The smallest useful network is a proxy and two servers. Once that works, adding a third is copying a block of config. Getting the first one right is the part worth doing slowly.
What to do
- Create the proxy instance
Velocity is its own server type, not a plugin. It needs very little memory — 512 MB is generous for a small network, because it holds no world data.
- Point the proxy's address at your players
The proxy is what people connect to. Its address and port are the ones you publish; the backends' addresses stay private.
- List the backends in
velocity.tomlUnder
[servers], each entry is a name and an address.trylists which server new players land on, in order. - Switch forwarding to
modernIn
velocity.toml, setplayer-info-forwarding-mode = "modern". This is how the backend learns who a player really is, including their skin and UUID. - Copy
forwarding.secretto every backendThe file sits next to
velocity.toml. Each Paper backend needs the same value inconfig/paper-global.ymlunderproxies.velocity, withenabled: trueandonline-mode: true. - Turn off online mode on the backends only
In each backend's
server.properties, setonline-mode=false. The proxy authenticates now; the backends trust the proxy. This is safe only with the next step done.
online-mode=false and no firewall is wide openAnyone who learns a backend's address and port can connect straight to it under any username — including yours, with your permissions. Backends must not be reachable from the internet. Restrict them to the proxy, or run them where only the proxy can see them.
What lives where
| Setting | Proxy | Backends |
|---|---|---|
online-mode | true | false |
| Forwarding secret | In forwarding.secret | Copied into paper-global.yml |
| Public address | Yes — this is what you publish | No |
| Permissions plugin | Optional (for proxy commands) | Yes, on each |
Connect to the proxy, then /server to move. If a backend works when you connect directly but not through the proxy, forwarding is the problem — not the backend.
You join the proxy, land in the lobby, run /server survival, and arrive with your correct name and skin intact.