Appearance

Proxy Protocol (IP forwarding) ​

When players connect through Game Shield, your backend sees our IP addresses instead of theirs. Proxy Protocol is a standard that fixes this: it passes each player's real IP address along to your backend, so features like IP banning and per-player logging work correctly.

DANGER

With Proxy Protocol turned off, your backend never sees real player IPs, which breaks things like IP banning. Always keep Proxy Protocol enabled.

Once it is on, every connection must go through NeoProtect. Direct connections stop working, which is exactly what protects your server.

How to enable Proxy Protocol correctly ​

  1. Open the Backends section in the panel.
  2. Enable Proxy Protocol.
  3. Configure your backend server for it (see below).
  4. Restart your server to apply the change.

Your panel setting and your backend config must match. If only one side has Proxy Protocol enabled, players cannot connect.

BungeeCord / Waterfall ​

In config.yml, set:

yaml
proxy_protocol: true

Velocity ​

In velocity.toml, set:

toml
haproxy-protocol = true

Paper 1.19+ ​

Only enable this if you are not running a proxy like BungeeCord or Velocity in front of your server.

Paper supports Proxy Protocol natively since version 1.19, with no plugin needed. In config/paper-global.yml, set:

yaml
proxy-protocol: true

Geyser ​

Proxy Protocol applies to Bedrock players who connect over RakNet. Players on NetherNet get their IP forwarded differently, see Real player IPs.

Turn on Proxy Protocol for your Bedrock backend group in the panel, then set this in Geyser's config.yml:

yaml
advanced:
  bedrock:
    use-haproxy-protocol: true
    haproxy-protocol-whitelisted-ips:
      - https://api.neoprotect.net/v2/public/servers/txt

Do not leave haproxy-protocol-whitelisted-ips empty: NetherNet treats an empty list differently from RakNet. See the RakNet guide for details.

WARNING

advanced.java.use-haproxy-protocol is a different option: it makes Geyser send Proxy Protocol to your Java server. Only enable it if Geyser connects to a server or proxy that expects Proxy Protocol, such as a standalone Geyser in front of a Velocity proxy with haproxy-protocol = true.

NOTE

Stuck on any step? Contact support and we will help.