NG HaProxy Support

# NG Proxy Support **Adds HAProxy PROXY protocol support to your Minecraft Forge server.** See real player IP addresses when your server is behind a proxy like **Velocity**, **TCPShield**, **FRP**, **Nginx**, or any other HAProxy-compatible reverse proxy. *** ## Features * **HAProxy PROXY Protocol v1/v2** — Full support for both protocol versions * **Real IP Resolution** — Players connecting through a proxy will show their real IP in server logs, bans, and plugins * **Hybrid Mode** — Supports both proxied and direct connections simultaneously * **Fail-Closed Security** — Connections from unknown IPs are automatically rejected, preventing proxy bypass attacks * **CIDR Notation** — Whitelist entire subnets (e.g. `192.168.0.0/16`) * **TCPShield Integration** — Automatically fetch and whitelist TCPShield server IPs * **Hot-Reload Config** — Reload configuration without restarting the server * **Status Command** — View current configuration and connection stats in-game * **Connection Logging** — Log real player IPs and proxy IPs to a dedicated log file ## Commands | Command |Permission |Description | | --------------------- |---------- |------------------------------------ | | <code>/proxyprotocol reload</code> |OP Level 4 |Reload config without restart | | <code>/proxyprotocol status</code> |OP Level 4 |View current config and active rules | ## Configuration Config file: `config/proxy_protocol_support.json` ``` { "enableProxyProtocol": true, "proxyServerIPs": , "directAccessIPs": , "whitelistTCPShieldServers": false, "logConnections": true } ``` | Option |Description | | ------------------------- |-------------------------------------------------------------------------------------------------------- | | <code>enableProxyProtocol</code> |Enable/disable the mod entirely | | <code>proxyServerIPs</code> |IPs of your proxy servers (Velocity, HAProxy, etc.) — PROXY headers will only be accepted from these IPs | | <code>directAccessIPs</code> |IPs allowed to connect directly without PROXY headers | | <code>whitelistTCPShieldServers</code> |Auto-fetch TCPShield IPs and add them to proxy whitelist | | <code>logConnections</code> |Log real IP and proxy IP to <code>logs/proxy_connections.log</code> | ## How It Works ``` Player → Proxy (Velocity/HAProxy/FRP) → Forge Server (with NG Proxy Support) ↓ Reads PROXY header Extracts real IP Sets player address ``` 1. Your proxy sends a **PROXY protocol header** with the real client IP 2. NG Proxy Support intercepts incoming connections and reads the header 3. The player's address is set to their **real IP** instead of the proxy IP 4. All server logs, ban systems, and plugins see the correct IP ## Security Model NG Proxy Support uses a **fail-closed** model: * ✅ Connections from `proxyServerIPs` → PROXY header is read, real IP is extracted * ✅ Connections from `directAccessIPs` → Allowed without PROXY header * ❌ Connections from **any other IP** → Automatically **rejected** This prevents players from bypassing your proxy to connect directly and spoof their IP. ## Setup Guide ### With Velocity 1. Install NG Proxy Support on your Forge server 2. Enable PROXY protocol in Velocity's `velocity.toml`: ``` haproxy-protocol = true ``` 1. Add your Velocity server IP to `proxyServerIPs` in the mod config 2. Restart both servers ### With HAProxy / Nginx / FRP 1. Configure your reverse proxy to send PROXY protocol headers 2. Add the proxy IP to `proxyServerIPs` 3. Restart the Forge server ## Requirements * Minecraft **1.20.1** * Forge **47.x** * Java **17+** * Server-side only (no client mod needed) ## Credits Made by **xylos** | © 2024-2026 All rights reserved