Install the official Bedrock Dedicated Server, then configure the transport shipped with that build before opening ports. Current Bedrock networking differs from the old “forward UDP 19132” recipe. This guide uses stable BDS 1.26.52.3, Ubuntu 24.04 on an Intel/AMD 64-bit machine and a VPS with a directly assigned public IPv4 address.
Choose a compatible server and client#
The official download page currently supports Ubuntu 22.04 or later. Use a supported Ubuntu release, adequate free storage and RAM; ARM binaries and other Linux distributions are outside this walkthrough.
Download stable server software for stable clients. Preview is a separate release channel. Before changing the server, check the client's protocol compatibility; an “Outdated Client” or “Outdated Server” message calls for matching versions, not more firewall rules. For first acceptance, use Windows Bedrock or a mobile client with an Add Server option. Console access has additional platform restrictions.
Install into a separate user's directory#
On a fresh Ubuntu 24.04 machine, prepare the account and required tools. libcurl4t64 is the Ubuntu 24.04 libcurl package, not a file to download from an unrelated DLL site.
sudo apt update
sudo apt install ca-certificates curl unzip libcurl4t64
sudo useradd --create-home --home-dir /srv/bedrock --shell /bin/bash bedrock
sudo -iu bedrock
umask 077
mkdir -p /srv/bedrock/game
cd /srv/bedrock
curl -fL -o server.zip https://www.minecraft.net/bedrockdedicatedserver/bin-linux/bedrock-server-1.26.52.3.zip
unzip -l server.zip
unzip server.zip -d game
cd game
chmod u+x bedrock_server
The URL pins the stable archive available when this guide was checked. For another release, obtain its Linux link from the official download page; do not invent a filename or silently substitute Preview. Inspect the archive before extraction and keep this destination empty. If the account exists, check ownership instead of recreating it.
Read the extracted server.properties and bedrock_server_how_to.html. Their transport comments matter: this archive defaults to transport=nethernet. Do not replace its whole configuration with a Java Edition template.
Configure the world and both network paths#
Edit existing keys in server.properties, preserving other settings. For a small private server, start with:
server-name=Friends Bedrock
level-name=FriendsWorld
max-players=4
online-mode=true
allow-list=true
enable-lan-visibility=false
transport=nethernet
server-port=19132
server-udp-ports=203.0.113.10:40000:40000,203.0.113.10:40001:40001,203.0.113.10:40002:40002,203.0.113.10:40003:40003
Replace every 203.0.113.10 with your VPS's actual public IPv4 address. It is a documentation address and cannot work as written. The four explicit UDP mappings are an illustrative allocation: reserve them for this instance and enlarge the configured and permitted set together if capacity testing requires it.
NetherNet has two stages: HTTP signaling on TCP 19132, followed by negotiated UDP gameplay on the configured ports. The Mojang protocol guide explains this separation. A successful signaling request does not establish a usable game connection.
In this mode the archive says server-portv6 is ignored; the signaling socket uses server-port for dual stack when available. Historical RakNet setups use UDP 19132 for IPv4 and UDP 19133 for IPv6 only when that transport is actually supported and active. Do not force RakNet as a repair for current builds. This walkthrough deliberately tests public IPv4; an IPv6 deployment needs its own reachable address, mappings and client test.
Launch and admit the intended players#
Run from the extracted directory as bedrock:
cd /srv/bedrock/game
LD_LIBRARY_PATH=. ./bedrock_server
This uses the supplied local libraries. A missing-library error needs the named Ubuntu dependency checked; Permission denied needs executable permission, directory access and mount options checked. Neither is fixed by running the server as root.
Use the interactive server console to allow a player's actual Xbox Gamertag, including quotes for spaces, and save the server identity:
allowlist add "Example Player"
serveridentity save
serveridentity status
The bundled how-to documents these commands. Preserving the identity key helps returning clients recognize this server after restart; protect it as a private key. Grant operator privileges separately only when needed.
Verify listeners and join from outside#
In another administrative terminal, inspect process-owned sockets while attempting a client connection:
sudo ss -lntp 'sport = :19132'
sudo ss -lunp
Find the bedrock_server process and its configured UDP allocations. UDP sockets may be allocated during connection negotiation, so an idle snapshot is not a complete test. An unrelated process on the same port is a collision, not success.
If UFW is active, permit TCP 19132 and UDP 40000–40003; apply the same protocol-specific rules to the VPS firewall. Do not enable UFW remotely without preserving SSH access. A router deployment additionally needs real public addressing and matching external-to-internal mappings; see CGNAT checks.
Add the server's address and 19132 in a compatible Bedrock client. First establish local reachability where applicable, then join from a different network. Confirm the intended world and the player entry in the console. A server-list entry, TCP check or UDP scanner result alone does not pass this step. A recent IPv6 support discussion illustrates how signaling and gameplay can fail independently.
Stop, back up and verify persistence#
Make a recognizable world change, leave and enter stop in the server console. Wait for the process to exit. In the bedrock shell, create a private stopped archive:
umask 077
mkdir -p /srv/bedrock/backups
chmod 700 /srv/bedrock/backups
backup_file="/srv/bedrock/backups/game-$(date -u +%Y%m%dT%H%M%SZ).tgz"
tar -C /srv/bedrock -czf "$backup_file" game
tar -tzf "$backup_file" >/dev/null
sha256sum "$backup_file" > "$backup_file.sha256"
This includes worlds, configuration, packs, admission files and identity keys. Keep a protected copy off the machine. Restart with the same command, join again and verify the saved change. Before an upgrade, retain the matching server archive and test a separate restore; an intact checksum establishes bytes, not a playable restored world.
