Step 1 — Find your server's allocation in Pterodactyl
Open your server in the Pterodactyl panel and go to Network (or check the address shown at the top of the console page). You'll see the allocation your server listens on — something like `203.0.113.10:25565`, or a node hostname like `node2.yourhost.com:25611`. That IP-and-port pair is your backend address. Note it down; it's the only thing Arvoris needs from Pterodactyl.
Step 2 — Create an Arvoris network with that backend
Register at the panel (the free plan covers up to 15 players), create a network, and enter the allocation from step 1 as the backend. From this point Arvoris knows where to deliver clean traffic — through Cloudflare Spectrum's 500+ Tbps anycast edge and Cryo's Minecraft-aware Layer-7 filtering, with seven PoPs to choose from.
Step 3 — Verify your domain and point DNS at the edge
- Add your domain in the Arvoris panel and complete domain verification (a TXT or CNAME record proves you own it).
- Point `play.yourdomain.com` at your assigned edge endpoint with a CNAME record.
- Using a non-standard port? Add an SRV record (`_minecraft._tcp.play.yourdomain.com`) instead — players still just type `play.yourdomain.com`.
Step 4 — Enable PROXY protocol via the file manager
So your server sees real player IPs instead of edge IPs, enable PROXY protocol in whatever actually accepts connections. All of these files are editable in Pterodactyl under Files — no SFTP needed:
| Velocity | `velocity.toml` → set `haproxy-protocol = true` (full guide) |
| BungeeCord / Waterfall | `config.yml` → under your listener, set `proxy_protocol: true` (full guide) |
| Paper (no proxy) | `config/paper-global.yml` → set `proxies.proxy-protocol: true` |
Restart the server from the Pterodactyl console after saving. Order matters: switch DNS to Arvoris first (or do both in one maintenance window), because once PROXY protocol is on, connections that don't come through Arvoris are rejected.
Step 5 — Test
- Join via `play.yourdomain.com` — you should connect normally.
- Check the console: your join should show your home IP, not a 172.x/edge address.
- Try connecting to the raw allocation (`203.0.113.10:25565`) — it should now fail. That's the protection working: bypass attempts die at the door.
Step 6 (recommended) — Firewall the node
PROXY protocol makes direct connections useless to players, but packets still reach the node. If you control the node (or your host will do it for you), firewall the allocation port so it only accepts traffic from Arvoris' forwarding addresses — then volumetric junk aimed at the old IP is dropped at the kernel, and the only reachable path to your server is through the filtered edge. Small hosts running many customers on Pterodactyl can apply the same pattern fleet-wide; that's exactly the setup the white-label host track productizes.
Common questions
Does Arvoris work with Pterodactyl servers?+
Yes — any Pterodactyl server works as a backend. Arvoris only needs an address and port to forward clean traffic to, and a Pterodactyl allocation (node IP or hostname + port) is exactly that. The egg, startup command and Docker image stay untouched.
Do I need to change my egg or startup settings?+
No. Everything happens outside the container (DNS, the Arvoris panel) or in plain config files you edit through Pterodactyl's built-in file manager — velocity.toml, config.yml or paper-global.yml depending on what you run.
Will I still see real player IPs in my console and plugins?+
Yes. Arvoris forwards the true client address via PROXY protocol on every plan, including Free. Once you enable the matching option in your proxy or Paper config, bans, whitelists and IP-based plugins keep working exactly as before.
Can players still connect directly to the node IP?+
Only if you let them. After enabling PROXY protocol, direct connections are rejected because they don't carry the expected header — a security benefit, not a bug. To close the loop completely, firewall the allocation port on the node so it only accepts traffic from Arvoris.
I run a small host on Pterodactyl — can I protect customer servers under my own brand?+
Yes. The Enterprise plan is built for hosts: white-label protection, SSO and dedicated locations, so your customers see your brand while their traffic rides the Arvoris pipeline. See [DDoS protection for hosts](/minecraft-host-ddos-protection).
Total time for steps 1–5 is around five minutes plus DNS propagation. Create your free network and your Pterodactyl server's allocation stops being a target.