TCPShield Plugin

Documentation regarding the TCPShield Plugin

TCPShield requires our plugin installed to allow access to the TCPShield Network. The plugin should only be run on your "Frontend machines" such as your BungeeCord(s) or Spigot, but never both. Historically, this plugin was referred to as RealIP, but now we simply call it the TCPShield plugin.


Our configuration is very simple, and often requires zero change on your part. only-allow-proxy-connections: true

It is very important you keep the only-allow-proxy-connections to true when in production. If this isn't set to true, you are NOT protected by TCPShield and are vulnerable to scanners which can find your backend IP address.

debug-mode: false

From version to version, this setting will mostly just produce random output only helpful to TCPShield staff. We recommend unless you are testing something for us, you leave this option disabled.

timestamp-validation = 'htpdate'

In order to secure your server from something known as a replay attack, we require that your server is running an up-to-date time. The options for this setting are htpdate which automatically updates time for you, system which keeps your time based on your systems time, or off to disable timestamp validation entirely. If you are having issues regarding time, disabling this is OK for a short period of time. We are actively looking at reworking this system to avoid the requirement of time all together.

Supported Versions

The plugin is a Bungee/Spigot hybrid. As of 5/11 we have tested against the following versions:

  • BungeeCord 1.16.1

  • Spigot 1.12.2

  • PaperSpigot 1.12.2

  • PaperClip 1.12.2

  • Velocity 1.12.2

  • FlameCord 1.16.1

  • Many more!

This does not mean your version of Bungee/Spigot won't work, we just cannot guarantee it at this time. If you find a version in which it doesn't work against, please contact our support. We also ensure the plugin will work on Java 8 and 11.

We do have the ability to support LilyPad, however for many reasons we do NOT recommend you use it. If you need LilyPad support, please reach out to our staff.

Plugin Conflicts

There are some plugins we know of that conflict with the TCPShield plugin. This list is not exhaustive, but at this time the following plugins conflict.

  • ServerMOTDPlus

  • TBD

Please consider reaching out to these authors and asking them to adjust the event priority of their plugins

A General Debugging Tip

If your server is having issues, and you suspect TCPShield may be the issue, you can disable the only-allow-proxy-connections option. You, or a player you trust can be then given the backend IP to directly connect to see if the problem persists. By doing this, you will bypass TCPShield and perhaps find it easier to find the root cause of the issue. However, do not do this for long periods of time. This is risky to leave disabled as a scanner could pickup your MOTD and DDoS your backend directly.

Source Code

The source code to our plugin can be found on GitHub. Pull requests are welcome!