Direct answer

If Velocity and all backend servers share one trusted machine, you can bind the Java backends to loopback (127.0.0.1) so outsiders cannot connect directly. The publicly reachable Velocity proxy must bind to a suitable network interface.

Recommended procedure

  1. Confirm the proxy and the backend run on the same network namespace; Docker containers and different machines do not share localhost.
  2. Stop the backend and set server-ip=127.0.0.1 in that backend’s server.properties.
  3. Ensure the corresponding server entry in Velocity velocity.toml points to 127.0.0.1:<backend-port>.
  4. Restart the backend and then the proxy; review startup logs for successful binding.
  5. Keep modern forwarding and its shared secret configured as appropriate, and retain firewall isolation for other exposed services.

Why this matters

Loopback is a network boundary, not an authentication mechanism. A backend on another host or container cannot be reached with 127.0.0.1 from the proxy without explicit networking.

Practical example: Example: Velocity running on the host and Paper running inside a Docker container do not necessarily share 127.0.0.1. In that layout, use a restricted container/private address with firewall or networking policy instead. Conversely, if both programs run directly on the same dedicated machine, localhost can prevent unwanted direct backend joins.

How to verify the result

  • Join through Velocity’s public address and switch to the backend.
  • From a separate outside host, confirm direct connections to the backend port fail.
  • If proxy joins fail, inspect both binding addresses and whether the proxy and backend share a network namespace.

Version and compatibility notes

  • Do not set the public Velocity listener to localhost unless you only want local clients.
  • For multi-host networks use restricted private IPs and host/provider firewall rules instead.

Related topic: How to Secure Minecraft Backend Servers Behind Velocity. Compare the two guides when choosing the right diagnostic or configuration step.

Official references

These sources were checked for the current MSH revision. Version-sensitive details should always be confirmed against the project documentation for the release you run.

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000