Articles on: Minecraft

How to Install BungeeGuard

BungeeGuard is a plugin-based security/firewall solution for BungeeCord (and Velocity) proxies. BungeeCord installations are insecure by default, and require additional firewall rules to be configured (using iptables or otherwise) to prevent malicious users from bypassing the proxy and connecting using any UUID and/or username they choose, allowing them to impersonate players and staff members.

This is a well-known issue, and over the years many (even large) servers have been successfully targeted using this attack. BungeeGuard can help and solve this issue.

Table of Contents

Installing BungeeGuard on BungeeCord
Installing BungeeGuard on Velocity
Installing BungeeGuard on your backend servers

Installing BungeeGuard on BungeeCord

This will also work for all BungeeCord forks, like Waterfall, FlameCord etc

Head over to the BungeeGuard SpigotMC page.

Click "Download Now". This JAR file is universal, meaning you won't have to download another one

Once downloaded, Head back over to the Apollo Panel, navigate to your proxy instance and access the File Manager.

Upload the BungeeGuard.jar file to the plugins folder.

If you are using BungeeCord, Ensure ip_forward is set to true in BungeeCord's config.yml. Then restart the proxy. If you have multiple proxies in your network, do this for each of them. Now navigate to /plugins/BungeeGuard/token.yml and make a note of the token.

If you are using Velocity, Set player-info-forwarding-mode to bungeeguard in velocity.toml, and make note of the forwarding-secret. This is the value used for the BungeeGuard token. If you have multiple proxies in your network, do this for each of them.

Installing BungeeGuard on Velocity

Velocity has had built-in support for the BungeeGuard authentication system since version 1.1.0, you just need to enable it in your configuration file!

Navigate to your proxy's File Manager, locate a file called velocity.toml and click on it to bring up the text editor.

In this file, set player-info-forwarding-mode to bungeeguard. Now, this is the point where installation may differ: older builds of Velocity stored

Installing BungeeGuard on your backend servers

Note: You NEED to install BungeeGuard on each server if you are going to use it on your network!
Note: You need to have ProtocolLib installed for this to work! If you're running Paper 1.9.4 or above, you can skip this requirement.

Start by heading over to the File Manager if the Minecraft Server.

Upload the same BungeeGuard.jar file to the plugins folder. Once completed, Restart the Minecraft Server.

Navigate to /plugins/BungeeGuard/config.yml. Add the token(s) generated by the proxy(ies) to the allowed-tokens list. For example:

# Allowed authentication tokens.  

  - "AUSXEwebkOGVnbihJM8gBS0QUutDzvIG009xoAfo1Huba9pGvhfjrA21r8dWVsa8"

Please make sure you remove the default tokens, so the only values in the list are your allowed tokens!

Run bungeeguard reload from the Console.

That's It! You have successfully installed BungeeGuard on your network and made it more secure!

If you require any further assistance, please create a ticket here.

Created By: Greg K.

Updated on: 02/01/2023

Was this article helpful?

Share your feedback


Thank you!