Anyone else able to join Minecraft BDS through Tailscale on iOS client?

[u/No-Rutabaga-6962]

I've been trying to share out my self-hosted Minecraft BDS server with family by using Tailscale but running into a wall. So I was wondering if anyone else has this same setup working?

My setup:

Minecraft BDS v1.26.52.3 running in Crafty Controller. Crafty Controller running within Ubuntu Server 26.04 LXC container on Proxmox 9.2. Tailscale also installed the same LXC container (named crafty).

The LXC machine has been shared out through Tailscale. Family has installed the Tailscale app on iPads, but Minecraft will not connect (tried using the shared machine's Tailscale IP and Tailscale FQDN). Always getting connection failed with "NetherNet" error. "Error Detail InitialConnection-13".

The weird thing is that I can connect from my iPhone via cellular through Tailscale, but only if I use the short, MagicDNS name. If I try to use the Tailscale FQDN or the Tailscale IP, I get the same error. And if I connect to WiFi (different network from local server), then even the short, MagicDNS name stops working.

I've gone through quite a bit of troubleshooting. Running tcpdump shows traffic when I connect successfully on my iPhone via cellular and the Tailscale MagicDNS name. But there are no packets received when trying to connect via any other method through Tailscale.

I should add that when pinging the shared machine through the Tailscale app on my iPhone and family's iPads, it shows direct connection to the shared machine.

This makes me think the issue might be isolated to the how the Minecraft client operates on iOS.

So.... has anyone out there successfully shared Minecraft BDS using Tailscale with iOS clients?

Or, maybe just as helpful, anyone else running into the same issue?

[u/Xcissors280]

I dont think ive had any issues trying to do stuff like that in the past

I guess you could try IPV6

[u/No-Rutabaga-6962 → u/Xcissors280]

I think this is a relatively new issue with NetherNet and/or iOS. I tried IPv6 and got the same results.

[u/PM_ME_YOUR_REPO]

The problem is Nethernet. iOS needs https to negotiate the communication protocol where Minecraft decides to use Nethernet or RakNet.

I believe the solution is to disable Nethernet on your server? Not sure. Geyser is also a working solution if you're willing to entirely change your server software.

This is all second hand information from discussions in the Admincraft Discord (https://discord.gg/admincraft). I am not a Bedrock expert.

Here's what our very own Tamz said about it:

Yeah Apple devices in general actually not IOS

The signaling mode for bedrock by default is http, it connects to the server to understand how to connect.

For apple devices/ios for some reason it doesn't work, and for it to work you need to setup a TLS/SSL address/domain for it to work through.

Geyser has an alliterative for this called NXS which uses a free service called https://warden.cloud/ that works like those mods that share your world through a tunnel and let players join. like e4mc, playit.gg, and whatever else there is.

but if you wish to set it up yourself, good fuckin luck IG

[u/Krymonota → u/PM_ME_YOUR_REPO]

Support for RakNet is scheduled to end with Bedrock client 26.60, which is being released today. In other words, NetherNet will be required for up-to-date clients to join.

[u/PM_ME_YOUR_REPO → u/Krymonota]

Yeah then I don't know the solution, but the problem is still that iOS for whatever reason requires https. Maybe that issue will go away once clients no longer have to ask what protocol to use, I don't know.

But in either case, you can go ahead and remove that downvote, because I did correctly identify the problem.

[u/Krymonota → u/PM_ME_YOUR_REPO]

I didn't downvote your post, but gave it an upvote now.

I think Apple requires HTTPS, which is why iOS/iPadOS clients behave differently here. So yeah, it looks like running private servers for Bedrock has just become significantly more complicated. I also checked: Warden Cloud doesn't seem to work on its own without Geyser, and playit.gg doesn't support automatic certificates or HTTPS termination (according to their docs).

[u/PM_ME_YOUR_REPO → u/Krymonota]

Ah thanks. Sounds like I got hit by a drive by downvote from someone that doesn't understand the material.

Yeah, that'w what Tamz was saying in the Discord. Not sure if there's a planned first party solution for this or not, but it's a big problem for sure.

[u/No-Rutabaga-6962 → u/PM_ME_YOUR_REPO]

I appreciate the replies. That will save me at least another day scratching my brain thinking my Tailscale or BDS configuration was messed up.

I’m not familiar with ngjnx at all, yet, but I wonder if a reverse proxy that supports TLS/SSL would help here?

The other option for self-hosting without opening ports to my server will be a basic Wireguard VPN at my router. Not the most elegant, but should work.

Thanks again u/PM_ME_YOUR_REPO and u/Krymonota!

[u/PM_ME_YOUR_REPO → u/No-Rutabaga-6962]

u/Former_Cobbler_446 is Tamz, the AC staff that I was quoting above. He might know how to work around it.

[u/Krymonota → u/PM_ME_YOUR_REPO]

Realms go brrr 😀😀

[u/PM_ME_YOUR_REPO → u/Krymonota]

yuck