Players Can Connect Directly to a Velocity Backend

Direct answer

An offline-mode backend behind Velocity should not be directly reachable by untrusted clients. Restrict backend network access so players can reach the proxy, not the backend ports.

What it means

A backend that is reachable from the internet can bypass the proxy and may expose offline-mode identity handling.

If you are a player

Copy the exact connection/kick message and note the timestamp; similar-looking login errors can have different causes.
Check the address, port, Minecraft version, and whether other players can connect at the same time.
Tell the owner whether the problem follows your account/device/network or affects everyone.

If you run the server

Use a firewall or equivalent network policy so backend Minecraft ports accept traffic only from the Velocity proxy. PaperMC specifically recommends firewalling the backend.
If the proxy and backend share one machine, binding the backend to an appropriate local/private interface can reduce exposure, but still review the host firewall and container networking.
Do not treat modern forwarding or a forwarding secret as a complete replacement for network isolation. Protect the backend connection path as well.
After restricting access, test both paths: a normal join through Velocity should work, while a direct connection to the backend from an untrusted network should fail.

Prove that backend isolation is effective

From a device that is not the proxy, attempt a connection directly to the backend IP and port. The TCP connection should be blocked by networking or firewall rules.
If the proxy and backend share a host, bind the backend to loopback where appropriate; if they are separate hosts, restrict inbound access to the trusted proxy or private tunnel.
Velocity Modern Forwarding secrets are an additional protection, not a replacement for a firewall. Rotate exposed secrets and review authentication if a backend was reachable.

References

References used to verify the settings and troubleshooting steps in this fix.

Was this article helpful?

Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.