A Waterfall proxy lets players use one public Minecraft address while it routes them to separate backend servers such as a lobby, survival world, or minigame network. The reliable pattern is: authenticate players at the proxy, enable BungeeCord forwarding on every backend, define those backends in the proxy configuration, block direct public access to the backend ports, and start the backends before the proxy.
Playing with friends? Godlike.Host runs hosted Minecraft Java servers from 10 data-center locations, with free DDoS protection.
Waterfall’s maintenance status is not consistently reported: a third-party guide says the Paper team marked it end-of-life on March 26, 2024, while the material available for this guide does not independently confirm that statement. Check PaperMC’s current project channels before deploying a new production network. The procedure below explains the configuration model and the checks you need regardless.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Minecraft | Java & Bedrock Deluxe Collection | Windows Digital Code | $39.99 | Buy on Amazon |
| 2 |
|
Minecraft | Java & Bedrock Ultimate Collection | Windows Digital Code | $49.99 | Buy on Amazon |
| 3 |
|
Minecraft | Standard Edition | XBOX Digital Code | $19.99 | Buy on Amazon |
| 4 |
|
Minecraft | $6.99 | Buy on Amazon |
| 5 |
|
Minecraft - Bedrock Edition PS4 | $42.98 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What a Waterfall proxy does
Without a proxy, each Minecraft server normally has its own address and port. Players must know those endpoints and authenticate separately. Waterfall sits in front of the servers and presents one public address. It accepts the player connection, performs authentication, and transfers the player to a selected backend.
A common network looks like this:
- Proxy: the only service exposed on the public Minecraft port, normally 25565.
- Lobby: the first destination and the fallback when another server is unavailable.
- Survival or other game servers: separate backend processes with their own worlds, plugins, and ports.
The proxy and backends can share one machine or run on separate private machines. The security rule is the same in both cases: a backend must not be reachable from the public internet when it has authentication disabled.
#1 Best Overall
- DELUXE COLLECTION — Includes Minecraft: Java & Bedrock Edition, three Bedrock add-ons, three exclusive Character Creator items, and 700 Minecoins.
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that’s unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world filled with surprises.
- SURVIVE THE ADVENTURE — Face mysterious foes, travel across exciting landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play cross-platform with friends in Bedrock Edition on console, mobile, and PC, or join community servers in Java Edition on PC, Mac, and Linux. Online console multiplayer requires a platform-specific subscription (sold separately).
Check the Waterfall decision before you build
Waterfall is a BungeeCord-compatible proxy, but its maintenance outlook is unclear in the available public material. A host-published guide reports that the Paper team marked Waterfall end-of-life on March 26, 2024; that claim is not independently confirmed here. Before committing a new network, verify the current status, supported Minecraft versions, and security fixes through PaperMC’s own channels. If the project is no longer receiving fixes for your target version, use a maintained alternative instead of exposing an obsolete proxy.
Prerequisites and network layout
Install the software you actually need
- A Waterfall build compatible with the Minecraft versions used by your network.
- One Java runtime supported by that Waterfall build and by your backend server software.
- One or more Spigot-compatible backend servers, each with its own directory, world, port, and plugin set.
- Firewall or hosting-panel access so backend ports can be restricted to the proxy.
- A DNS name is optional; players can connect to the proxy’s public IP address.
Keep each backend in a separate directory. Do not run two servers from the same world directory or let two processes bind the same port.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsChoose non-conflicting ports
The proxy listener and a backend on the same host cannot use the same IP-and-port combination. If the proxy listens on 0.0.0.0:25565, do not also bind a local lobby to port 25565. Use private backend ports such as 25566 and 25567, or place the backend on another machine and use that machine’s private address.
| Component | Example address | Internet exposure |
|---|---|---|
| Waterfall listener | 0.0.0.0:25565 |
Public; this is the address players use |
| Lobby backend | 127.0.0.1:25566 on the same host |
Private; allow only the proxy process |
| Survival backend | 127.0.0.1:25567 on the same host |
Private; allow only the proxy process |
The addresses in the table are examples, not mandatory ports. On a multi-host installation, replace the loopback addresses with private network addresses and restrict the firewall to the proxy’s private IP.
Prepare every backend server
Repeat these changes in each Spigot-compatible backend directory. Make the changes while the server is stopped, then restart that backend.
Rank #2
- ULTIMATE COLLECTION — Includes Minecraft: Java & Bedrock Edition, five Bedrock add-ons, five exclusive Character Creator items, and 1000 Minecoins.
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that’s unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world filled with surprises.
- SURVIVE THE ADVENTURE — Face mysterious foes, travel across exciting landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play cross-platform with friends in Bedrock Edition on console, mobile, and PC, or join community servers in Java Edition on PC, Mac, and Linux. Online console multiplayer requires a platform-specific subscription (sold separately).
Enable BungeeCord forwarding in spigot.yml
Open the backend’s spigot.yml and set the BungeeCord option under the settings section:
Recommended Free Tools
settings:
bungeecord: truePreserve the indentation and existing keys in the file. YAML indentation is structural; a misplaced space can make the setting ineffective or prevent the file from loading.
Disable backend authentication in server.properties
Set the backend’s authentication mode to false:
online-mode=falsePlayers should authenticate at the proxy, not independently at each backend. This setting is safe only when the backend cannot be reached directly by untrusted players. If someone can connect to an offline-mode backend without passing through the proxy, they may be able to impersonate a username.
Bind and firewall the backend
- On a single host, bind the backend to a loopback address such as
127.0.0.1where your server software and network design permit it. - On separate hosts, use private addresses and firewall the backend port so only the proxy host can connect.
- Do not publish backend ports in a hosting panel or router unless the rule is restricted to the proxy’s source address.
- After changing
spigot.ymlorserver.properties, fully restart the backend; a live reload is not a substitute.
Generate and edit the Waterfall configuration
Run Waterfall once, then stop it cleanly
- Place the Waterfall JAR in its own proxy directory.
- Start it once with the Java command appropriate for your system, for example
java -jar waterfall.jar. - Wait for the initial files to be created, then stop the process cleanly.
- Open the configuration file generated by your build. Community guides and a PaperMC issue title refer to
config.yml, while a PaperDocs page is titledwaterfall.yml; because the filename is not consistent across the available material, use the file your build actually creates rather than renaming one arbitrarily.
Set the listener
In the generated configuration, set the listener host and port. A typical listener binds all interfaces on the public Minecraft port:
listeners:
- host: 0.0.0.0:25565If your provider assigns a specific public interface, you can bind to that address instead of all interfaces. Binding to 0.0.0.0 is convenient but makes firewall rules especially important.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that is unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world full of surprises.
- SURVIVAL ADVENTURES — Face mysterious foes, travel across varied landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play solo or join friends in local split-screen and cross-platform play across console, mobile, and PC. Online multiplayer supports up to 8 players.
- COMMUNITY PLAY — Connect with players on community servers, or subscribe to Realms Plus (sold separately) to play with up to 10 friends on a private server.
Turn on IP forwarding
Enable the top-level IP forwarding option:
ip_forward: trueOne community example misspells this as ip_foward. That spelling is not the key you should copy. Use the exact key shown in the official configuration generated by the Waterfall build you installed, and verify that the setting is at the top level rather than nested under a listener.
A host wiki reports that the default may be false and warns that leaving it disabled is a security risk; community setup guides consistently instruct administrators to set it to true. Treat the generated file as authoritative for your version, but explicitly set the value so an unnoticed default cannot change the behavior of your network.
Declare each backend under servers
Define a name, address, MOTD, and restricted flag for every backend. This example uses the non-conflicting local ports from the layout above:
servers:
lobby:
motd: '&1Lobby'
address: 127.0.0.1:25566
restricted: false
survival:
motd: '&2Survival'
address: 127.0.0.1:25567
restricted: falseThe names are labels used by the proxy and by commands or plugins; they do not have to match directory names. The address must be reachable from the proxy host. The motd is the description shown by the proxy for that server, and restricted controls whether a restricted server requires a corresponding permission.
Set fallback priorities
Use the listener’s priorities list to choose the first destination and the fallback order. Put the lobby first:
Rank #4
- Skins! We have biome settlers, city folk, town folk, and more!
- The Nether and all its inhabitants. Fight Ghasts and make friends with Pigmen
- Cross platform play for up to five players between Pocket Edition and Windows 10
- Revamped touch controls, controller support, and a controller mapping screen
- Enhanced Weather effects! Accumulating snow and more
listeners:
- host: 0.0.0.0:25565
priorities:
- lobby
- survivalIf the lobby is down, Waterfall can try the next available entry. Keep the names in this list identical to the keys under servers. A typo produces a destination that does not exist, even though the YAML itself may parse successfully.
Understand player-count settings
Do not assume that the displayed player count and the admission limit are the same setting. One guide describes player_limit as the cap for total players across the network, with -1 meaning unlimited, while max_players controls the number displayed to clients and may differ from the real cap. Confirm the exact key names and behavior in the configuration generated by your Waterfall build before relying on them for capacity control.
Start the network in the correct order
- Stop all servers before editing their files.
- Start each backend server and wait until it has finished loading its world and plugins.
- Confirm that each backend is listening on the address and port declared in the proxy configuration.
- Start Waterfall only after the backends are ready.
- Connect using the proxy’s public address, not a backend address.
Starting the proxy first can leave it with no available destination. It may recover when a backend appears, but starting backends first makes the initial connection and log diagnosis predictable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify that forwarding and routing work
Test the player path
- Join the public proxy address on port 25565.
- Confirm that the connection lands on the lobby named first in
priorities. - Move from the lobby to the survival server using the proxy’s server-selection command or plugin.
- Stop the survival backend and reconnect to verify that the configured fallback behavior is understandable and intentional.
Check identity and location data
On the backend, verify that the player’s UUID, username, and address-related data are what your permissions, banning, and logging systems expect. If every player appears to originate from the proxy or identity data is missing, forwarding is not configured correctly for your build. Do not “fix” this by exposing the backend; recheck spigot.yml, ip_forward, the generated configuration filename, and the backend restart.
Test direct-backend blocking
From a machine outside the server network, attempt to connect to each backend port. The attempt should fail or be blocked by the firewall. Only the proxy should be able to establish a backend connection. Repeat this check after firewall, hosting-panel, or router changes.
Best Value
- Play and share with friends on console, mobile and Windows 10
- discover community creations in the new in-game store
- access new mini games and game modes through servers
Troubleshooting common failures
The proxy says the configuration cannot be loaded
YAML indentation is the most common cause described by setup guides. Compare spaces under listeners, servers, and each server name. Remove tabs, restore the original generated structure, and validate the file before restarting. Also confirm that you edited the file Waterfall actually reads; a build that generates waterfall.yml will not necessarily use a separately created config.yml.
Free tools Windows power users keep installed
One-click scans. No signup required.
The proxy starts, but no backend is reachable
- Check that every backend process is running before the proxy.
- Check the backend port in its own server configuration and compare it character-for-character with the proxy’s
address. - On one host, make sure the proxy listener and backend ports are different.
- On multiple hosts, verify private routing and firewall rules between the proxy and backend.
- Look for a typo in the server name used by
priorities.
Players can join a backend directly
This is a security failure, not merely a routing preference. Remove the public firewall or port-forward rule, bind the backend privately where possible, and allow only the proxy host. Because online-mode=false is required on the backend for proxy authentication, never leave an unrestricted direct path in place.
Players are authenticated twice or rejected
Confirm that the proxy is performing authentication and that each backend has online-mode=false. Then verify bungeecord: true in every backend’s spigot.yml, enable ip_forward: true in the proxy configuration, and restart all affected processes. Mixing a backend that still runs online mode with offline-mode backends commonly produces inconsistent login behavior.
The lobby does not appear as the first destination
Check the spelling and order of the priorities list. The first available name is used; a backend that is stopped, firewalled, or misaddressed is skipped. Ensure the lobby’s key under servers exactly matches the priority entry.
Waterfall, classic BungeeCord, and Velocity
Waterfall retains the BungeeCord configuration model and plugin ecosystem, which is why existing networks often choose it as a drop-in proxy. Classic BungeeCord is generally treated by current guides as outdated. Velocity is the usual modern alternative, but it does not use the same forwarding setup.
| Area | Waterfall | Velocity |
|---|---|---|
| Forwarding model | BungeeCord forwarding; backend spigot.yml uses bungeecord: true, and the proxy uses IP forwarding. |
Modern forwarding with a shared secret; backend Velocity support is enabled and the BungeeCord option is disabled. |
| Backend authentication | Backends use online-mode=false; the proxy authenticates players. |
Backends also rely on the proxy, with forwarding settings matched to the backend software. |
| Compatibility | Useful where existing BungeeCord plugins and configuration are required. | Check every plugin and backend version for Velocity support before migrating. |
| Maintenance decision | Verify Waterfall’s current status and release activity through PaperMC before production use. | Uses a different configuration and forwarding method; follow the version-specific Velocity and backend documentation. |
A guide describing Velocity recommends enabling velocity support in the Paper backend configuration, setting a forwarding secret, and disabling the BungeeCord option in spigot.yml. Do not copy those settings into a Waterfall network: the forwarding protocols are different. Choose one proxy model and configure every backend for that model.
Quick Recap
Operational checklist
- Players have one public address, and only the proxy listener is internet-facing.
- Every backend has
bungeecord: trueinspigot.yml. - Every backend has
online-mode=falseand is protected by firewall rules. - The proxy’s generated configuration has the correct filename and
ip_forward: true. - All backend addresses and ports are reachable from the proxy and do not conflict with its listener.
- The lobby is first in
priorities, and fallback entries match keys underservers. - Backends start before Waterfall, and all configuration changes are followed by full restarts.
- You have checked Waterfall’s current maintenance status and compatibility with your target Minecraft release.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
