How to secure a velocity server

How to Secure Your Velocity Proxy – Best Practices

When using Velocity (or any proxy), one of the most important things is securing your backend servers. Since your backend servers run in offline mode, they could theoretically be joined directly by anyone. This guide explains the best ways to protect your network so only your Velocity proxy can connect.

1. Velocity Modern Forwarding (Best for 1.13+)

Velocity includes a modern forwarding system that not only sends player data but also adds strong protection against impersonation.

How to enable it:

• Set player-info-forwarding-mode = "modern" in velocity.toml
• Use the same secret key on all backend servers

Advantages: Excellent security + better player data forwarding.

Disadvantages: Only works on Minecraft 1.13 and newer.

2. Encrypted Tunnel (Advanced)

Use tools like WireGuard, OpenVPN, or spiped to create encrypted tunnels between your proxy and backend servers.

Advantages: Encrypts traffic and restricts access.

Disadvantages: Complex setup.

3. IP Whitelisting Plugins (Last Resort)

You can use plugins like IPWhitelist to only allow connections from your Velocity proxy’s IP.

This is especially useful on shared hosting where firewall options are limited.

Other Important Security Tips

• Always keep Velocity, your backend servers (Paper/Purpur), and plugins updated.
• Run servers as a non-root user.
• Make regular backups.
• Use strong passwords and secure all services on your machine.
• Avoid running unnecessary plugins.

Need Help Securing Your Velocity Network?

Setting up proper security can be complicated, especially when migrating from BungeeCord or managing multiple servers.

At PloxHost, we offer a professional configuration service for a one-time fee. Our technical staff can fully install, configure, optimize, and secure your Velocity proxy and backend servers.

Just open a ticket or message us on Discord and we’ll take care of everything for you.