Building a Minecraft Server Network with Velocity

One Minecraft server is fun, but at some point you want more: a survival world and a creative world, or a separate minigames server for events. Cramming everything into a single server quickly becomes slow and messy. The solution is a network: multiple servers behind one address, with a proxy that sends players to the right place.

Velocity is currently the obvious choice for that proxy. Below you'll read why, how such a network fits together and which pitfalls to avoid — with the forwarding secret as the most important one of all.

What does a proxy actually do?

A proxy is a small server that doesn't run a world itself. Players connect to the proxy's address, and it forwards them to one of your real servers: the backends. To players it feels like one big server. They type /server survival or step through a portal in the lobby, and land in a different world without logging in again.

In concrete terms, that gives you:

• One address for everything. Players only need to know a single IP or domain name, no matter how many servers you put behind it.
• Switching without reconnecting. From lobby to survival to minigames, without logging out or juggling server lists.
• Maintenance without total downtime. If you restart the survival server, the rest of the network keeps running and players fall back to the lobby.
• Spreading the load. A heavy minigame or a busy event won't drag your entire network down; every backend has its own resources.

There's an honest downside too: you're suddenly managing multiple servers, and network-wide features such as chat, ranks and an economy need plugins that share data between those servers, often via a database. A network really pays off once a single server becomes genuinely too small — not when you're playing with four friends.

Velocity or BungeeCord?

BungeeCord is the veteran among proxies and was the standard for years. Velocity is the modern counterpart, developed by the team behind Paper. The differences at a glance:

• Performance. Velocity is designed to handle many concurrent players with little memory and scales noticeably better.
• Security. Velocity's modern forwarding signs the forwarded player data with a secret key. BungeeCord sends that data on without a signature and needs an extra plugin such as BungeeGuard to close the same gap.
• Plugins. This is where BungeeCord scores on age: there are simply more old Bungee plugins around. In practice, virtually all major network plugins now have a Velocity version as well.
• Maintenance. Velocity is actively developed, while BungeeCord is mostly maintained for compatibility.

If you're starting a new network today, choose Velocity. BungeeCord really only makes sense if you depend on one specific Bungee plugin without a Velocity alternative — so check that before you choose, not after.

How your network fits together

A minimal network consists of three parts: a Velocity proxy, a lobby and at least one game backend. The proxy's configuration lives in velocity.toml and its core is surprisingly short. Under [servers] you give each backend a name and address, for example lobby = "127.0.0.1:25566" and survival = "127.0.0.1:25567". With try = ["lobby"] you then determine that incoming players start in the lobby.

The backends themselves are regular Minecraft servers, preferably on Paper. Good to know:

• Each backend runs independently, with its own port and its own plugins, worlds and settings.
• On every backend, online-mode in server.properties goes to false: the proxy already verifies accounts on entry, and the backends rely on that.
• Ideally only the proxy is publicly reachable, and the backends accept traffic exclusively from the proxy.

If your proxy and backends run with the same host, the internal connection is short and in practice you'll barely notice the forwarding. That second point above — disabling account verification — feels counterintuitive after every piece of security advice you've ever read, and that brings us to the most important part of the entire setup.

The forwarding secret: small file, big deal

Because your backends run with online-mode=false, they no longer verify accounts themselves. Without an extra safeguard, anyone who knows a backend's address can connect to it directly, under any player name they like — including yours as the owner. This is the classic hole in sloppily built networks, and it is actively exploited.

Velocity solves this with modern forwarding. On first startup, Velocity generates a file called forwarding.secret containing a secret key. The proxy uses it to sign the player data it forwards, and a backend only accepts connections with a valid signature. Here's how to set it up:

1. In velocity.toml, set the forwarding mode to modern.
2. On every Paper backend, enable Velocity forwarding in the Paper configuration and paste in exactly the same secret as on the proxy.
3. Restart the proxy and backends, log in and check that your normal skin shows up — that means your real account info is coming through properly and forwarding is working.

Treat the secret like a password: don't share it with anyone and don't paste it into screenshots or support tickets. If you do go with BungeeCord, at the very least use BungeeGuard or a similar solution to close the same gap.

A lobby that carries your network

The lobby is both the front door and the safety net of your network: everyone enters through it, and if a backend restarts or goes down, players fall back to it. So keep it light and boringly stable:

• Use a small, pre-built map; a void world with a single island is popular for a reason.
• Put players in adventure mode so nothing gets broken or griefed.
• Limit plugins to navigation and decoration: a compass menu or NPCs that let players jump to a server.
• Disable what you don't need, such as mob spawning and weather. That saves resources and keeps your console clean.
• Check that the try list in velocity.toml points to the lobby, so players automatically land there when a backend crashes instead of seeing an error message.

A lobby needs hardly any resources; the heavy lifting happens on the backends. Budget generously there, especially for a survival world where lots of chunks stay loaded.

What does a network cost at MC-Node?

The nice thing about a network built from separate plans: you pay per component exactly what that component needs, and you scale each one independently. A starter network could look like this:

That puts a complete starter network at €12.60 per month. If your survival server outgrows its plan, you only upgrade that plan. All plans can be cancelled monthly and run on NVMe storage with DDoS protection included; you'll find the full range with specifications in the MC-Node Minecraft store.

Start small: proxy, lobby and one backend. Once the forwarding secret is set up correctly and players switch servers smoothly, every additional backend is just a matter of ordering another server, copying the configuration and adding one line to velocity.toml.