What Is Velocity? Minecraft Proxies and Networks Explained

Big Minecraft servers are rarely one server. When you join a network, you usually land in a lobby, pick a game mode, and get moved to survival, skyblock or minigames without ever typing a new address. The piece that makes this work is a proxy, and today the most popular one is Velocity.

In this guide, we will cover what a proxy actually does, how Velocity compares to BungeeCord and Waterfall, why player info forwarding matters for your server's security, and how to set up a basic network with a lobby and a survival server.

By the end of this guide, you will know how to connect several servers behind one address, which files to edit, and when a proxy is simply not worth the extra work.

What a Minecraft Proxy Does

A proxy sits between your players and your Minecraft servers. Players connect to the proxy, and the proxy passes them on to one of the servers behind it. Those servers are called backend servers.

Example:

• Players join play.yourserver.net → the Velocity proxy
• Velocity sends them to lobby first
• From the lobby they can move to survival or minigames

Each backend is a normal, full Minecraft server with its own world, plugins and settings. The proxy does not run any world itself. It only handles connections, so players can switch servers without disconnecting. In Velocity, players can do that with the built-in /server command, or you can give them a menu or NPC with a plugin.

This is why networks use proxies:

• One address for everything, so players never need to know about the backend servers
• Split the load: a busy survival world does not slow down your minigames
• Restart or update one backend while players stay on the others
• Different software per backend, for example Paper for survival and a modded server for an event

Velocity vs BungeeCord vs Waterfall

There are three proxy names you will see in guides and on hosting panels. Only two of them are still maintained.

Proxy	Made by	Status (November 2026)
Velocity	PaperMC	Active. Latest stable is 4.3.1 (October 2026). Needs Java 25.
BungeeCord	SpigotMC	Still maintained. The original proxy with a large, older plugin library.
Waterfall	PaperMC (BungeeCord fork)	End of life since March 2024. Still downloadable, but new Minecraft versions are not expected.

PaperMC announced the end of Waterfall on March 26, 2024 and told users to "Migrate to Velocity!" (source: PaperMC news). If you still run Waterfall, plan your move now, before a Minecraft update breaks it.

For a new network, pick Velocity. It supports players on Minecraft 1.7.2 up to the latest release (26.3 right now), it has its own secure forwarding (more on that below), and PaperMC develops it next to Paper, so the two work well together.

Note: Velocity plugins and BungeeCord plugins are not the same thing. A BungeeCord plugin will not load on Velocity. Check that every proxy plugin you need has a Velocity version before you switch. Most big ones, like LuckPerms and Geyser, do.

Player Info Forwarding: Why It Matters for Security

This is the part most guides rush through, and it is the part that gets servers hacked.

When you use a proxy, the proxy checks each player's Minecraft account. Your backend servers do not, so they must run with online-mode=false in server.properties. If a backend can be reached directly and nothing else protects it, anyone can connect to it with any username, including yours. The Velocity docs say it plainly: "someone could impersonate any player on your server" (source: Velocity security guide).

Player info forwarding fixes this. The proxy passes each player's real UUID, skin and IP to the backend, and the backend only accepts players who came through the proxy. Velocity offers these modes in velocity.toml:

• none → the default. No forwarding, players get offline-mode UUIDs. Do not run a public network like this.
• legacy → BungeeCord-style forwarding, for backends on 1.12.2 or older. The docs call it "fundamentally insecure" without a firewall.
• bungeeguard → legacy forwarding plus a secret token, for old backends on hosts where you cannot set up a firewall.
• modern → Velocity's own forwarding, signed with a secret key. Works on Minecraft 1.13 and newer. Use this.

With modern forwarding, Paper checks every login against your secret. A player who tries to connect straight to the backend gets turned away, because they cannot prove they came through your proxy.

Velocity's docs still recommend a firewall on top of this, because modern forwarding "is not a replacement for a firewall". On a shared host where you cannot control the firewall, the same docs say modern forwarding may be your best option. Either way, the secret is what keeps impostors out (source: Velocity forwarding guide).

Warning: Treat forwarding.secret like a password. Never paste it in Discord or a public screenshot. If it leaks, put a new random value in the file and update every backend.

Read our How to Protect Your Minecraft Server guide for the rest of your security setup.

How to Set Up a Basic Velocity Network

We will build the classic setup: one proxy, a lobby and a survival server, all on Paper.

Step 1: Start Velocity once

Download Velocity from papermc.io/downloads/velocity. It needs Java 25 or newer. Start it with a command like the one in PaperMC's guide (they use 1 GB of RAM):

java -Xms1G -Xmx1G -jar velocity.jar

On the first start, Velocity creates velocity.toml and a forwarding.secret file with a random key. Stop the proxy after it finishes loading.

Step 2: Edit velocity.toml

Open velocity.toml and change these parts:

bind = "0.0.0.0:25565"
online-mode = true
player-info-forwarding-mode = "modern"
forwarding-secret-file = "forwarding.secret"

[servers]
lobby = "127.0.0.1:30066"
survival = "127.0.0.1:30067"

try = [
    "lobby"
]

• bind → the address and port players connect to. Port 25565 is the default.
• [servers] → a name and address for each backend. The names are what players type after /server.
• try → where players go when they join, or when they get kicked from another server.

The default file also has a [forced-hosts] section with example domains for factions and minigames. Remove those examples or point them at your own servers. If a forced host names a server that is not in [servers], Velocity reports the config as invalid and will not start.

Step 3: Configure each Paper backend

Do this on every backend server:

1. In server.properties, set online-mode=false and set server-port to the port you used in [servers].
2. In spigot.yml, make sure settings.bungeecord is false.
3. In config/paper-global.yml, fill in the proxies.velocity section:

proxies:
  velocity:
    enabled: true
    online-mode: true
    secret: 'paste the text from forwarding.secret here'

online-mode here must match online-mode in velocity.toml. Restart the backend after saving. Paper 1.18.2 and older use paper.yml with settings.velocity-support instead.

Fabric and Forge backends need a small mod for modern forwarding: FabricProxy-Lite for Fabric, and ProxyCompatibleForge for Forge 1.14 and newer.

Step 4: Sort out your ports

Only the proxy needs to be reachable by players. Each backend needs its own free port.

• Same machine → give backends ports like 30066 and 30067, and set server-ip=127.0.0.1 in their server.properties so nobody outside can reach them.
• Different machines or a host → use each backend's real address and port in [servers], and rely on modern forwarding plus a firewall if you have one.

Step 5: Test it

Start the backends, then the proxy. Join using the proxy address, then type /server survival. Now try to join a backend directly by its own address. You should be refused. If you get in, your forwarding is not set up correctly, so fix that before you open the network to players.

Running a Network on a Hosting Panel

On a host, each server in your network is its own server with its own address. On EternalZero, Velocity is one of the options in the Versions Changer, so the proxy is just another server you switch to Velocity. Your lobby and survival servers stay on Paper, and you copy their addresses and ports into the [servers] section.

Two things to check:

• The proxy needs Java 25. Pick the right Java image on the Startup page. Read Which Java Version Does Your Minecraft Server Need? if you are not sure.
• Backends on a host are reachable from the internet, so modern forwarding with a private secret is not optional. It is your main protection.

Plugins on a Network

A network has two kinds of plugins:

• Proxy plugins go in Velocity's plugins folder. They handle things that cross servers: network-wide permissions, chat between servers, server selector commands, and Geyser if you want Bedrock players.
• Backend plugins go in each Paper server's plugins folder, as usual. Your survival server gets land claims and economy, your lobby gets a spawn and a menu.

Velocity plugins are on Hangar and Modrinth. Read our How to Install Plugins guide for the basics, and our Geyser and Floodgate guide if you want phone and console players on your network.

When You Do Not Need a Proxy

A proxy adds a second Java process, more RAM and more places for things to go wrong. Skip it if:

• You run one survival world for you and your friends.
• You only want Bedrock players to join. Geyser runs as a plugin on a single Paper server.
• You want a few worlds but not separate servers. A world management plugin on one Paper server is simpler.
• You do not have the RAM to run at least two backends plus the proxy.

A proxy makes sense when you want two or more separate servers behind one address, or when you plan to grow into a network later.

Conclusion

Velocity lets you put several servers behind one address, so players can move between a lobby, survival and minigames without reconnecting. For a new network, it is the proxy to pick. Waterfall is end of life, and BungeeCord mostly makes sense for old setups.

Start small: one proxy, one lobby, one game server, with modern forwarding turned on and your secret kept private. Once that works, adding more backends is just one more line in velocity.toml.