--- title: "BungeeCord and Waterfall hosting in Brazil | Legacy proxy" description: "BungeeCord and Waterfall in Brazil for networks already in production: what to close on the firewall, what the fork changed and what migrating to Velocity really costs." url: "https://streethosting.com.br/en/minecraft-bungeecord" type: "page" language: "en-US" --- Legacy proxy, operated with judgement # BungeeCord and Waterfall hosting for a network already live If your network runs on BungeeCord or Waterfall and migrating right now is not an option, the question stops being which proxy is better. It becomes closing the right ports and setting the date to leave. [See VPS with root for the proxy](https://streethosting.com.br/en/vps-minecraft) [Compare with Velocity](https://streethosting.com.br/en/minecraft-velocity) * São Paulo, Brazil * Anti-DDoS up to 400 Tbps * NVMe Quick answer For a new network Velocity is the better call: Waterfall was discontinued by PaperMC and BungeeCord forwarding is not signed. BungeeCord stays justifiable when the network is already in production with proxy plugins that have no equivalent. ## The honest answer before the rest of the page BungeeCord carried the first generation of Brazilian networks, and Waterfall arrived as a PaperMC fork: same API, same plugins, protocol fixes. PaperMC declared Waterfall discontinued and pointed to Velocity. It still works, but with no active development. For a new network the smallest regret is Velocity, and this page will not pretend otherwise. Almost every BungeeCord still online today is inheritance: active players, a working shop and plugins written against the net.md\_5.bungee API. ## The hole legacy forwarding leaves open What brings a Bungee network down is not lag, it is authentication. With ip\_forward enabled in config.yml, the proxy injects the real IP and UUID into the handshake. To accept that, the backend runs with online-mode off and the bungeecord flag on in spigot.yml. That handshake is not signed: there is no shared secret between proxy and backend. Anyone who can reach a backend port builds the same packet and logs in with whatever UUID they like, the owner included. The defences work together. On the network side, backends listening only on 127.0.0.1 or a firewall that accepts only the proxy IP. On the application side, BungeeGuard, which covers the day someone gets a rule wrong. ## When staying is the right call Staying is justified in three cases: a proxy plugin with no equivalent and no source code; an open season, because changing the entry point cuts everyone off if it goes wrong; and a large network that is already stable. Freezing the version, documenting the configuration and postponing the migration is a legitimate decision. What is not acceptable is finding out which version is running only on the day of the incident. ## The real cost of migrating, item by item The expensive part is the proxy plugin: the Velocity API is a different one and nothing from Bungee runs there without a port. Sort the plugins folder into three piles: has a Velocity build, has a replacement, or needs new code. The third pile is the budget. The cheap part is the backend, because Velocity keeps the legacy plugin messaging channel. Add permissions, MOTD, tab list and the Discord integration. Bring the new proxy up on an alternate port and change DNS last. Infrastructure ## What the machine has to deliver for a proxy * Real root for firewall, system limits and the proxy process tree, with no panel in the way. * A stable public IP, because the proxy address is the one printed on the network ads. * A national network: every server switch crosses the proxy twice before reaching the player. Use cases ## The networks that stay on Bungee for good reason * Queue, staff or shop written against the Bungee API, with no author left to port it. * A season in progress, when changing the entry point is the biggest risk on the table. * A large, stable network with migration planned for the map reset. Optimization ## Adjustments worth more than swapping proxies * Close the backends on 127.0.0.1 or behind a firewall before picking a proxy. * Add BungeeGuard on top of the firewall, so a mistyped rule does not turn into admin access. * Split proxy and backends across instances, so a frozen world does not take login down with it. Tech sheet ## How to size the proxy machine A proxy is not a backend: the sizing ruler here is a different one. Where the load shows up Network and clock, not RAM The proxy generates no chunk and runs no world tick: it only decompresses, encrypts and forwards packets. The bottleneck is per-core frequency. VPS Ryzen Budget entry step R$ 31,00/month (2GB, 20GB NVMe, 1 vCPU) Enough for the proxy of a small network with the backends on another instance. VPS Ryzen Performance entry step R$ 42,00/month (2GB DDR5, 20GB NVMe, 1 vCPU) For when the login peak is concentrated and cannot be allowed to form a queue. Edge protection AntiDDoS 400 Tbps The proxy is the only public IP on the network: taking it down takes every backend with it. Comparison ## BungeeCord, Waterfall and Velocity side by side What separates them is maintenance, the forwarding model and the price of leaving. | Criterion | BungeeCord | Waterfall | Velocity | | ---------------------------- | ------------------------------ | -------------------------------------------- | ------------------------------------------ | | Maintenance | Active, at a slow pace | Discontinued by PaperMC | Active, where the ecosystem invests | | Plugin API | net.md\_5.bungee | The same as BungeeCord | com.velocitypowered.api, incompatible | | Forwarding | Legacy, unsigned | Legacy, with BungeeGuard as a patch | Modern, signed by a shared secret | | If a backend is left exposed | Login as any UUID | The same, unless the token is active | Connection refused for lack of a signature | | Suited to | A legacy network in production | A legacy network that wants the fork patches | Any new project | If the middle column describes your network, you are not doing it wrong. You are on software with no active maintenance, a manageable risk with the backends closed and a date to leave. ## Frequently asked questions 01 Is BungeeCord still safe in 2026? It is safe to the extent that you close the backends. Forwarding is not signed, so anyone who reaches a backend port logs in with whatever UUID they like. With 127.0.0.1 or a firewall plus BungeeGuard, the network holds. 02 Waterfall was discontinued. Do I need to migrate now? Not now, but with a date on the calendar. With no active development, a new protocol flaw may never get a fix. Freeze the version and plan the exit for the next season change. 03 Do my BungeeCord plugins work on Velocity? The proxy ones do not: the API is a different one and each needs a Velocity build, a replacement or a port. The backend ones usually survive, because Velocity keeps the plugin messaging channel. 04 Can I run the proxy and the backends on the same VPS? You can, and for a small network it is the simplest arrangement: the backends listen on 127.0.0.1 and stay unreachable from outside. The limit shows up when one backend freezes and takes login with it. Keep reading ## Background reading for anyone running a network * [Velocity and BungeeCord: when to use a proxy The full comparison and when a network really needs a proxy.](https://streethosting.com.br/en/guides/minecraft/velocity-vs-bungeecord) * [UFW firewall on an Ubuntu VPS Rules that block direct access to the backends without locking out SSH.](https://streethosting.com.br/en/guides/vps/ufw-firewall-ubuntu-vps) * [Paper on a VPS with root, from scratch Each backend with its own service, dedicated user and automatic restart.](https://streethosting.com.br/en/guides/vps/host-paper-minecraft-server-on-vps) * [Migrating a server with no downtime Run the new environment in parallel and switch DNS last.](https://streethosting.com.br/en/guides/infrastructure/migrate-server-without-downtime) 4.7/5 on Trustpilot Money-back guarantee Activation in 60s Premium support Trusted by 2,500+ customers ## What we sort out with you before touching the proxy * A read of the current topology: how many backends exist and who talks to whom. * Closing the backend ports and testing from outside before flipping the switch. * A maintenance window with the old proxy still up until the new one passes. [See VPS with root for the proxy](https://streethosting.com.br/en/vps-minecraft) [Contact support](https://streethosting.com.br/en/contact) A legacy network does not need a new pitch. It needs closed backends, the version written down and a date to migrate.