warden. Open panel

Signaling infrastructure for Minecraft Bedrock

Warden provides managed HTTPS signaling for NetherNet servers. It selects a destination for each connection and gives the player the details needed to connect. Game traffic then flows directly between the player and the selected server.

Open Warden panel How signaling works

The default signaling service for Geyser’s NetherNet integration, operated by Ziax, the creators of CubeCraft. Warden is in active development; see current usage and support.

Signaling and game traffic The player exchanges signaling with Warden, which selects a server. Gameplay then travels directly between the player and that server, bypassing Warden. Player W warden HTTPS signaling Game server Signaling Direct game traffic
Signaling Direct game traffic

How signaling works

NetherNet is Minecraft Bedrock’s WebRTC-based networking technology. Before connecting, the player and server exchange connection details through an HTTP signaling service. Warden hosts this service: it selects a server and returns the details needed to establish an encrypted connection.

  1. 1

    Server registration

    The server registers with Warden and reports its connection details, health, and availability.

  2. 2

    Destination selection

    The player sends a join request to Warden over HTTPS. Warden chooses an eligible server using your routing policy.

  3. 3

    Direct connection

    The player establishes a NetherNet connection to the selected server. The server handles the game session.

You host the game server. Warden handles signaling. It does not relay game traffic or hide the server’s IP address.

Open specification

Warden implements NetherNet External Signaling (NXS), an open, vendor-neutral specification maintained by Cloudburst as part of Open Collaboration. NXS defines how a NetherNet server integrates with a signaling provider, so operators can choose any provider that implements it.

A note on spelling

We use “signaling” to match the WebRTC specification. Yes, we rewrote the codebase to drop an “l”. The British members of the team have not forgiven us.

What Warden provides for your server

A public signaling endpoint, managed domains, and connection diagnostics, configured from the Warden panel.

A ready-to-share address

Each server gets a hostname and port to give to players, shown in your Warden panel.

your-server.wdn.gg:443

Custom hostnames

Use a friendly Warden hostname or your own domain. Keep the same public address when you change the underlying server.

Managed SSL/TLS

Warden provisions and renews certificates for the signaling hostname, including supported custom domains.

NAT traversal

Behind NAT, prefer UDP port forwarding and a configured public address. When forwarding is unavailable, assisted joins can help if both networks allow it.

Troubleshoot NAT and assisted joins

Global edge network

Cloudflare’s global edge network serves signaling requests. Game traffic connects directly to your host.

Connectivity tests

Test server reachability and inspect connection diagnostics to identify failures during connection setup.

Routing and diagnostics for networks

Networks get the same domain, TLS, NAT traversal, and diagnostic features, and can group multiple servers into regional pools behind one public address.

Player joins your network

WardenHealth, acceptance and routing policy

Europe London pool

  • eu-01Selected
  • eu-02Accepting
  • eu-03Draining

North America Virginia pool

  • na-01Accepting
  • na-02Not accepting
  • na-03Accepting

Asia Pacific Singapore pool

  • ap-01Draining
  • ap-02Accepting
  • ap-03Not accepting
An example join: Warden selects eu-01 and skips servers that are draining or not accepting players.

Routing at connection time

GeoDNS returns addresses that resolvers and clients cache. Warden instead selects a destination for each join request using available health, capacity, and location data.

Destination control

Route players across regional server pools using geographic or weighted policies. Draining stops new joins to a server while its existing sessions continue; it does not move sessions or guarantee instant failover.

Routing diagnostics

Inspect destination selections, test routing policies, and review connection failures across your network. Routing uses the latest health state available to Warden, which has freshness limits.

Integration and operation

Warden is the default signaling service for Geyser’s NetherNet integration.

Ziax, the creators of CubeCraft, develops and operates Warden independently of Geyser.

Connecting requires a Geyser build with NetherNet support and a compatible Minecraft Bedrock client. Availability depends on the software version and platform.

Current usage and support

Warden is in active development. Current usage is primarily intended for personal servers.

Warden has no service-level agreement (SLA), uptime guarantee, or guarantee of support. Features and availability may change as the service develops.

For commercial use, contact Ziax to discuss your requirements.

Contact Ziax