DocumentationНастройкаBackends

Backends

Server and firewall configuration

A backend is your real Java Edition server, where MineGuard forwards filtered traffic. For Bedrock Edition, use Bedrock tunnels.

Adding a backend

Open the network and find the Servers section. To add a backend:

  • Click + Set to create a Backend Set (server group) and give it a name
  • Click Add and enter the IP address, port, and select the Backend Set group
Example
IP:   185.100.50.25
Port: 25565
Primary server — the main backend that receives traffic first. Other backends in the group are used as fallbacks when the primary is unavailable.

MineGuard

Filtered

Backend Set

185.100.50.25

Primary

185.100.50.26

Fallback

Passing the player's real IP

By default, your server sees MineGuard's filter IP instead of the player's real IP. There are two ways to pass the real IP:

Proxy Protocol v2

The standard way to pass the real IP via a proxy protocol header. Enable it in the backend settings using the Proxy Protocol v2 toggle.

The downside is that you need to configure Proxy Protocol support on the Minecraft server side, which isn't always straightforward.

MineGuardRealIP plugin (recommended)

The easiest approach — install our MineGuardRealIP plugin. It passes the real IP without configuring Proxy Protocol and blocks direct connections that bypass the filter. Learn more in the MineGuardRealIP plugin article.

Hide your IP

Protection becomes pointless if an attacker knows your real IP. Make sure:

  • Your IP isn't published anywhere (old DNS records, forums, Shodan)
  • Your server has a firewall configured to only accept traffic from MineGuard
  • You aren't using the same IP for a website or other public services
If your IP has leaked, the only fix is to change it. Contact your hosting provider for a new IP, configure the firewall, and update the backend in MineGuard.

Server firewall setup

On your server you need to allow connections only from MineGuard's IP addresses. You can find our IPs in the control panel on the network page.

The current list of MineGuard IP addresses for whitelisting is available at:

IP list for firewall (JSON)
https://mineguard.pro/api/filter-ips

A plain-text format is also available — one IP per line, convenient for bash scripts and direct firewall imports:

IP list for firewall (TXT)
https://mineguard.pro/api/filter-ips/txt

Add each IP from the list to your allow rules. Example for iptables:

iptables example
# For each IP in the list:
iptables -A INPUT -p tcp --dport 25565 -s <IP_FROM_LIST> -j ACCEPT

# Block all other connections on the server port
iptables -A INPUT -p tcp --dport 25565 -j DROP
The IP list may change over time. Check it periodically and update your firewall rules accordingly.

Multiple backends

If you have multiple servers (e.g. a lobby and game servers behind BungeeCord/Velocity), you can add multiple backends with weights for load balancing.

PreviousDNS SetupNextMineGuardRealIP Plugin