v1.7.3 — fixes the 1.7.2 login break, and configures forwarding on both sides

If you are on 1.7.2, update — it broke every login.

The disconnect (my bug, not IP forwarding)

Internal Exception: io.netty.handler.codec.DecoderException:
Received unknown packet id 21

21 is the Play-state custom-payload id. Packet ids live in per-state namespaces, and Finish Configuration is what moves the server into Play — but 1.7.2's plugin bridge wrote its "hold this player" instruction to the server just before forwarding that packet. So the server read a Play id against Configuration's namespace, couldn't decode it, and dropped the connection. Every login, for everyone.

Fixed, with a test that pins the ordering rather than the symptom.

Worth saying plainly: your IP forwarding was working. Your own log has

xTest (/159.146.99.204:52749) lost connection

— your real address, delivered to the server. Two unrelated failures arrived together and looked like one problem.

Forwarding now sets up both halves, and rescues itself

The Servers page will configure your server for you. Pick a mode, press Set my server up for this: it finds the file, shows you the exact line it would change, and writes nothing until you approve that line. Exactly one line changes — verified byte-for-byte against a real 144-line Paper config — and the original is kept beside it.

And if the two settings ever disagree, the firewall notices. A server not told to expect the forwarding data reads it as the first Minecraft packet, can't decode it, and drops every connection — leaving the server unjoinable for a reason invisible from inside the game. After three connections that die before the server has said a word, forwarding switches itself off, the log names the setting you need, and people can play again. Nothing is written to disk, so the next restart tries again rather than silently disabling something you configured on purpose.

About vanilla

You asked for a method that works on vanilla too. There isn't one, and this is checked rather than assumed — I searched a real Mojang server jar for any forwarding setting. Vanilla has none. It reads the socket it is talking to and cannot be told otherwise; the only forwarding-adjacent key it has is prevent-proxy-connections, which does something different.

That is vanilla's limitation, not this firewall's. Paper and Spigot both have a setting, and the button above will set it. On vanilla, leave forwarding off — the panel now says so specifically instead of failing.

---

664 tests. Windows 10/11, x64.