What is BungeeCord / Waterfall / Velocity?

BungeeCord is a Minecraft proxy written by the SpigotMC team. It acts as a proxy between the player’s client and the connected Minecraft servers. End-users of BungeeCord see no difference between it and a normal Minecraft server.

When the player connects to BungeeCord, it bridges the connection seamlessly to the Minecraft server and allows the player to connect. From there, the player can use commands/plugins to move themselves to different servers seamlessly, without having to reconnect to a new server.

It is advised to use Velocity over Bungeecord or Waterfall, as it’s a modern, more efficient & secure proxy software.

What is Velocity?

Velocity is a new, modern Minecraft server proxy. It’s being developed from scratch, with a notable community member Tux (known from NuVotifier, RedisBungee & more) as lead maintainer of the project. It focuses on scalability, flexibility & security. By default, it’s a lot more secure than BungeeCord because of the modern player forwarding system, integrated with modern versions of Paper. It’s a lot more efficient than BungeeCord/Waterfall as well, e.g. there have been instances of 700 players running on a single Velocity instance at 150% CPU usage.

What is Waterfall / Travertine / Other Bungee-forks?

Waterfall is a fork of Bungeee intended to better the ecosystem.

Properly Securing Your BungeeCord

If you're running a BungeeCord network and are not using Velocity, you will need to properly secure your backend servers. Without properly securing your servers, an attacker could set up their own BungeeCord (also known as a “rogue bungee”) and attach it to one of your backend servers, such as a Hub or a Survival server. This would allow the attacker to set the rogue bungee in offline mode, spoof the owner's player name or UUID, and then join as the owner. According to the backend server, the attacker is a legitimate player and the actual BungeeCord does not see the attacker. The attackers could then access information and perform actions that a regular player should not be able to access and exploit the added access.

An example: Someone joined my server as me. They were not listed in my bungeecord server, so I knew they had to have connected a rogue bungee. They proceeded to attempt to delete WorldGuard regions in my Factions spawn. Their UUID did not match mine, so they could not. Instead, they used Plugman (which I had installed for testing purposes) to unload WorldGuard and then several other players joined and proceeded to dump lava and water all over my spawn.

After that, I looked into available options for preventing that from happening. I found three that apply to different environments:

• BungeeGuard – The only option if you are using a shared host
• Firewall Rules – Available for VPS and Dedicated Servers
• Set the server's IP to localhost – Only works if all your servers are on the same physical machine

One thing you want to make sure to do is set ‘ip-forwarding: true’ in your BungeeCord's config.yml. This will allow your BungeeCord to forward the player's IP address. If you do not set this to true, everyone's IP address will be 127.0.0.1 (localhost). This is not ideal since you cannot IP ban localhost.

BungeeGuard is the only of these 3 options that will work on shared hosting since you cannot modify firewall rules and your servers are likely spread across different IP addresses. From BungeeGuard's spigot page: “BungeeGuard is a plugin which adds a security token to the BungeeCord handshaking protocol.” Simply put, it allows your backend server to verify a connection is from a trusted BungeeCord server.

Firewall Rules are more flexible and reliable, on a VPS or Dedicated Server than using BungeeGuard. You have the option to use the system's firewall to control traffic and only allow a specific BungeeCord to send traffic to the backend server. A player's information will come through the BungeeCord and then transfer to the backend server. The firewall will check if the information is coming from an allowed source: your BungeeCord. If it is, then it will let it pass through. If it is not, it will drop the connection or do whatever else you want it to do, depending on how you set up your firewall.

You can use UFW (Uncomplicated Firewall), IP Tables, FirewallD, or whichever firewall with which you are most comfortable that your OS supports. You would need to only allow connections from a specific IP to a specific port or port range.

Setting your server's IP to localhost (127.0.0.1) is one of the easiest manner in which to fix this problem. If all of your servers are on the same physical machine and have the same IP address this will work. If they do not have the same IP address, this will not work. In server.properties, set your IP to ‘127.0.0.1’. Make sure to also include that in the BungeeCord's config.yml for the backend server. The only IP address you don't want on localhost is the BungeeCord itself since players will need to connect to that to access your network.

Additionally, you will need to have localhost loopback allowed.

The way this works is simple: The backend servers are listening on localhost for incoming connections. The BungeeCord sends the player's information through localhost to the specific port you've set for that server. If an attacker scans for open ports, they would not see anything listening on localhost. Also, if they were to somehow obtain the port number of your backend server, they would be unable to connect with a rogue bungee since the connection is not coming from localhost.