How to Set Up BungeeGuard on Your Minecraft BungeeCord Network

BungeeGuard prevents players from bypassing your BungeeCord proxy and connecting directly to your backend servers. Without it, anyone who discovers a backend's IP can connect with online-mode=false and impersonate any player — including admins.

Why BungeeGuard Is Essential

BungeeCord requires backends to run with online-mode=false so the proxy can handle authentication. The trade-off is that backends will accept any username from any client. BungeeGuard adds a shared secret token that backends verify on every connection — only connections coming through the proxy carry the token, so direct connections are rejected.

Install BungeeGuard

token: "your-generated-secret-token-here"

allowed-tokens:
  - "your-generated-secret-token-here"

Verify It Works

Try connecting directly to a backend server's IP and port. You should see:

BungeeGuard - No valid token was provided!

If you can still connect directly, check that:

• The token matches exactly between the proxy and every backend
• BungeeGuard is installed on all servers (proxy + every backend)
• All servers were restarted after configuration

Why This Matters

Without BungeeGuard, your network is vulnerable to UUID spoofing — a player connecting directly can claim to be anyone, including OPs and admins. This is a critical security plugin for any BungeeCord setup.

Alternative: Velocity Modern Forwarding

Velocity has built-in modern forwarding security with a shared secret — no separate plugin needed. If you're starting a new network, consider Velocity instead of BungeeCord + BungeeGuard.

Related Guides

• BungeeCord Guide
• BungeeCord IP Forwarding
• BungeeCord Troubleshooting
• Velocity Guide