Testing Minecraft Proxy Networks - BungeeCord and Velocity Guide

Player -> Minecraft Server (Survival)

Player -> Proxy (Velocity/BungeeCord) -> Backend Servers:
                                         - Lobby
                                         - Survival
                                         - Creative
                                         - Minigames

# Create proxy directory
mkdir velocity-proxy
cd velocity-proxy

# Download latest version
wget https://api.papermc.io/v2/projects/velocity/versions/3.3.0-SNAPSHOT/builds/latest/downloads/velocity-3.3.0-SNAPSHOT.jar

# Rename for convenience
mv velocity-*.jar velocity.jar

java -Xms512M -Xmx512M -jar velocity.jar

# Accept EULA (edit velocity.toml, change eula=false to eula=true)
nano velocity.toml
# Change: eula = false -> eula = true

# Start again
java -Xms512M -Xmx512M -jar velocity.jar

# Server bind address
bind = "0.0.0.0:25577"

# MOTD
motd = "&bMy Minecraft Network"

# Max players
show-max-players = 500

# Player info forwarding (CRITICAL for security)
player-info-forwarding-mode = "modern"  # or "legacy" for BungeeCord compat

# Forwarding secret (CHANGE THIS!)
forwarding-secret = "CHANGE_ME_TO_RANDOM_STRING"

# Servers
[servers]
# First server players join
lobby = "127.0.0.1:25565"
survival = "127.0.0.1:25566"
creative = "127.0.0.1:25567"

# Default server (where players initially connect)
try = [
  "lobby"
]

[forced-hosts]
# Route players based on domain
"lobby.example.com" = [
  "lobby"
]
"survival.example.com" = [
  "survival"
]

# Linux/Mac
openssl rand -base64 32

# Or
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1

# CRITICAL: Disable online mode
online-mode=false

# Server should NOT be exposed publicly
# Bind to localhost or private IP only
server-ip=127.0.0.1

# Use unique ports for each server
server-port=25565  # lobby
# server-port=25566  # survival
# server-port=25567  # creative

settings:
  # IMPORTANT: Disable BungeeCord mode for Velocity
  bungeecord: false

proxies:
  velocity:
    enabled: true
    online-mode: true  # Match Velocity's online-mode
    secret: "SAME_SECRET_AS_VELOCITY_TOML"  # MUST MATCH

# Terminal 1: Lobby
cd lobby-server
java -jar paper.jar

# Terminal 2: Survival
cd survival-server
java -jar paper.jar

# Terminal 3: Proxy
cd velocity-proxy
java -jar velocity.jar

# On proxy console
/glist

# Should show all connected players across all servers

# On lobby server
/list

# Should show players on that specific server

/server survival

# Should seamlessly move to survival server

listeners:
  - host: 0.0.0.0:25577
    max_players: 500
    tab_size: 60
    force_default_server: true
    ping_passthrough: false

# IP forwarding (REQUIRED for player auth)
ip_forward: true

servers:
  lobby:
    address: localhost:25565
    restricted: false
  survival:
    address: localhost:25566
    restricted: false

# Default server
priorities:
  - lobby

settings:
  bungeecord: true  # Different from Velocity!

online-mode=false  # Same as Velocity

# velocity.toml
player-info-forwarding-mode = "modern"
forwarding-secret = "your-secret-here"

# paper-global.yml (backend)
proxies:
  velocity:
    enabled: true
    secret: "your-secret-here"

# velocity.toml
player-info-forwarding-mode = "legacy"

# spigot.yml (backend)
settings:
  bungeecord: true

# Download BungeeGuard plugin
# Place in proxy plugins/ folder
# Place in backend plugins/ folder

# Configure token (both proxy and backend)
# plugins/BungeeGuard/config.yml
allowed-tokens:
  - "your-random-token-here"

# Connect with valid Minecraft account
# Should succeed

# Try connecting with offline mode client
# Should be rejected by proxy

# Try connecting directly to backend server
# Example: localhost:25565 (lobby server)

# Expected: Connection rejected or fake username

# If you can join with any username, forwarding is BROKEN

# On backend server, try to join with:
# - Your real username
# - A fake username like "Notch"

# If both work, forwarding is not configured properly

# Theoretical vulnerability test
# If using legacy forwarding without BungeeGuard:

connect_to_backend(
    address="your-backend-ip:25565",
    username="AdminPlayer",
    spoofed_ip="trusted_proxy_ip"
)

# If this succeeds, your forwarding is BROKEN
# Fix: Use Velocity Modern or BungeeGuard

# Connect to proxy
# Join lobby server (default)

/server survival
# Should switch immediately, no disconnect

/server creative
# Should work again

/server invalid_server_name
# Should show error, stay on current server

# Connect and join lobby
# Stop lobby server (simulate crash)

# Expected: Player kicked with message
# Or: Moved to fallback server (if configured)

[servers]
lobby = "127.0.0.1:25565"
survival = "127.0.0.1:25566"

try = [
  "lobby",
  "survival"  # Fallback if lobby offline
]

Test:
1. Connect 50 bots to lobby
2. All execute /server survival simultaneously
3. Monitor for errors, crashes, or stuck players

Expected:
- All players successfully switch
- No errors in proxy or backend logs
- TPS remains stable

/server survival
/server creative
/server lobby
/server survival
# Repeat rapidly

# Expected: All switches succeed, no errors

# How many players can join per second?
# Test by connecting bots rapidly

# Good: 100+ connections/second
# Acceptable: 50+ connections/second
# Poor: <20 connections/second

# Measure time from /server command to arrival on new server

# Excellent: <500ms
# Good: 500-1000ms
# Acceptable: 1-2 seconds
# Poor: >2 seconds

# Monitor proxy with 100+ players online

top -p $(pgrep -f velocity.jar)

# RAM: Should stay under 1GB for proxy alone
# CPU: Should stay under 50% on modern hardware

Phase 1: 10 bots connect, switch servers
Phase 2: 50 bots connect, switch servers
Phase 3: 100 bots connect, switch servers
Phase 4: 200 bots connect, switch servers

Monitor:
- Connection success rate
- Proxy CPU/RAM
- Backend server TPS
- Packet loss or timeouts

All 100 bots connect within 10 seconds

Monitor:
- How many successfully connect?
- How long until all connected?
- Any errors or crashes?

100 bots connected to lobby
All execute /server survival simultaneously

Monitor:
- Switching success rate
- Time until all switched
- Lobby TPS during exodus
- Survival TPS during arrival

Objective: Verify players can connect to proxy and reach lobby

Setup:
- Start proxy and lobby server
- Configure bots to connect to proxy address

Test:
1. Connect 10 bots
2. Wait 30 seconds
3. Verify all 10 appear in /glist on proxy

Expected: 100% connection success rate

Objective: Validate /server command works under load

Setup:
- Start proxy, lobby, survival servers
- Connect 20 bots to lobby

Test:
1. Bots execute /server survival every 30 seconds
2. Run for 10 minutes
3. Monitor for errors or stuck bots

Expected: All switches succeed, no errors

Objective: Confirm player data forwards correctly

Setup:
- Configure Velocity modern forwarding
- Install test plugin that checks player UUIDs

Test:
1. Connect bot with specific account
2. Check UUID on backend matches real UUID
3. Verify skin data forwarded

Expected: UUIDs match, player data intact

Objective: Test fallback when backend server crashes

Setup:
- Configure fallback servers in velocity.toml
- Connect 10 bots to survival server

Test:
1. Stop survival server (simulate crash)
2. Monitor what happens to connected bots

Expected: Bots moved to fallback (lobby) or kicked gracefully

Objective: How does proxy handle partial network issues?

Setup:
- Connect 50 bots
- 25 on lobby, 25 on survival

Test:
1. Block network traffic to survival server
   (using firewall rules, simulate network partition)
2. Monitor proxy behavior

Expected: Lobby players unaffected, survival players kicked

Target: your-proxy-ip:25577
Bot Count: 20
Join Delay: 1000-2000ms
Protocol: 1.21

Enabled Plugins:
- Auto Reconnect (test connection stability)
- Chat Logger (monitor server messages)

# On proxy
/glist
# Should show bots distributed across servers

# In logs
tail -f proxy/logs/latest.log | grep -i error
# Watch for connection errors, forwarding failures

# On backend servers
/spark tps
# Check if server switching causes TPS drops

Good Results:
✅ All bots connected to proxy
✅ /glist shows bots on correct servers
✅ /server commands execute successfully
✅ No errors in proxy logs
✅ Backend servers maintain 20 TPS

Problems:
❌ Some bots timeout during connection (capacity issue)
❌ /server command fails (misconfigured servers)
❌ Forwarding errors in logs (secret mismatch)
❌ TPS drops when bots switch (performance bottleneck)

# Test connectivity from proxy to backend
# On proxy server:
telnet 127.0.0.1 25565

# Should connect. If not, backend unreachable

# Only allow connections from proxy IP
sudo iptables -A INPUT -p tcp --dport 25565 -s PROXY_IP -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 25565 -j DROP

# Replace PROXY_IP with your proxy's IP
# Repeat for all backend servers

# server.properties
server-ip=127.0.0.1

# Only works if proxy and backend on same machine

# velocity.toml
[advanced]
# Increase timeout
read-timeout = 60000  # 60 seconds (default: 30)