A proxy network is only as secure as its weakest backend. If a player can reach a backend server directly instead of going through the proxy, every protection the proxy provides stops applying to them.
What you are seeing
- Players appear in-game without having registered or logged in.
- Someone joins with an administrator's username and has their permissions.
- Player counts on the backend do not match what the proxy reports.
Why it happens
When you build a network with BungeeCord or Velocity, the backend servers — lobby, survival, minigames — each still listen on their own port. If those ports are reachable from the internet, a player can connect straight to them, skipping the proxy, skipping registration and presenting whatever username they like.
What to do
- Turn on forwarding between proxy and backends
Set
ip-forwarding: truein BungeeCord, or configure modern forwarding in Velocity. This is what lets the backend trust the identity the proxy passes it. - Set
online-mode=trueon every backendWith forwarding configured, the backends verify the identity that arrived through the proxy instead of accepting whatever connects to them directly.
- Verify from outside your network
Try to connect to a backend's own address and port from a different connection. If it lets you in, the hole is still open.
A direct connection attempt to a backend is refused, and the only way into the network is through the proxy address.
Securing your own network topology is a client-side responsibility. Support does not audit network configurations or set up firewalling on your behalf.