TCPShield Plugin
Documentation regarding the TCPShield Plugin
As of February 2022, we now support Proxy Protocol v2. The TCPShield plugin is incompatible with this feature, as well as it's no longer a requirement for our service. Please check out this page for further details.
TCPShield requires our plugin installed to allow access to the TCPShield Network. The plugin should only be run on your "Frontend machines" such as your BungeeCord(s) or Spigot, but never both. Historically, this plugin was referred to as RealIP, but now we simply call it the TCPShield plugin.
Our configuration is very simple, and often requires zero change on your part.
only-allow-proxy-connectionsIt is very important you keep the only-allow-proxy-connections to
true when in production. If this isn't set to true, you are NOT protected by TCPShield and are vulnerable to scanners which can find your backend IP address. timestamp-validationCan be picked between available modes:
- htpdate: uses a synchronized date
- system: uses the system time
- off: deactivates timestamp validation
enable-geyser-supportFor your own safety it is crucial that you do only set this to
true if you are using TCPShield's Geyser tunnel. If you do not follow our advice, your backend is not only easily scannable but your IP is easily queryable by DNS and thus prune to attacks. We do not provide support in case you do this anyways. debug-modeCan be turn on to true to gather useful information that can help diagnosing your issues
pre-login-eventThis option can be toggle either true/false to fix Velocity pre-login issue
prefer-protocollibThis defaults to true so users with ProtocolLib will use that over the regular Paper integration, this is due to that implementation exposing MOTDs to direct connect users, this however does require version 5.x.x of ProtocolLib or it will throw an error, disable that config option if you're using Paper with an unsupported version of ProtocolLib.
How to use this feature:
- 1.Create a file with a
.listextension - 2.
If you are running Spigot standalone (i.e. no proxy in front) you will need to install ProtocolLib for the plugin to work
The plugin is a Bungee/Spigot hybrid. We have tested against the following versions:
- BungeeCord 1.16.1
- Spigot 1.12.2 (Requires ProtocolLib)
- Paper 1.8.8 to 1.19.3 (Requires ProtocolLib)
- Velocity 1.20.1
- FlameCord 1.19
- Waterfall 1.20.1
- Many more!
This does not mean your version of Bungee/Spigot won't work, we just cannot guarantee it at this time. If you find a version in which it doesn't work against, please contact our support. We also ensure the plugin will work on Java 8 and 11.
We do have the ability to support LilyPad, however for many reasons we do NOT recommend you use it. If you need LilyPad support, please reach out to our staff.
There are some plugins we know of that conflict with the TCPShield plugin. This list is not exhaustive, but at this time the following plugins conflict. If you must use a plugin that is known to have conflicts with TCPShield, please refer to our section regarding
proxy-protocol.- ServerMOTDPlus
- TBD
Please consider reaching out to these authors and asking them to adjust the event priority of their plugins
If your server is having issues, and you suspect TCPShield may be the issue, you can disable the
only-allow-proxy-connections option. You, or a player you trust can be then given the backend IP to directly connect to see if the problem persists. By doing this, you will bypass TCPShield and perhaps find it easier to find the root cause of the issue. However, do not do this for long periods of time. This is risky to leave disabled as a scanner could pickup your MOTD and DDoS your backend directly. Last modified 1mo ago