A Waterfall proxy puts one public Minecraft address in front of two or more backend servers. Players connect to the proxy, authenticate there, and are sent to a lobby, survival world, minigame, or another backend without seeing separate addresses. A reliable setup requires three things: BungeeCord forwarding enabled on every Spigot backend, online-mode=false on those backends, and IP forwarding plus a complete servers list in the proxy configuration.
Playing with friends? Godlike.Host runs hosted Minecraft Java servers from 10 data-center locations, with free DDoS protection.
The procedure is: prepare and lock down each backend, run Waterfall once to generate its files, edit the generated configuration, restart the backends, then start the proxy and test the public address. The examples below assume one machine; adapt addresses and firewall rules if your servers are distributed across private hosts.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What Waterfall does in a Minecraft network
Waterfall is a proxy layer derived from the BungeeCord proxy model. It listens on the address players use, handles the initial connection and authentication, and forwards each player to a backend server. A typical network has a lobby plus one or more game servers:
- Proxy: the only service exposed to players, for example
play.example.net:25565. - Lobby: the first destination and the fallback when another server is unavailable.
- Game backends: survival, creative, minigames, or other Spigot-compatible servers.
Backends must trust the proxy’s forwarding data. Because authentication occurs at the proxy, a backend is normally set to offline mode and must not be reachable directly from the public internet. If someone can connect straight to an offline-mode backend, they may bypass the proxy’s authentication and impersonate another name.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Waterfall does not merge worlds or plugins into one server. Each backend remains a separate Minecraft server with its own world, plugins, port, and resource use. The proxy only decides where connections go and carries player identity and address information between servers.
Before you install: plan the network
Choose ports and addresses
Reserve one listening port for Waterfall, commonly 25565. Every backend needs its own port. If the proxy and backends share a host, do not bind a backend to the same port as the proxy; use distinct local ports such as 25566 for a lobby and 25567 for survival. On separate hosts, use their private addresses and allow traffic from the proxy host.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteDecide where authentication happens
Players should authenticate at the proxy. Consequently, each backend uses online-mode=false and BungeeCord forwarding in spigot.yml. This is safe only when backends are firewalled so that the proxy is the sole path to them.
Prepare access and backups
- Use the Java runtime required by the Waterfall build you select; check that build’s release notes before launching it.
- Have shell or control-panel access to every backend and to the proxy host.
- Back up each backend’s
server.properties,spigot.yml, worlds, and plugin configuration before changing settings. - Record each backend name, address, port, and intended fallback order.
Step 1: Configure every backend server
Enable BungeeCord forwarding in spigot.yml
Stop the backend before editing it. Open its spigot.yml, find the settings section, and set:
settings:
bungeecord: trueKeep the existing indentation and surrounding keys generated by your Spigot or Paper build. YAML uses spaces; a tab or misplaced indentation can prevent the file from loading.
Disable backend authentication
In that backend’s server.properties, set:
online-mode=falseAlso assign a unique server-port to the backend. Restart the backend after changing either file so the settings are actually read.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Block direct public access
Bind a same-host backend to a loopback address where practical, or enforce a firewall rule that permits its port only from the proxy host. A backend listening on a public interface while offline mode is enabled is an authentication bypass, not a harmless alternate entry point. On a multi-host network, place backends on a private network or allow-list the proxy’s private address and deny all other sources.
Repeat exactly for each backend
Every backend must use the same forwarding model. Configure the lobby, survival server, and any minigame server separately; changing only the lobby is not sufficient. Keep a written map of names to ports, because those names will be referenced by Waterfall’s servers and priorities entries.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Step 2: Run Waterfall once to generate its files
Create a dedicated directory for the proxy and place the Waterfall JAR there. Start it once with the Java command supplied by your hosting panel or launch script, for example:
java -jar waterfall.jarThe first run creates the proxy’s configuration and supporting files. Stop the process cleanly after generation; do not edit a file while Waterfall is still running, because a shutdown can overwrite unsaved changes.
Recommended Free Tools
Most installations create config.yml. Some documentation and builds refer to waterfall.yml instead. Use the filename that your own build creates and that the startup log reports. Do not create a second file with the other name and assume it will be read.
Step 3: Edit the proxy configuration
Preserve the generated structure and comments, then change the listener, forwarding, backend definitions, and priorities. Key names have varied between builds, so compare your file with the official file generated by that exact Waterfall version. In particular, one community example misspells the forwarding key as ip_foward; the intended key is normally ip_forward, but you should copy the spelling used by your generated configuration rather than blindly pasting a web snippet.
Listener address
Set the listener to the public interface and port players will use. Guides commonly show:
listeners:
- host: 0.0.0.0:255650.0.0.0 means all interfaces. If your host has multiple network interfaces, bind to the specific private or public address required by your firewall instead. The DNS name players enter should point to this proxy host, not to a backend.
Enable IP forwarding
At the top level of the configuration, enable forwarding:
ip_forward: trueOne host wiki says this option defaults to false and warns that leaving it disabled is a security risk; community setup guides consistently instruct administrators to set it to true. Verify the default in your build and set it explicitly rather than relying on a default.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Declare every backend under servers
Each server entry needs a unique name, an address, a message of the day, and a restricted flag. This illustrative fragment uses separate local ports for the proxy, lobby, and survival backend:
servers:
lobby:
address: 127.0.0.1:25566
motd: '&1Lobby'
restricted: false
survival:
address: 127.0.0.1:25567
motd: '&2Survival'
restricted: falseIf your backends are on other machines, replace the loopback addresses with their private addresses and confirm that the firewall accepts connections from the proxy. The names lobby and survival are arbitrary, but the spelling must match everywhere it is referenced.
Set fallback priorities
The priorities list determines where a player is sent first and which server is tried next if the first is down. Put the lobby first, followed by a suitable fallback:
priorities:
- lobby
- survivalPlace this list in the listener section where your generated file expects it. If a backend name in the list does not exist under servers, the proxy cannot use it as a destination.
Understand player-limit fields
Waterfall configurations may expose both player_limit and max_players. A guide describes player_limit as the cap on total network players, with -1 meaning unlimited, while max_players is the player count displayed to clients and can be different. Treat these as separate controls; changing the displayed number does not necessarily raise the connection limit. Confirm the exact behavior in the configuration comments shipped with your build.
Illustrative combined fragment
The following is a compact example, not a replacement for your generated file. Merge the values into the existing sections and retain required keys that are not shown:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ip_forward: true
servers:
lobby:
address: 127.0.0.1:25566
motd: '&1Lobby'
restricted: false
survival:
address: 127.0.0.1:25567
motd: '&2Survival'
restricted: false
listeners:
- host: 0.0.0.0:25565
priorities:
- lobby
- survivalYAML indentation is significant. Use spaces consistently, keep list markers aligned with the generated example, and validate the file before starting the proxy.
Step 4: Start in the correct order
- Stop any running backend and proxy processes before making configuration changes.
- Start the lobby and every other backend. Wait until each server finishes loading its world and reports that it is ready to accept connections.
- Start Waterfall only after the backends are ready.
- Watch the proxy console for configuration or connection errors. A backend that was not started, has the wrong port, or is blocked by a firewall will not be available even if its YAML entry is correct.
Whenever you change spigot.yml or server.properties, restart that backend. A proxy restart alone does not reload backend forwarding settings.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Step 5: Test the finished network
Test the player path
- Connect a Minecraft client to the proxy’s public hostname or IP and port, not to a backend address.
- Confirm that the first destination is the lobby.
- Stop or disconnect the lobby temporarily and verify that the next configured priority is selected, if your fallback policy calls for it.
- Reconnect after restoring the lobby and check that the player can reach the intended backend through the proxy.
Check identity and address information
With forwarding enabled on both sides, the backend should receive the player’s real identity and address information through the proxy. If every player appears to come from the proxy host, forwarding is not enabled or the proxy and backend settings do not match. Do not solve that by exposing the backend; fix the forwarding configuration and restart the affected server.
Check the security boundary
From a network that is not the proxy host, attempting to connect directly to a backend port should fail. This is an intentional result. Test firewall behavior after every network change, especially when moving a backend to a new host or provider.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failures and precise fixes
Waterfall ignores my changes
Confirm that you edited the file the running JAR actually loads. Installations commonly use config.yml, while some documentation labels a Waterfall configuration page waterfall.yml. Check the startup log and the directory containing the JAR. Stop the proxy, edit that file, save it, and start again.
The proxy refuses to start or reports a YAML error
Look first for indentation, tabs, missing colons, or an unclosed quote. Restore the generated file from backup, reapply one change at a time, and start after each change. YAML errors often make the entire configuration unavailable rather than merely skipping one server.
Players cannot connect to a backend
- Verify the backend process is running and listening on the exact address and port in
servers. - Check the backend firewall and host firewall for a rule permitting the proxy.
- Ensure the proxy and backend are using the same network path;
127.0.0.1works only when both processes are on the same machine. - Confirm that the backend name in
prioritiesexactly matches the name underservers.
Players can join directly or impersonate names
This indicates that an offline-mode backend is reachable outside the proxy. Remove its public firewall rule, bind it to a private or loopback address, and allow only proxy-to-backend traffic. Keep online-mode=false on the backend only while that isolation is enforced.
Player IPs or skins appear wrong
Check that ip_forward: true is set at the top level, that every backend has settings.bungeecord: true, and that each backend was restarted after editing spigot.yml. Also verify that you did not copy the misspelled ip_foward key from an example; use the exact key shown in your generated file.
The lobby is not the first destination
Review the priorities order and make sure the lobby entry is spelled identically in both sections. If the lobby is down, Waterfall will try the next priority; restore the lobby before treating that fallback as a configuration failure.
The server list shows an unexpected player count
Check whether you changed max_players, which can be a displayed count, or player_limit, which a guide describes as the network cap. They are not interchangeable. Use the comments in your build’s generated configuration to confirm the intended field.
Hardening and operating the proxy
Firewall policy
Expose only the Waterfall listener port to players. Keep backend ports private, allow proxy-to-backend traffic, and restrict administration ports separately. Recheck these rules after changing hosts, adding IPv6, or enabling a hosting-panel network.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Backups and change control
Back up the proxy configuration and each backend before upgrades. Record the Waterfall build, backend versions, forwarding settings, and port map. Make one configuration change at a time and retain the previous working file so a bad YAML edit can be rolled back quickly.
Logs and monitoring
Monitor both proxy and backend logs. A proxy-side connection error usually points to an address, port, firewall, or stopped backend; a backend authentication or forwarding error usually points to online-mode, bungeecord, or ip_forward. Keep logs available long enough to correlate a player’s connection time with the failure.
Adding a new backend
- Assign a unique private address and port.
- Configure its
spigot.ymlandserver.propertieslike the existing backends. - Firewall the port so only Waterfall can reach it.
- Add a matching entry under
servers. - Add its name to
prioritiesonly if it should participate in fallback. - Restart the backend, then reload or restart the proxy using the method supported by your build.
Removing or renaming a backend
Remove its name from priorities before deleting the server entry. A stale priority can make fallback fail even when all remaining entries are healthy. If you rename a server, update every reference and test from a fresh client connection.
Waterfall versus BungeeCord and Velocity
These proxies are not drop-in configuration equivalents. Choose the forwarding method first, then configure every backend to match it.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Area | Waterfall | BungeeCord | Velocity |
|---|---|---|---|
| Forwarding model | BungeeCord-style forwarding; Spigot backends use bungeecord: true and offline mode behind the proxy. |
Original BungeeCord-style forwarding. | Modern forwarding; backend settings and a forwarding secret differ from the BungeeCord model. |
| Configuration layout | Generated YAML commonly called config.yml; some references use waterfall.yml, so verify your build. |
BungeeCord configuration conventions. | Different configuration files and forwarding keys; do not paste Waterfall YAML into it. |
| Backend compatibility | Designed for BungeeCord-compatible plugins and Spigot-family backends, subject to plugin testing. | Broad legacy compatibility. | Plugins and backend forwarding must explicitly support the modern method. |
| Maintenance outlook | Status is disputed; check PaperMC’s current release and support channels before deploying. | Older technology with less compelling reasons for a new network. | Frequently presented by current guides as the modern alternative, but migration requires reconfiguring forwarding. |
A guide published by a hosting provider claims that the Paper team marked Waterfall end-of-life on March 26, 2024. That is a third-party claim, not confirmation from PaperMC itself. Because maintenance status can change, verify PaperMC’s own project and release channels on the date you deploy. If long-term maintenance and modern forwarding are priorities, evaluate Velocity separately rather than assuming a Waterfall configuration will transfer unchanged.
What changes when moving to Velocity
One migration guide describes enabling Velocity support in paper.yml, configuring a forwarding secret, and disabling the BungeeCord option in spigot.yml. That is a different trust model. Do not leave both forwarding methods half-configured; select one proxy, follow its official backend instructions, and test identity forwarding before opening the network.
Operational checklist
- Players know one public hostname and port: the proxy listener.
- Every backend has a unique private address and port.
- Every backend has
settings.bungeecord: trueandonline-mode=false. - Backend ports are unreachable from untrusted networks.
- The generated proxy file is the one you edited.
- The listener binds to the intended interface and port.
- Top-level IP forwarding is explicitly enabled using the key your build expects.
- Every backend appears under
serverswith a correct address. - The priorities list names valid servers in the intended order.
- Backends start before Waterfall.
- A fresh client test reaches the lobby and fallback behavior works.
- PaperMC’s current Waterfall status and release guidance have been checked before production use.
Frequently Asked Questions
Can I run the proxy and all backends on one machine?
Yes. Bind the backends to loopback or another private interface and give each one a different port from the Waterfall listener. The proxy can then reach them locally while the firewall exposes only the proxy port.
Why does the proxy need offline mode on backend servers?
Authentication is performed at the proxy in this design. Backends receive the authenticated identity through forwarding, so they use online-mode=false; direct backend access must be blocked to prevent authentication bypass.
Is Waterfall still maintained?
The available public claims conflict: one hosting guide says Paper marked it end-of-life on March 26, 2024, while that claim is not independently confirmed here. Check PaperMC’s own project and release channels immediately before deployment.
Can I switch from Waterfall to Velocity by changing one setting?
No. Velocity uses modern forwarding with a secret and different backend settings. Plan a migration, disable BungeeCord forwarding, configure the new method on every backend, and test before exposing the proxy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
