UDP forwarding and PROXY protocol

A UDP proxy can forward RakNet traffic and preserve the original client address using PROXY protocol v2. Enable this feature when an upstream UDP proxy sends those headers to your listener. Ordinary router port forwarding does not require it.

On the server or Minecraft proxy receiving the forwarded UDP traffic, create config/raknetify2-proxy-protocol.json:

{
  "trustedProxies": ["192.0.2.10"]
}

Replace the example with the UDP proxy's actual source IP address or a CIDR range you control. The address must match what the receiving listener sees after any intervening NAT. IPv4 and IPv6 literals are accepted. DNS hostnames are rejected. Restart the receiving server or proxy.

Configure the forwarding proxy to send PROXY protocol v2 headers for UDP. Raknetify2 accepts forwarded client addresses only from the listed sources. Direct RakNet connections without those headers are rejected while this configuration is enabled. The TCP listener keeps its existing configuration.

Trust and access

Each listed proxy is trusted to supply client addresses. Restrict access to the backend UDP port in its firewall so only the intended proxy can reach it. Keep the trusted ranges as narrow as your network allows.

The file must contain only trustedProxies, with at least one entry. An empty array is an error. An invalid file prevents the RakNet listener from starting.

To return to direct UDP connections, remove the file and restart the listener. Update the upstream forwarding behavior and firewall rules for the new route at the same time.

If connections fail after enabling this feature, check the proxy's actual source address at the backend, the configured trusted range, and whether the proxy emits UDP PROXY protocol v2 headers.

For Minecraft proxy installation and backend configuration, follow Velocity and BungeeCord.