--- title: "Velocity hosting in Brazil: a proxy for your Minecraft network" description: "Run Velocity with modern forwarding and backends closed off at the firewall. Ryzen VPS with root in São Paulo from R$ 31,00/month for your network proxy." url: "https://streethosting.com.br/en/minecraft-velocity" type: "page" language: "en-US" --- Proxy with modern forwarding # Velocity hosting for Minecraft networks Velocity stitches several instances behind a single address, with signed identity and backends that never sit exposed. It runs on a VPS with root, where velocity.toml and the firewall are files you edit yourself. [See VPS with root for the proxy](https://streethosting.com.br/en/vps-minecraft) [Compare with BungeeCord](https://streethosting.com.br/en/minecraft-bungeecord) * São Paulo, Brazil * Anti-DDoS up to 400 Tbps * NVMe Quick answer You need a proxy when you have more than one instance running at the same time, not when you have a lot of players. Velocity does that with signed forwarding, asks for very little memory and runs on a Ryzen VPS with root from R$ 31,00. ## What triggers a network is the number of instances, not the number of players A well tuned Paper handles a good crowd long before a proxy makes sense. What pushes a project towards Velocity is how many Java processes run in parallel, not how full the server gets. The maths flips once the instances stop being compatible: different versions, different mod loaders, different restart cycles. None of that fits in one server, and that is where the proxy pays for itself. The reverse holds just as strongly: the proxy is one more service to watch and the point everybody passes through. If you run one server and just want one more world, a multiworld plugin is the better answer. ## Modern forwarding: what Velocity signs and why that matters The proxy is what authenticates the player against Mojang, so the backends run with online-mode off and take its word about who just arrived. In legacy forwarding that information travels attached to the handshake, unsigned. Modern forwarding closes the gap with a shared secret: Velocity signs the player data with the contents of forwarding.secret and the backend refuses the connection when the signature does not match. On Paper, that lives in paper-global.yml. Two details trip up more people than the theory does. The secret has to match byte for byte, and a single trailing newline is enough to refuse everyone. And whoever comes in through the proxy gets an online UUID: turning forwarding on for an older server means migrating inventories and permissions. ## An open backend port is the classic mistake when building a network A backend with online-mode off accepts any name. If its port answers on the internet, somebody connects from outside claiming to be the owner and walks in with every permission. That is no fault of Velocity or BungeeCord: it is the price of delegating authentication and stopping halfway. The rule: only the proxy port stays public, 25577 by default, and each backend accepts connections from its IP alone. With UFW that is one rule per backend plus the default deny on incoming. Then test from another network: if the direct connection completes, your network is wide open. ## A proxy asks for good networking, not a lot of memory Velocity loads no chunks, simulates no entities and stores no world. It reads a packet, decides where it goes and writes it again, per player, in both directions. Raising the heap changes almost nothing: what tightens first is the packet rate and the limit on open connections. That is why a small VPS carries the proxy while the backends sit on machines with CPU headroom. What you cannot economise on is distance: every hop between the two ends lands in the ping, and with both in São Paulo that layer drops out of the equation. Infrastructure ## What the foundation has to deliver for a proxy * Root: velocity.toml and forwarding.secret are files, not panel fields. * A fixed IP, so the backends can authorise the proxy and refuse everything else. * Proxy and backends in the same region: the hop between them lands in the ping. Use cases ## Situations where a proxy actually solves something * Survival on Paper and skyblock on Fabric living side by side, which a single Java process cannot do. * A minigame that restarts after every match without taking the lobby down with it. * An event room that goes up on Friday and disappears on Monday, with no address change. Optimization ## Settings that change how the network behaves * The try order in velocity.toml, so a backend going down drops the player into the lobby. * Permissions and economy on a single database, otherwise every backend becomes its own world. * ViaVersion on one layer only, either the proxy or the backends, never both. Comparison ## Velocity and BungeeCord side by side What changes from one proxy to the other, in practice. | Criterion | Velocity | BungeeCord | | -------------------- | ------------------------------------------------------- | -------------------------------------------------------- | | Player identity | Forwarding signed with a shared secret, built in | Forwarding without a signature, or BungeeGuard bolted on | | State of the project | Active, and recommended by the Paper team itself | Conservative, and the Waterfall fork was discontinued | | Natural pick | A new network, or one willing to swap its proxy plugins | A network tied to a plugin that exists only for Bungee | If your proxy plugins have a Velocity counterpart, migrating comes out cheaper. If one of them does not, BungeeCord holds its ground. Checklist ## Before you publish the network IP * Connect to each backend port from outside and confirm that it refuses. * Check that forwarding.secret is identical on both sides, with no leftover newline. * Switch servers and come back, checking that UUID and rank stay the same. * Take a backend down on purpose and see whether the player lands in the lobby. ## Frequently asked questions 01 How many players justify moving to a Velocity network? No number justifies it on its own. The criterion is how many instances need to exist in parallel. For more worlds on the same server a multiworld plugin does the job; for different versions or loaders, the proxy is the way. 02 What does the foundation for proxy and backends cost? The proxy fits on a 2GB VPS Ryzen Budget at R$ 31,00 per month. It is the backends that need headroom: the Ryzen Performance line starts at R$ 42,00 with 2GB and passes R$ 126,00 at 8GB. 03 Do I still have to close the backend ports when using modern forwarding? You do. With online-mode off, anyone who can reach that port comes in under whatever name they like. Signed forwarding protects the people arriving through the proxy, it does not stop somebody from going around it. 04 Can I migrate from BungeeCord to Velocity without losing players? You can, and the real work is in the proxy plugins. Bring Velocity up in parallel, sort out forwarding and the firewall, and only then move the DNS. If the network already ran with online UUIDs, the data stays intact. Keep reading ## Background reading before you build the network * [Velocity and BungeeCord: when to use a proxy Both proxies, and when neither is necessary.](https://streethosting.com.br/en/guides/minecraft/velocity-vs-bungeecord) * [UFW firewall on an Ubuntu VPS Rules that let only the proxy talk to the backends.](https://streethosting.com.br/en/guides/vps/ufw-firewall-ubuntu-vps) * [Hosting Paper on a root VPS Preparing each backend, with a service and restarts.](https://streethosting.com.br/en/guides/vps/host-paper-minecraft-server-on-vps) * [Latency and ping on a server Why the distance between the two ends shows up in the ping.](https://streethosting.com.br/en/guides/infrastructure/what-is-latency-and-ping) 4.7/5 on Trustpilot Money-back guarantee Activation in 60s Premium support Trusted by 2,500+ customers ## Where StreetHosting fits into this architecture * VPS with KVM and root for the proxy, with a fixed IP to authorise on the backends. * Separate backends, each scalable on its own as it grows. * A forwarding and firewall review with support in Portuguese before opening day. [See VPS with root for the proxy](https://streethosting.com.br/en/vps-minecraft) [Contact support](https://streethosting.com.br/en/contact) A network only stands up when the proxy is the single public address and everything else talks quietly behind it.