Forwarding and PaperGuard

Forwarding and PaperGuard

Each backend can use its own forwarding mode in paperproxy.toml. Servers that are not listed use player-info-forwarding-mode from velocity.toml.

[forwarding.servers]
lobby = "modern"
old-pvp = "paperguard"

Modes: modern, paperguard, bungeeguard, legacy, none.

PaperGuard

PaperGuard is signed, replay-proof forwarding for servers that cannot use modern forwarding, for example 1.8 to 1.12 servers.

• Every login is signed with HMAC-SHA256 over all player data, the target server name, a timestamp and a one-time nonce.
• Each server gets its own key, derived from the proxy's secret. A leaked key only affects that one server.
• The backend plugin PaperGuard (Paper 1.12.2+, Folia) checks the signature and rejects everyone while it is not configured.
• Replayed, expired, modified or foreign logins are rejected.

Setup

1. In paperproxy.toml set the server to paperguard.
2. In the proxy console run paperproxy paperguard key <server>. The key is only shown in the console.
3. Put the server name and the key into plugins/PaperGuard/config.yml on the backend.
4. Set settings.bungeecord: true in the backend's spigot.yml.

paperproxy paperguard rotate creates a new secret. All servers then need their new keys.

[paperguard] max-age-seconds (default 10) is how long a signed login stays valid. Keep the clocks of proxy and backends in sync.