Direct answer

Compare the exact kick message with the proxy and backend logs. For Velocity Modern Forwarding, check that Velocity uses modern, the Paper backend has forwarding enabled, both share the same secret, and the backend is reachable only through the trusted proxy. Do not expose an offline-mode backend to the public Internet.

What it means

“This server requires you to connect with Velocity” normally indicates a direct connection or a missing forwarding request; “Unable to authenticate your connection” or a secret mismatch can indicate the wrong forwarding configuration. The precise wording and backend type matter—legacy, modern, and BungeeGuard are not interchangeable.

If you are a player

  • Connect using the public Velocity address, not a backend IP/port. Save the exact disconnect text and the time.
  • If all players suddenly fail after an update, provide the server owner with the message; changing your client DNS or account password will not repair forwarding configuration.

If you run the server

  1. Choose one forwarding mode for the network. For modern forwarding and compatible Paper backends, set player-info-forwarding-mode = "modern" in velocity.toml and keep the proxy online-mode enabled for normal authenticated networks.
  2. In the backend server.properties, set online-mode=false only for a backend secured behind the proxy. In spigot.yml use settings.bungeecord: false for modern forwarding.
  3. In config/paper-global.yml, enable proxies.velocity.enabled, set proxies.velocity.online-mode to match the proxy, and copy the exact contents of Velocity’s forwarding.secret to proxies.velocity.secret. Older Paper versions may use paper.yml instead.
  4. Block direct public access to each backend using firewall/network isolation; forwarding authentication is not a firewall replacement. Restart the proxy/backend after configuration changes and test using the public proxy address.
# velocity.toml (proxy)
player-info-forwarding-mode = "modern"
# config/paper-global.yml (Paper backend)
proxies:
  velocity:
    enabled: true
    online-mode: true
    secret: "REPLACE_WITH_CONTENTS_OF_FORWARDING_SECRET"
Credential safety

Never publish the real forwarding secret in guides, screenshots or Git repositories. Replace the placeholder in this example. A legacy/BungeeGuard/Fabric backend needs its own documented procedure.

References

Use the documentation for the exact software and release you run. These sources support the settings or diagnostic behavior used in this fix.

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000