How to Secure Minecraft Backend Servers Behind Velocity

Direct answer

Even when Velocity modern forwarding is enabled, PaperMC recommends a firewall or private network. A secret reduces impersonation risk; it does not remove the need to deny direct public access.

Recommended procedure

1. List every backend host, interface and port, and identify the IP address from which the proxy connects.
2. If proxy and backend share a trusted dedicated host, consider binding each backend to 127.0.0.1 while Velocity points to that same address.
3. For separate hosts, use private networking or host firewall rules allowing backend ports only from the proxy’s address.

What to change

1. Keep the public Velocity listener accessible on its intended port, but block public traffic to every backend game port.
2. Test a real external connection: proxy joins should succeed; attempts to reach backend address:port directly should fail.

How to verify the result

Recheck backend reachability after firewall changes and server reboots. Record the trusted proxy IP and revise firewall rules when it changes.

Version and compatibility notes

Never bind a backend to 127.0.0.1 if Velocity runs on a different host. Avoid blanket firewall commands without checking SSH/management access first; shared hosting may need provider-specific network controls.

Official references

• Velocity security recommendations
• Velocity setup

Related guides