it back to builtin:

bedrock:
  transport: nethernet
  signaling:
    mode: builtin

The transport doesn’t match

The Geyser (Bedrock) card must show NetherNet and Geyser must have transport: nethernet. Geyser 1280 removed the RakNet-only transport: a transport: raknet config is switched back to nethernet when Geyser starts. So a network still on RakNet on Infinity-Filter’s side stops working for Bedrock as soon as Geyser is updated — switch the network to NetherNet on its Backends page (see From RakNet to NetherNet). Don’t use transport: both behind Infinity-Filter — it needs separate UDP ports that Infinity-Filter doesn’t route.

The Geyser port isn’t open in TCP

NetherNet uses the Geyser port in TCP (handshake) and UDP (gameplay). If you only opened UDP (enough for RakNet), the handshake never reaches Geyser. Open both, ideally only from the Infinity-Filter IP ranges.

Geyser uses the same port as your Java server

The handshake needs the Geyser port in TCP, which your Java server already uses. Geyser then can’t start its built-in signaling and players are blocked. Give Geyser its own port (and update the Geyser backend in the panel). This is also why clone-remote-port doesn’t work with NetherNet.

Check Geyser’s console at startup: it must print Built-in signaling started on http://0.0.0.0:<port>. Messages like “Built-in signaling cannot use port … because the Java server already uses it” or “Built-in signaling could not start” mean the port is taken.

HTTPS is enabled in Geyser

If bedrock.signaling.builtin.https has a certificate, Geyser expects HTTPS while Infinity-Filter talks to it in plain HTTP: every join fails. Remove the certificate from Geyser’s config and restart. Infinity-Filter already serves the certificate of your Bedrock domains to the players.

Geyser doesn’t expect the PROXY protocol

Infinity-Filter adds the player’s real IP to the handshake with the PROXY protocol. On Geyser 1280 or later, listing our IPs in haproxy-protocol-whitelisted-ips is what makes Geyser expect it:

advanced:
  bedrock:
    haproxy-protocol-whitelisted-ips: ["https://www.infinity-filter.com/v4/"]
    webrtc-proxy-protocol-relays: []
    prefer-signaling-proxy-address: true

This is the config with the NetherNet PROXY protocol (UDP) option off (the default). advanced.bedrock.use-haproxy-protocol (old name: bedrock.enable-proxy-protocol) no longer exists since build 1280; Geyser migrates an old config by itself when you update.

Geyser and the NetherNet PROXY protocol (UDP) option don’t match

With relays listed in webrtc-proxy-protocol-relays, Geyser expects a PROXY protocol v2 header on every NetherNet UDP packet from them. So:

Any mismatch between Geyser and the option on Network → Backends, and Bedrock players can’t join. Change both at the same time and restart Geyser. See NetherNet PROXY protocol (UDP).

advertise-addresses is missing or has no port

bedrock.signaling.advertise-addresses is the address Geyser gives players for the NetherNet (WebRTC) connection. It must be your dedicated IP hostname with port 19132, for example ["{uid}.ip.infinity-filter.com:19132"]. Without a port, Geyser gives its own UDP port (your backend port), which is wrong behind Infinity-Filter. The config shown by the panel has it filled in.

Geyser listens on 127.0.0.1, or is too old

bedrock.address must be 0.0.0.0 — NetherNet doesn’t work on 127.0.0.1. And Geyser must be build 1280 or later; update to the latest build. Older builds don’t have webrtc-proxy-protocol-relays and prefer-signaling-proxy-address.

Players get a “Trust on first use” prompt

The game shows this prompt when it can’t verify the server — the connection is unencrypted. It means the player didn’t use a declared Bedrock domain with an Active certificate (they typed the IP, or another name). Give them the domain; with it, the prompt disappears on every platform.

Up-to-date players can’t join, older versions can

Your network is still on RakNet. Since Bedrock 26.60 (October 27, 2026), up-to-date players only connect through NetherNet. Switch it: see From RakNet to NetherNet.

Bedrock stopped working right after a Geyser update

Your network is probably still on RakNet on Infinity-Filter’s side. Geyser 1280 removed the RakNet-only transport and starts in NetherNet, so Bedrock players can’t join until the network uses NetherNet too. Switch it on its Backends page and apply the NetherNet config: see From RakNet to NetherNet.

A Bedrock domain can’t be added or stays in DNS error

Health-check requests in Geyser’s logs

With NetherNet and several Geyser backends, each Geyser server receives a GET /v1/join request from our IPs every 5 seconds. These are health checks that let Infinity-Filter stop sending players to a Geyser server that’s down. They’re normal.

Some players end up on a broken Geyser server

With several Geyser backends, a NetherNet player always lands on the same Geyser server (chosen from their IP). If one server misbehaves, those players fail while others join fine:

• Make sure every Geyser server has the same config and reaches the same Java network.
• Take a server out of rotation for maintenance by disabling its backend (power button on the Backends page).

Real player IP not visible

• Every player shows an Infinity-Filter IP: Geyser takes the IP of the WebRTC (UDP) stream. With the NetherNet PROXY protocol (UDP) option off, set advanced.bedrock.prefer-signaling-proxy-address: true (it’s false on a fresh Geyser install) with our IP list in haproxy-protocol-whitelisted-ips.
• Friend joins through MCXboxBroadcast show the Broadcaster’s IP: that’s the default setup. To get the right IP for every join, turn on the NetherNet PROXY protocol (UDP) with the matching Geyser config (prefer-signaling-proxy-address: false).
• If Geyser runs standalone and your Java proxy has PROXY protocol enabled, also set advanced.java.use-haproxy-protocol: true so Geyser forwards the real IP to your proxy (and your proxy accepts the connection).

See Real-IP forwarding issues.

RakNet only: “Trouble establishing a connection to multiplayer services”

On a network still using RakNet, this usually means UDP traffic doesn’t reach Geyser:

• Geyser was updated to build 1280 or later: it no longer has RakNet. Switch the network to NetherNet.
• The Geyser port isn’t open in UDP from the IF IP ranges.
• Geyser doesn’t accept the PROXY protocol: on a Geyser build older than 1280 (the only ones with RakNet), set advanced.bedrock.use-haproxy-protocol: true (old name: bedrock.enable-proxy-protocol: true) and list our IPs in haproxy-protocol-whitelisted-ips.

”Header length exceeds allowed maximum”

Geyser received a PROXY header it doesn’t accept. Check that haproxy-protocol-whitelisted-ips contains our IP list and that Geyser is up to date.

Bedrock module suddenly stopped after a subscription renewal

Billing has been observed to wrongly flag a dedicated IP for cancellation during renewal. The dedicated IP needs to be re-enabled platform-side.

Fix: open a support ticket on the Discord. We can re-enable it manually.

Multi-proxy setup, only some Bedrock players can connect

In a setup with several proxies, Geyser must be installed on every proxy. Bedrock players routed to a proxy without Geyser can’t join.

Fix: install Geyser (and Floodgate) on every proxy.

Floodgate on the wrong layer

Floodgate goes on the proxy only — never on the backend servers behind it.

Backend port surprise

Players always connect on 19132 to Infinity-Filter. The Geyser port on your server is internal and can be anything (just not your Java server’s port) — it doesn’t have to be 19132.

Common one-line diagnoses

What’s next