---
description: For everything Bedrock related.
---

# Sentry Tunnel for Bedrock/Geyser/PocketMine

{% hint style="danger" %}
For customers using the Pterodactyl panel, you may need to contact us during the setup process, as Pterodactyl reserves all private IP addresses, which can prevent the creation of the tunnel. Refer to this [debug section](../common-issues-and-debugging#id-2.-error-nexthop-has-invalid-gateway).
{% endhint %}

## 1. Ensure a working Geyser Instance

Before proceeding, make sure your Geyser instance is running. Follow the instructions in the [Geyser documentation](https://geysermc.org/wiki/geyser/setup/) to set up your server. In this example, we have a Bedrock server up and running on `108.61.149.182:19132` :

<figure><img src="https://530345640-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWXTvAX8gueFZ5txjDV%2Fuploads%2FNeeJX8JBhB7ATuPtfY7h%2Fimage.png?alt=media&#x26;token=6f964c15-ec5a-49aa-abe0-bc0730bc1ca0" alt=""><figcaption><p>Bedrock server using Geyser-Standalone</p></figcaption></figure>

For TCPShield customers running PocketMine MP, please consult their [official guide](https://doc.pmmp.io/en/rtfd/installation.html).

## 2. Create your Sentry Tunnel

Once your Geyser instance is up and running, create a Sentry Tunnel and enter the correct IP address of your Geyser server in the “Endpoint” field. You can leave the “Port” field blank—your application will continue listening on its default port. Sentry Tunnel simply forwards traffic to the original port over the backend IP.

<figure><img src="https://530345640-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWXTvAX8gueFZ5txjDV%2Fuploads%2Fxtu6iwMB2zUeIe9fgNVj%2Fimage.png?alt=media&#x26;token=6edfa284-e7eb-4052-9439-e5393cf303b8" alt=""><figcaption><p>Tunnel Creation</p></figcaption></figure>

## 3. Run the VXLAN Creation Script

<figure><img src="https://530345640-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWXTvAX8gueFZ5txjDV%2Fuploads%2Fxt9o3C1oG2u1ph5P8Y6x%2Fimage.png?alt=media&#x26;token=7bafd9b1-3ec6-435e-916a-bc23e6dad6a5" alt=""><figcaption><p>Tunnel Overwiew page</p></figcaption></figure>

After creating the tunnel, navigate to the bottom of the Overview page, then copy and run your VXLAN creation script. If you encounter any errors, refer to the [troubleshooting section](common-issues-and-debugging). To verify that the tunnel was created successfully, run the following command:

```
ip -s link show vxlan_<id>
```

Example output:

```
root@admin:~# ip -s link show vxlan_47
418: vxlan_47: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether 12:cc:cb:ab:1f:e8 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped missed  mcast
    341644143  2036858  0       0       0      0
    TX: bytes  packets  errors  dropped carrier collsns
    53378176   387353   0       0       0      0
```

At this point you should also be able to ping the tunnel's local IP address:

```
root@admin:~# ping 172.18.128.2
PING 172.18.128.2 (172.18.128.2) 56(84) bytes of data.
64 bytes from 172.18.128.2: icmp_seq=1 ttl=64 time=51.6 ms
64 bytes from 172.18.128.2: icmp_seq=2 ttl=64 time=50.9 ms
64 bytes from 172.18.128.2: icmp_seq=3 ttl=64 time=50.0 ms
64 bytes from 172.18.128.2: icmp_seq=4 ttl=64 time=50.0 ms
```

## 4. Whitelist VXLAN and Backend Ports

Ensure both the VXLAN port and your backend port are properly whitelisted. You can achieve this using either UFW or iptables. <mark style="color:purple;">This step might not be necessary, but worth mentioning nonetheless</mark>.

### Using UFW

```
ufw allow <port>/udp
ufw allow <port>/tcp
```

Then verify the status by running:

```
ufw status
```

### Using iptables

```
iptables -A INPUT -p udp --dport <PORT> -j ACCEPT
iptables -A INPUT -p tcp --dport <PORT> -j ACCEPT
iptables -A OUTPUT -p tcp --sport <PORT> -j ACCEPT
iptables -A OUTPUT -p udp --sport <PORT> -j ACCEPT
```

Then verify your configuration by running:

```
iptables-save
```

{% hint style="warning" %}
<mark style="color:purple;">IMPORTANT: For customers using Pterodactyl, ensure that you open the VXLAN port on the panel itself. This can be done by navigating to the</mark> <mark style="color:purple;"></mark><mark style="color:purple;">**Network**</mark> <mark style="color:purple;"></mark><mark style="color:purple;">tab and selecting</mark> <mark style="color:purple;"></mark><mark style="color:purple;">**Create Allocation**</mark><mark style="color:purple;">. For more information, visit this</mark> [<mark style="color:purple;">guide</mark>](https://knowledgebase.aquatis.host/books/pterodactyl-guides/page/how-do-i-addopen-a-server-port-on-pterodactyl)<mark style="color:purple;">.</mark>
{% endhint %}

## 5. Update the config file

### 5.1 Geyser&#x20;

Next, update the `address` (under the `Bedrock` section) in the Geyser configuration file to the public IP address of your VXLAN tunnel. For example, if your public IP is `104.234.6.128`, make the necessary changes to the config. The port of the server stays the same, aka `19132`.

<figure><img src="https://530345640-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWXTvAX8gueFZ5txjDV%2Fuploads%2FEPcUzeO8euqyHnUoYCXR%2Fimage.png?alt=media&#x26;token=387341f2-7064-423e-a0a7-8d0e09ae2e96" alt=""><figcaption><p>Update Geyser's backend IP Address</p></figcaption></figure>

After restarting the server, double-check that the service is running properly by running the following command:

```
netstat -plunt | grep 104.234.6.128
```

The output should look similar to this:

```
root@admin:~# netstat -plunt | grep 104.234.6.128
udp     0   0 104.234.6.128:19132 0.0.0.0:*                        1546258/java
udp     0   0 104.234.6.128:19132 0.0.0.0:*                        1546258/java
```

### 5.2 PocketMine MP

By default PocketMine will always listen on `0.0.0.0` , hence you have to navigate to your `server.properties`  and update `server-ip` to the tunnel Public IP Address. If not available, simply add it in the file. Example config:

```
#Properties Config file
#Tue Jul 8 11:04:48 UTC 2025
language=eng
motd=TCPShield Test
server-port=19132
server-ip=104.234.6.128
server-portv6=19133
gamemode=SURVIVAL
...
```

Restart the server and you should see the MP server is listening on the correct interface:

```
root@admin:~# netstat -plunt | grep 104.234.6.128
udp        0      0 104.234.6.128:19132     0.0.0.0:*       1095804/PocketMine- 
```

## 6. Final Step

At this point, the connection to your Bedrock server will be using the public IP `104.234.6.128`. Create an A record that points directly to this IP address on your preferred DNS manager:

<figure><img src="https://530345640-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWXTvAX8gueFZ5txjDV%2Fuploads%2FGrs7XtnTLnR0guiCYAOE%2Fimage.png?alt=media&#x26;token=e7791662-f894-41dd-94ce-3fafb8106ca8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://530345640-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWXTvAX8gueFZ5txjDV%2Fuploads%2FeDcjEUn6uYbrvLhEkIIA%2Fimage.png?alt=media&#x26;token=11a7e25d-fe13-495e-89bd-9411a832b004" alt=""><figcaption><p>The Geyser instance running on 104.234.6.128:19132</p></figcaption></figure>

<figure><img src="https://530345640-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWXTvAX8gueFZ5txjDV%2Fuploads%2FsxbLF5a8ecs15ogLYLTb%2Fimage.png?alt=media&#x26;token=b9af9b04-c0e8-4d35-a2be-5241d05ee4a6" alt=""><figcaption><p>Your PocketMine MP instance running on 104.234.6.128:19132</p></figcaption></figure>

And that's it, happy gaming!
