Sentry Tunnel for Bedrock/Geyser/PocketMine/VoiceChat
For everything Bedrock related.
For customers using the Pterodactyl panel, you may need to contact us during the setup process, as Pterodactyl reserves all private IP addresses, which can prevent the creation of the tunnel. Refer to this debug section.
1. Ensure a working Geyser Instance
Before proceeding, make sure your Geyser instance is running. Follow the instructions in the Geyser documentation to set up your server. In this example, we have a Bedrock server up and running on 108.61.149.182:19132 :
For TCPShield customers running PocketMine MP, please consult their official guide.
2. Create your Sentry Tunnel
Once your Geyser instance is up and running, create a Sentry Tunnel and enter the correct IP address of your Geyser server in the “Endpoint” field. You can leave the “Port” field blank—your application will continue listening on its default port. Sentry Tunnel simply forwards traffic to the original port over the backend IP.
3. Run the VXLAN Creation Script
After creating the tunnel, navigate to the bottom of the Overview page, then copy and run your VXLAN creation script. If you encounter any errors, refer to the troubleshooting section. To verify that the tunnel was created successfully, run the following command:
Example output:
At this point you should also be able to ping the tunnel's local IP address:
4. Whitelist VXLAN and Backend Ports
Ensure both the VXLAN port and your backend port are properly whitelisted. You can achieve this using either UFW or iptables. This step might not be necessary, but worth mentioning nonetheless.
Using UFW
Then verify the status by running:
Using iptables
Then verify your configuration by running:
IMPORTANT: For customers using Pterodactyl, ensure that you open the VXLAN port on the panel itself. This can be done by navigating to the Network tab and selecting Create Allocation. For more information, visit this guide.
5. Update the config file
5.1 Geyser
Next, update the address (under the Bedrock section) in the Geyser configuration file to the public IP address of your VXLAN tunnel. For example, if your public IP is 104.234.6.128, make the necessary changes to the config. The port of the server stays the same, aka 19132.
Also make sure enable-proxy-connections: false . On newer Geyser version, this setting is also called haproxy-protocol, but make sure you only edit the one located inside the bedrock section.
After restarting the server, double-check that the service is running properly by running the following command:
The output should look similar to this:
5.2 PocketMine MP
By default PocketMine will always listen on 0.0.0.0 , hence you have to navigate to your server.properties and update server-ip to the tunnel Public IP Address. If not available, simply add it in the file. Example config:
Restart the server and you should see the MP server is listening on the correct interface:
6. Final Step
At this point, the connection to your Bedrock server will be using the public IP 104.234.6.128. Create an A record that points directly to this IP address on your preferred DNS manager:
And that's it, happy gaming!
7. Voice chat setup:
There are 2 values to update:
- To make sure SVC's listening on the correct IP address, bind_address should be using the tunnel public IP .
- You would then specifiy the voice_host to tunnel_IP:port so the clients can connect to it.
Example config file:
7.2 Plasmo Voice
Shout out to a very detailed documentation on their side.
To setup PlasmoVoice with VLXAN tunnel, you need to:
- Change the IP and port of [host] and [host.public] to match your VXLAN's public IP and your specific port .
- Example config:
Last updated
Was this helpful?