Players Rejected by prevent-proxy-connections

Direct answer

The prevent-proxy-connections property is an authentication-related check, not a way to firewall Velocity backends. If normal players are rejected, inspect the exact login message and the intended authentication architecture first.

What it means

Player IPs may differ for legitimate reasons such as roaming networks, VPNs and proxy routing. Separately, an unsecured offline-mode backend behind a proxy can be reached directly unless protected by network restrictions.

Practical example: Example: a user connecting through a residential VPN may trigger a different identity/network check than one on their normal connection. That observation does not prove an attack. However, a backend in offline mode that accepts direct public traffic is a serious impersonation risk regardless of this server.properties setting.

If you are a player

• Temporarily test from a stable connection without a VPN or relay, if allowed by the server’s policy.
• Provide the exact disconnect message and time to the administrator.
• Do not ask administrators to turn off server authentication simply to bypass a connection error.

If you run the server

1. Check whether the affected connection reaches a standalone authenticated server or the correct public Velocity proxy.
2. Review prevent-proxy-connections only in the context of your server’s authentication policy and Minecraft version.
3. For Velocity, verify modern forwarding settings and backend isolation according to official documentation.
4. Do not confuse the prevent-proxy-connections check with the firewall rules needed for a proxy network.
5. Compare one known-good login with one failing account and review server-side auth logs.

References

References used to verify the settings and troubleshooting steps in this fix.

• PaperMC: server.properties reference
• PaperMC: Velocity security

Related fixes and guides