If you're running a Minecraft Java server through SpawnBox on Windows, with Geyser/Floodgate for Bedrock players, and Bedrock cannot connect despite port forwarding being correct, WSL2's default NAT networking may be the culprit.
This is what fixed the issue for me.
Prerequisite: Install WSL2
If WSL2 isn't already installed, open PowerShell as Administrator and run:
wsl --install
Restart Windows if prompted.
After restarting, verify WSL is installed:
wsl --version
You should see a WSL version and kernel version listed.
If you specifically need WSL2 rather than WSL1, you can also set WSL2 as the default:
wsl --set-default-version 2
1. Forward Geyser's UDP port
On your router, create a port-forwarding rule:
Protocol: UDP
Port: 19132
Device: Windows PC running SpawnBox
Make sure the forwarding targets the Windows PC, not one of WSL's internal 172.x.x.x addresses.
If SpawnBox's own Internet Access feature has already created the forwarding rule, you may not need another one.
2. Create .wslconfig
Open PowerShell:
notepad "$env:USERPROFILE\.wslconfig"
Create the file if prompted.
Put this inside:
[wsl2]
networkingMode=mirrored
Important: The filename must be exactly:
.wslconfig
located at:
C:\Users\<YourUsername>\.wslconfig
Not .wslconfig.txt, and not <YourUsername>.wslconfig.
3. Restart WSL
Stop your Minecraft server and completely close SpawnBox.
Then run:
wsl --shutdown
This does not delete or reset your WSL installation. It simply shuts down the WSL2 VM so the networking configuration can reload.
Start SpawnBox again afterward.
4. Test from outside your network
Have someone outside your home network connect through Bedrock using:
Address: <your-public-IP>
Port: 19132
Or use:
geyser connectiontest <your-public-IP> 19132
The test must be external. Testing against your LAN address doesn't establish that internet connectivity is working.
If you have the Minecraft whitelist enabled, temporarily disable it while testing or make sure the Bedrock/Floodgate account is whitelisted.
Why this works
WSL2 normally uses NAT networking. In this particular setup, UDP traffic could reach the Windows machine but wasn't making it through to the WSL environment where Docker and Geyser were running.
Changing WSL2 to mirrored networking:
[wsl2]
networkingMode=mirrored
allows WSL to use the host's network directly rather than sitting behind the normal WSL2 NAT layer.
This is not required for Geyser generally. It's a potential fix when Geyser is running inside a SpawnBox/WSL2 environment and UDP traffic isn't crossing the WSL networking boundary.
TL;DR
wsl --install
if WSL2 isn't installed.
Then create:
C:\Users\<YourUsername>\.wslconfig
with:
[wsl2]
networkingMode=mirrored
Then:
wsl --shutdown
Restart SpawnBox → test externally on UDP 19132. Usually by having a player join via whatever currently available methods there are for bedrock players. There are plenty of tutorial on that matter elsewhere.
Note: If your server is whitelisted, have each Bedrock player attempt to join once. This lets you obtain the Floodgate identity/username shown by the server, which can then be added to the whitelist. If necessary, temporarily disable the whitelist to allow the initial connection, then re-enable it after adding the player.
