BungeeCord and Waterfall hosting for a network already live

BungeeCord carried the first generation of Brazilian networks, and Waterfall arrived as a PaperMC fork: same API, same plugins, protocol fixes. PaperMC declared Waterfall discontinued and pointed to Velocity. It still works, but with no active development.

For a new network the smallest regret is Velocity, and this page will not pretend otherwise. Almost every BungeeCord still online today is inheritance: active players, a working shop and plugins written against the net.md_5.bungee API.

What brings a Bungee network down is not lag, it is authentication. With ip_forward enabled in config.yml, the proxy injects the real IP and UUID into the handshake. To accept that, the backend runs with online-mode off and the bungeecord flag on in spigot.yml.

That handshake is not signed: there is no shared secret between proxy and backend. Anyone who can reach a backend port builds the same packet and logs in with whatever UUID they like, the owner included.

The defences work together. On the network side, backends listening only on 127.0.0.1 or a firewall that accepts only the proxy IP. On the application side, BungeeGuard, which covers the day someone gets a rule wrong.

Staying is justified in three cases: a proxy plugin with no equivalent and no source code; an open season, because changing the entry point cuts everyone off if it goes wrong; and a large network that is already stable.

Freezing the version, documenting the configuration and postponing the migration is a legitimate decision. What is not acceptable is finding out which version is running only on the day of the incident.

The expensive part is the proxy plugin: the Velocity API is a different one and nothing from Bungee runs there without a port. Sort the plugins folder into three piles: has a Velocity build, has a replacement, or needs new code. The third pile is the budget.

The cheap part is the backend, because Velocity keeps the legacy plugin messaging channel. Add permissions, MOTD, tab list and the Discord integration. Bring the new proxy up on an alternate port and change DNS last.