How to Set Up a Velocity Proxy for a Minecraft Network

Why run a Minecraft server network, and how Velocity works

A network lets you run different game modes side by side under one address, give each one its own plugins and resources, and restart one server without kicking everyone off the others.

Players only ever connect to the proxy. The proxy logs them in with Mojang, then passes them to one of the backend servers — ordinary Paper servers that hold the worlds. When a player types /server survival, Velocity moves them to another backend without a disconnect.

• The proxy is light: it holds no world, so it needs far less memory than a game server.
• The backends run in offline mode and trust the proxy to tell them who each player is. That trust is what you have to secure.
• Velocity 4, the current version, needs Java 25 and works with Minecraft from 1.7.2 up to the latest release.

Install Velocity

1. Download Velocity from papermc.io into an empty folder.
2. Start it once with Java 25:

java -Xms512M -Xmx512M -jar velocity.jar

The first start creates velocity.toml and a forwarding.secret file with a random secret. Stop the proxy with end and open the config.

Configure velocity.toml

The settings that matter for a first network:

bind = "0.0.0.0:25565"
motd = "<#09add3>My Network"
online-mode = true
player-info-forwarding-mode = "modern"
forwarding-secret-file = "forwarding.secret"

[servers]
lobby = "203.0.113.10:25566"
survival = "203.0.113.11:25567"
try = ["lobby"]

• bind — the address and port players connect to.
• player-info-forwarding-mode — set it to modern. The default is none, which gives every player an offline UUID; legacy is the old BungeeCord format and only worth it for 1.12 and older servers.
• [servers] — a name and address for each backend. The name is what players use with /server.
• try — where players go on login, and where they are sent if a backend kicks them.

Forced hosts, under [forced-hosts], can send players to a backend by the address they typed — for example survival.yourserver.com straight to survival.

Set up the Paper backends for modern forwarding

On every Paper backend, make three changes and restart:

1. server.properties: online-mode=false — the proxy does the Mojang login now.
2. spigot.yml: settings.bungeecord: false.
3. config/paper-global.yml:

proxies:
  velocity:
    enabled: true
    online-mode: true
    secret: 'paste the contents of forwarding.secret here'

online-mode here must match velocity.toml, and secret must be exactly the text in the proxy's forwarding.secret. Modern forwarding works on Minecraft 1.13 and newer; Spigot servers do not support it, so use Paper or a Paper fork.

Other backends: Fabric servers use the FabricProxy-Lite mod with the same secret, and Forge servers above 1.20.2 need ProxyCompatibleForge. BungeeCord plugins do not run on Velocity.

Keep the backends safe

An offline-mode server will accept any player name. That is safe only if players cannot reach the backends without going through the proxy.

• Modern forwarding is your main protection. A Paper backend with Velocity forwarding enabled refuses anyone who connects directly: without the signed data from the proxy, the login is rejected with This server requires you to connect with Velocity.
• Keep the secret secret. Anyone with forwarding.secret could pretend to be your proxy. Never post it, and change it everywhere if it leaks.
• Firewall the backends where you can. Velocity's own documentation is clear that modern forwarding is not a replacement for a firewall. If the proxy and the backends share a machine, bind each backend to 127.0.0.1 and list them as 127.0.0.1:port.
• Never run a backend in offline mode with forwarding off. That lets anyone join as anyone, including as an operator.

Run a Velocity network on HytHost

Each part of the network is its own server: one for the proxy and one for each backend. The proxy needs little memory, so the smallest plan is enough for it; size the backends by their worlds and players on Minecraft hosting.

1. Turn one server into the proxy. In its Version tab, pick Velocity. The panel installs it and sets bind to the server's own port. Check that Java 25 is selected in the Startup tab.
2. Set modern forwarding yourself. The panel writes a basic velocity.toml with an empty server list. In the file manager, set player-info-forwarding-mode = "modern" and add your backends under [servers] with the address and port each one shows in its panel.
3. Configure each backend as in the Paper section above, with the proxy's forwarding.secret.
4. Point your domain at the proxy and give players only that address.

Every backend has its own public address, so modern forwarding is what keeps direct joins out — do not leave a backend in offline mode with forwarding off. For permissions across the whole network, run LuckPerms on every server with one shared MySQL database; each plan includes databases.