Java Edition

Protocol: TCP | DNS: CNAME | Firewall: All condition types

Java Edition uses TCP with a well-defined connection flow. We parse every stage of it:

1. Handshake — We validate the protocol version, server address, and next state fields. Malformed handshakes are dropped immediately.
2. Status — Server list pings are answered at the edge using cached MOTD data from your backend. Your server never sees ping traffic.
3. Login — We validate login start packets and check the username against your firewall rules before forwarding.
4. Play — Once the connection is established, we forward traffic to your backend with PROXY Protocol v2 so your server sees real player IPs.

Bot detection

We catch the common patterns that bot tools use:

• Missing or malformed handshake packets
• Rapid connection cycling from the same IP
• Connections that start the login flow but never finish it
• Protocol version mismatches (e.g., a 1.8 handshake to a 1.21 server)
• Known bot username patterns (configurable through firewall rules)

Compatibility

Works with vanilla, Spigot, Paper, Purpur, Folia, and other server forks. Works behind BungeeCord and Velocity — just make sure IP forwarding is configured so your server receives real player IPs through PROXY Protocol.

Also works with Forge and Fabric modded servers. The proxy only inspects the handshake and login phases, so mod-specific packets in the play phase pass through untouched.