Minecraft Proxy Networks

Introduction

A Minecraft proxy, such as BungeeCord, Waterfall, or Velocity, lets players move between several backend servers through one address. Players connect to the proxy, and the proxy connects to the backends.

Backend servers usually run in offline mode and trust the proxy to check who each player is, so anyone who connects to them directly can join as any player. This guide hides them from the internet so they only accept connections from the proxy.

Allocations

Give the proxy a normal allocation on the node's public IP address so players can reach it.

Give each backend server an allocation on 127.0.0.1 instead. To create them, open the node's Allocation tab, enter 127.0.0.1 as the IP Address, and add a port for each backend, such as 25566-25570.

For these allocations, Wings listens on the node's address on the servers' Docker network, 172.18.0.1 by default, not on 127.0.0.1. Other servers on the node can reach that address; nothing outside the node can.

Configuring the Proxy

Inside a container, 127.0.0.1 and localhost mean the container itself, not the node. In the proxy's configuration, address each backend as 172.18.0.1 with its port.

For BungeeCord and Waterfall, in config.yml:

servers:
  lobby:
    address: 172.18.0.1:25566
    restricted: false
    motd: Lobby
  survival:
    address: 172.18.0.1:25567
    restricted: false
    motd: Survival

For Velocity, in velocity.toml:

[servers]
lobby = "172.18.0.1:25566"
survival = "172.18.0.1:25567"
try = ["lobby"]

Configuring the Backend Servers

Configure each backend as your proxy requires. For BungeeCord and Waterfall with Paper or Spigot:

• In server.properties, set online-mode to false.
• In spigot.yml, set settings.bungeecord to true.

Velocity's recommended forwarding mode needs different settings. See your proxy's documentation.

Firewalls

If UFW is enabled, it blocks connections from the servers' network to 172.18.0.1, so the proxy cannot reach the backends. Allow each backend's port from the pterodactyl0 interface:

ufw allow in on pterodactyl0 to 172.18.0.1 port 25566 proto tcp

Replace 25566 with the backend's port and repeat for each backend. The rule only applies to traffic from the servers' network, so the backends stay hidden from the internet.