How do I secure offline-mode backends (BungeeGuard / firewall)? — Minecraft

Q: I'm on Velocity, not BungeeCord — does this still apply?

Yes. Velocity uses its own player-info-forwarding configuration, and BungeeGuard-style secret forwarding still applies. The principle is identical: backends must only trust connections carrying your secret.

When you run a BungeeCord or Velocity network, your backend servers run in offline (cracked) mode so the proxy can handle authentication. That convenience comes with a risk: anyone who learns a backend's IP:port could connect to it directly and impersonate any player, including your staff. Securing those backends is the single most important step in setting up a proxy network.

Why offline-mode backends need protection

The proxy authenticates players with Mojang and then forwards them to a backend. Because the backend itself trusts whatever the proxy tells it, a direct connection that bypasses the proxy can claim to be any username. BungeeGuard closes that hole by requiring a shared secret token: a backend will reject any connection that doesn't present the proxy's token.

How to secure your backends

Install BungeeGuard on the proxy and on each backend server, configuring them to share the same secret token. Backends will then reject any connection that does not carry that token.
Enable BungeeCord forwarding on each backend. For Spigot/Paper backends, set bungeecord: true in spigot.yml. For Velocity, use the equivalent player-info-forwarding setting so the proxy and backends agree on how player data is passed.
Keep your backend addresses private. Don't publish or share the backend IP:port values — only the proxy address should be public.

Warning: Never expose an offline-mode backend without BungeeGuard or a forwarding secret in place. This is the main security step for any network, and skipping it leaves your servers open to impersonation.

Frequently asked questions

Do I need BungeeGuard on both the proxy and the backends? Yes. The token has to match on the proxy and every backend so that the backends can verify connections are coming through your proxy.

I'm on Velocity, not BungeeCord — does this still apply? Yes. Velocity uses its own player-info-forwarding configuration, and BungeeGuard-style secret forwarding still applies. The principle is identical: backends must only trust connections carrying your secret.

Can't a firewall alone protect the backends? Restricting backend ports helps, but the reliable, portable fix is BungeeGuard plus proper forwarding. If you need help locking things down, open a ticket and our team will walk through it with you.