Why you need this
Behind Arvoris, player connections arrive from the protection network — so without PROXY protocol, BungeeCord logs every player as the edge's IP. Bans hit everyone, alt detection breaks, geo plugins lie. PROXY protocol fixes it by prefixing each connection with the player's true address, and it's included on every Arvoris plan — including Free.
Step 1 — edit config.yml
Open `config.yml` in your BungeeCord folder and find the `listeners:` section. Add `proxy_protocol: true` to your listener, alongside the existing keys:
- `listeners:`
- `- host: 0.0.0.0:25577`
- ` proxy_protocol: true`
- ` motd: '&1Your server'`
- ` max_players: 100`
Indentation matters — `proxy_protocol` sits at the same level as `host`. If you run multiple listeners, set it on the one your Arvoris backend points at. On a Pterodactyl host, edit the file through the panel's file manager; nothing about your egg or startup command changes.
Step 2 — restart, don't reload
Fully restart the BungeeCord process. The listener socket is created at startup, so `/greload` or plugin reloads won't apply the change. In the Arvoris panel, make sure your network's backend targets this listener's address and port (for example `203.0.113.7:25577`).
Step 3 — verify it worked
- Join through your play domain (the one pointing at the Arvoris edge) — the connection should succeed normally.
- Check the console or run `/ip <name>` — the logged address should be the player's real IP, not an edge IP.
- Try connecting to the backend IP directly — it should fail. That's correct behavior, confirmed below.
Troubleshooting
| Garbled handshake / 'Invalid PROXY protocol header' spam | Non-PROXY traffic is hitting the listener — direct connections, uptime pingers, or DNS still pointing at your backend instead of the edge |
| Players see edge IPs in logs | proxy_protocol not applied: wrong listener, indentation error, or the proxy was reloaded instead of restarted |
| Nobody can connect at all | Backend address or port mismatch in the panel, or your DNS record hasn't propagated to the edge endpoint yet |
| Backends show the proxy's IP | Separate issue — enable ip_forward: true in BungeeCord and bungeecord: true in each backend's spigot.yml, as with any Bungee network |
Direct connections failing is the point
Once `proxy_protocol: true` is set, only traffic that has passed through Arvoris' filtering can complete a handshake with your proxy. An attacker who scrapes or leaks your backend IP and aims a booter or bot wave straight at it gets connection resets instead of a way around your protection. Enable it only when all legitimate traffic comes through Arvoris — which, for exactly this reason, it should.
Common questions
Where exactly does proxy_protocol go in the BungeeCord config?+
In config.yml, inside the listeners section, at the same indentation level as host and max_players — one entry per listener. Set proxy_protocol: true, save, and fully restart BungeeCord (a plugin reload is not enough; the listener socket must be recreated).
Is the config the same on Waterfall?+
Yes. Waterfall is a BungeeCord fork and uses the identical config.yml structure — the same proxy_protocol: true key under the listener works unchanged. Velocity is different: it uses haproxy-protocol = true in velocity.toml, covered in the Velocity guide.
Why can't I connect directly to my server's IP anymore?+
Because with PROXY protocol enabled, BungeeCord requires every connection to open with a PROXY header — and a direct connection from a Minecraft client doesn't send one, so it's rejected. That's a feature, not a bug: anyone who discovers your backend IP and tries to bypass Arvoris gets refused at the socket.
I'm seeing 'Invalid PROXY protocol header' or garbled handshake errors in the console. What's wrong?+
Something is reaching that listener without speaking PROXY protocol — usually a player connecting straight to the backend IP, a monitoring ping, or your DNS still pointing at the server instead of the Arvoris edge. Confirm your play domain resolves to your assigned edge endpoint and that nothing else connects to that port directly.
Do I need proxy_protocol on my Paper/Spigot backends too?+
No. Arvoris speaks PROXY protocol to BungeeCord; BungeeCord then forwards the real IP to your backend servers through its normal ip_forward mechanism, exactly as before. Only the listener facing Arvoris changes.
Running Velocity instead? The Velocity PROXY protocol guide covers the equivalent `haproxy-protocol` setting. Not protected yet? Create a free network first — this config only makes sense with Arvoris in front.