Real-IP forwarding issues

When real-IP forwarding is misconfigured, every player on your backend shows the edge IP instead of their real IP. Symptoms are obvious once you know to look — the consequences (mass-bans, broken antibot, useless geo-analytics) are not.

Symptom: all players show the same IP

Your backend logs / LiteBans / antibot all report the same IP for every player. That IP belongs to Infinity-Filter, not to your players.

Cause: real-IP forwarding isn’t enabled, or is enabled on only one side.

Fix:

[advanced]
haproxy-protocol = true

token: "{paste-the-token}"
allow-external-connections: true
geyser-support: true   # only if Geyser runs standalone

Symptom: every connection fails after enabling PROXY protocol

You enabled PROXY protocol on only one side — either in the panel but not in Velocity, or in Velocity but not in the panel. The two must agree.

Fix: enable it in both places, then restart Velocity.

Symptom: weird disconnects, “header parse error”

Both PROXY protocol and the IF plugin are running. Each wraps the connection; combining them double-wraps and breaks the handshake.

Fix: pick one. Remove the IF plugin JAR if you want PROXY protocol; remove PROXY protocol toggle if you want the IF plugin.

Symptom: LiteBans mass-bans the proxy IP

An admin banned a player whose IP, on the backend, looked like the proxy IP. LiteBans then cascade-banned everyone else with the same IP — effectively locking out the entire player base.

Cause: real-IP forwarding off → every player looks like the proxy.

Fix:

1. Enable real-IP forwarding (PROXY protocol recommended).
2. In LiteBans, lift the ban on the proxy IP and unban affected players.
3. Going forward, real bans will target real player IPs.

Symptom: backend timeouts at high traffic only

Real-IP forwarding can look healthy at low load but fail at high load. The actual cause is usually compression-threshold mismatch:

• Velocity in front: network-compression-threshold = 256
• Spigot behind: network-compression-threshold = -1

This is destabilising at high player counts.

Fix: match the values on both sides.

Symptom: real IP not visible for Bedrock players

Infinity-Filter always sends the Bedrock player’s real IP to Geyser with the PROXY protocol on the handshake (signaling). See Geyser (Bedrock):

• In Geyser (build 1280 or later): our IP list in advanced.bedrock.haproxy-protocol-whitelisted-ips, and advanced.bedrock.prefer-signaling-proxy-address: true. Without that last line (it’s false on a fresh install), Geyser takes the IP of the WebRTC (UDP) stream and every player shows an Infinity-Filter IP. advanced.bedrock.use-haproxy-protocol no longer exists since build 1280.
• Friend joins through MCXboxBroadcast show the Broadcaster’s IP with that setup. To get the right IP for every join, turn on the NetherNet PROXY protocol (UDP) on the Backends page and, at the same time, set webrtc-proxy-protocol-relays to our IP list and prefer-signaling-proxy-address: false in Geyser.
• If Geyser runs standalone, to pass the real IP on to your Java proxy: advanced.java.use-haproxy-protocol: true, and PROXY protocol enabled on Velocity / BungeeCord.

Diagnostic: verify it actually works

After enabling, have a player connect and check your backend logs:

The IP shown should be the player’s, not Infinity-Filter’s.

Common one-line diagnoses

What’s next