waterfall-help

[marble kelp]

this is most likely a routing issue

then contact the ISP and OVH (or the intermediate network operator that is slow) and see if they can do something about that

of course you can't do much if this is due to some network being overloaded which I wouldn't be surprised if the deep sea connection there is still so poorly developed as it was 5 years ago

[meager wolf]

Is there a video I can watch on how to configure my servers to work with Waterfall?

[winged pilot]

I have one machine in Europe with waterfall on it and I put some backends on it from another machine in the U.S

and it's really laggy, im assuming because of the distances?

[tough vale]

Correct

Data's gotta travel from wherever you are to the europe box, then from there to the backends in US.

I've yet to hear a valid reason for having proxies and backends be in different geolocs without the reason being "this is what I can afford" or similar

If your goal is to attempt to have lower ping for both EU and NA players, that's not how networking works

someone's gonna have poor ping, stick your servers wherever most of your playerbase is

@winged pilot ^

[winged pilot]

ohh ok but yea no I just got a really good deal on this machine from reliablesite

I only use it for testing and stuff anyway

[meager wolf]

so I've got waterfall set up and everything is working, how do I got about adding a portal that takes people from the hub to the seperate server?

[silver lintel]

Or can we install version 1.18.2?

[craggy trout]

What do you mean? Waterfall is a proxy that supports mutiple versions at once (1.8 to lastest)

[obtuse shadow]

latest*

[craggy trout]

bruh

[tidal musk]

what is mean?

[tulip surge]

message.txt by @rain oyster: https://paste.gg/a06b78f50eda48c4b7fe51457fb2f4a6

[reef fulcrum]

it means that something made a web request and the SSL cert was invalid

Caused by: java.security.cert.CertificateExpiredException: NotAfter: Sun Oct 19 03:00:00 TRT 2025

[tidal musk]

hello from the future

[craggy trout]

https://tenor.com/view/hungry-baby-gif-23203493

[hallow idol]

hello, a query. I have seen servers where you enter the survival mode, and when you want to go explore, you have several worlds to choose from, and in each one there are an x number of players, how is that achieved?

that is, you enter a world, and not all the people are together, it is as if another vps or dedicated is separately hosting the survival worlds

[marble kelp]

depends on how you want to setup it really, lots of server have different servers with completely different inventories or you could just use a multiworld plugin if you want it on one single server

and it really doesn't matter if it's the same machine/vps/dedicated server

[dusk perch]

Is there a better way to center a MOTD without doing it manually?

[tough vale]

nope

just screw around with a preview site until you get it looking good

[craggy trout]

&r &ahello

[dusk perch]

What does this mean? erm

[reef fulcrum]

It says, an event took too long to process

[stuck delta]

Can someone help me about this? I always get timeout but my connection is good

[placid elm]

you put a screenshot of half a kick message

full error, proxy logs

[stuck delta]

Not really half is the ip and ip4 from the server

[stuck delta]

There no log in proxy

Also i don't why is pinging when the proxy is off

[placid elm]

there could be a lot of reasons for that

the server is offline,

you have the wrong IP

improper port forward

[stuck delta]

For that i use ip4 from the proxy

[stuck delta]

I used the default port for java edition

[placid elm]

ok is this the same machine that the server is hosted on?

[stuck delta]

25565

[placid elm]

do you use a hosting provider or is this hosted on your pc?

[stuck delta]

Hosting provider

[placid elm]

Ok then, is the server running?

[stuck delta]

Is offline right now but i made it online

[placid elm]

and you are sure the server is on port 25565

some providers don't give you this port automatically

[placid elm]

is that an f before the 25565?

[stuck delta]

Yes

[placid elm]

ok so thats not an IPv4 address

thats an IPv6 address or domain

[stuck delta]

Yes

[placid elm]

is it a domain or an IPv6?

[stuck delta]

Domain

If you ask what domain it is

Is .cf

[placid elm]

alright

can you post your latest.log

https://mclo.gs/

[stuck delta]

https://mclo.gs/ca7jMUz

[placid elm]

bad config

looks like you have -{server} in places in your config where there shouldn't be a -

[stuck delta]

Not really i already fix it

Before i send that i already know there are something wrong in the config file

[placid elm]

ok

you are connecting with the IPv4?

what happens if you connect with the provided domain?

[stuck delta]

Yes and not everytimes i mostly using the ipv6 because i try search the problems from the ip

[stuck delta]

Time out that what happened when i try join not ipv4 abd ipv6

[placid elm]

so

if your home network is on IPv4

you won't be able to connect to IPv6

[stuck delta]

But when i try ipv4 same things happend

So probably something wrong with the ip or the domain

[placid elm]

probably, there seems to be nothing wrong on the servers side

you might want to contact your host about this

[stuck delta]

When i try join there are no ping log in console or proxy log

[stuck delta]

Alright, ty

[placid elm]

yes because it can't find the server, which is a networking issue

so that has to be fixed by your host

[stuck delta]

Also that hosting provider is my friend provider

[stuck delta]

Ty

[tiny robin]

Hi . What it is ?

[reef fulcrum]

something is sending bada data to the query port

[tiny robin]

Is this a problem? Is it somehow possible to see which port it is in order to close it?

[reef fulcrum]

I mean, if you're not using it, just disable the query protocol in the config

[young plank]

Hi , May I ask a question plz?

I think that I've been configured the server program correctly.But my WaterFall can NOT skip to the Forge server still.

and this is the feedback

I've also searched on many searching engines but nothing could be reference

I would be appreciated if somebody could give me a reply🤝 🙏

[unkempt girder]

What version is the forge server?

[young plank]

1.16.5

and I can access the server directly

the forge version is 1.16.5-36.2.30

[unkempt girder]

Theres some problem with forge after 1.12.2, iirc you wont be able to connect to forge server unless its the first server that proxy tries to connect you to

(But im not exactly sure if its like that, you can try finding more accurate info about it in history of #waterfall-help or #velocity-help)

[young plank]

emmm, the advanced server is a vanilla server

when I use the command : server CS01 which is the Forge subserver ,It occured this feedback

the structure is

weird

[young plank]

what iirc is,I've never heard it

[tidal musk]

if I recall correctly

[young plank]

😂 okay

[craggy trout]

You can use ligthfall, wich is a waterfall fork that hacky supports modern forge with server-mod depend.

Actuall forge protocol doesn't allow rigth work with proxies

[young plank]

need I reconfigure the config.yml or just replace Waterfall.jar with Lightfall ?

[marble kelp]

you should just need to change the jar but you also need to install their forge mod which kinda makes the whole thing not viable

[umbral lichen]

Why does it take 10 seconds to connect to a Sub server

It just keeps saying connecting to server

[unkempt girder]

Provide logs

[tidal musk]

Hi. I am setting up a waterfall proxy for me and my friends to play minecraft. I currently have a 1.19.2 hub and 1.19.2 vanilla survival server setup and connected to waterfall. We have started to play RLCraft recently so I created a forge server for it. To make it more clean I want to add it to the proxy so we can easily connect to it without having to keep track of multiple IPs for each server. However as the hub server is running on version 1.19.2 and the forge server is running on version 1.12.2 I am unable to connect to the proxy with the RLCraft client due to the version being outdated. I tried to use Viaversion plugins to go around this, however that just makes it impossible to connect to the forge server when on the hub server. Looking at what the console says it seems that the plugin interferes with the mods installed and the connection ends up timing out. I read the messages above, but I am not sure if the same issue applies here given that the forge server is version 1.12.2 in this case.

[reef fulcrum]

first server you connect to needs to perform the forge handshake in order for forge stuff to work

[young plank]

I am sorry to interrupt agian.Now I've replace WaterFall proxy with Lightfall but I can't connect the server,and this is the feedback of the server .I am sure that I've set the online mode in both proxy's config.yml file and my subservers.

[reef fulcrum]

We don't support lightfall

The things also blatently saying that it's upset that something is in online mode which shouldn't be

[young plank]

Okay,I just thought lightfall is simillar to waterfall.All settings in my subserver are already in offline mode.I won't use lightfall any longer.I can't understand japanese at all😖

OMG ,when I use the waterfall.The problem was happened still

[young plank]

How can I remove this

[reef fulcrum]

if 1.13+, you can't

if older versions, you can iirc, but, more complex

primarily being that you need to use ping-passthrough towards a server which will actually support the FML stuff

[tidal musk]

So the first server on the proxy that someone connects to needs to be a forge server itself, correct?

[marble kelp]

yes

some modpacks don't support server switching properly though

[rocky falcon]

where is download of waterfall for 1.18.2 beacuse

[bold swan]

Most recent version should support 1.8-1.19.2

[rocky falcon]

thanks!

[cold rune]

Hello, I have a server in my network that cannot use ip_forward at this time. 😦 Is there anyway to disable it for a single server?

I dont wish to disable it globally if I can avoid it

well thats unfortunate. Before I go, do you think it would be posible to get spigot/paper to not enforce Ip_forward? ( i understand that would never be offically supoorted due to numerous issues) Similary to the functionaliy of FabricProxy for bungee

[frank anchor]

Hey! I have a Waterfall proxy setup it works great connecting between servers, forge support is also enabled, however when I connect to the Pixelmon server and get into a battle, I get an endless waiting loop on the battle, is there any fix for this?

[left basin]

If I have a 1.19.2 Proxy, can i still connect a 1.18 server or how would i do that?

[craggy trout]

Yes, waterfall supports from 1.8 to latest version

[meager dagger]

Hello, guys!

I'm here with (again) a not very trivial question.

What I have:
1x waterfall proxy
3x 1.19.2 paper servers with NO LOBBY

What I want:
same proxy
same 3x 1.19.2 servers (main1, main2, and creative)

• extra 1.12.2 server (for a small minigame)

Question:
How can I make it possible, using only my one proxy?
On a 1.12.2 server is possible to install the ViaVersion (ViaRewind actually) to allow users with 1.19.2 clients to join the 1.12.2 server.
But.. ok, what if I will not install ViaVersion to my 1.19.2 server? How can I ask Waterfall to push players to 1.12.2?
Like, I can create a lobby. But I want my 1.19.2 main1 server to be main, so it will be the very first server players joining to use my IP.

but for players who joining with 1.12.2 it will be not possible since the main1 is the 1.19.2 server.. Wil taht players will be pushed to 1.12.2 which is in the waterfall priorities: list? Or how?

Thanks ❤️

[unkempt girder]

Guess that if you set-up priority list correctly it should push them to that server eventually

[marble kelp]

yeah, just set the 1.19.2 server as priority 1 and the 1.12.2 as priority 2

if you want more control you could also use my plugin: https://www.spigotmc.org/resources/version-connector.20179/

[meager dagger]

Thanks! Will try it out!

[meager dagger]

nah, it seems like it is not working.
players has been kicked with message that his version is too old..

[reef fulcrum]

Waterfall will work down the priority list to connect them to something

If that's not happening, something else is borking it

I.e. forced host, etc

[meager dagger]

I hava no forced hosts set up..
now, I'm trying to understand how can I config the version-connector..

fuck it
I'll make just another ip:port server

[craggy trout]

deam what a based guy

[elder cradle]

Is disabling online mode on the servers the only way to run Waterfall? I prefer to use online mode to keep out the riff raff.. the Waterfall documentation doesn't go into it, but all of the Bungee cord setup guides tell people to disable online mode.

[craggy trout]

You can enable or disable it, that's the reason why its configurable.

Disable online mode on backend, not on the proxy

[elder cradle]

When it's enabled and players try to connect, the get an error 'server is online mode'

Ok, I will try that out

[reef fulcrum]

The proxy needs to deal with auth, and so the thing the proxy connects to needs to be in offline mode

You'd wanna ensure that people can't connect to the backend servers, i.e. firewall, bungeeguard

[elder cradle]

OK, it's good. The bungie guides were not very clear, so it made it seem like disabling online mode on the proxy was required.

All of my server instances are on a LAN together and the firewall only allows connections to the proxy. That should prevent shenanigans, right?

[reef fulcrum]

yup

[green geyser]

im having a very strange issue where waterfall isnt following the system route table, i have a wireguard tunnel between my VPS and home network, the wireguard network is 192.168.99.0/24 and the VLAN the paper server is on 10.0.0.0/24, basically any time waterfall tries to establish a connection to the server (10.0.0.91), the source IP is the public IP of my VPS' eth0 interface rather than the wg0 interface IP (192.168.99.1) what causes the request to just not complete. Confirmed this using tcpdump, my VPS is running ubuntu 22.04.1, my home router that is running the wireguard peer is running pfsense and my paper server is also running on ubuntu 22.04.1

ive tried multiple different ports, i can ping the paper server from my VPS and the source IP is the wg0 interface IP of the VPS

image 1) waterfall trying to connect to the paper server on port 9000 (set in server.properties and confirmed to be listening on port 9000 using netstat -tlupn)
image 2) successful ping from the VPS to the paper server host and the reply, the source being the wg0 interface IP

[elder cradle]

@green geyser when you setup your routes, did you include the src IP?

ip route add 10.0.0.0/24 via 192.168.99.1 src 192.168.99.100

would tell the OS to send all traffic for 10.0.0.0/24 using 192.168.99.1 as gateway and show the peer a source IP of 192.168.99.100 (where 100 should match your local system's VLAN IP)

There is almost no way this issue is a problem with waterfall, it sounds entirely network related.

[green geyser]

I could try that, I haven't ever had this issue before though with anything else so I kinda assumed it was something with waterfall

[craggy trout]

No, waterfall works good.

I think is stable enougth for saying that the 99.99% of cases are external issues

[elder cradle]

FWIW I do a lot of work with VPN tunnels, so I think the src option would be the first thing to check.

[green geyser]

thanks for the info but it doesnt appear that worked, i do have a feeling it might be something with wireguard or my route config though

[green geyser]

done some more debugging and put the server running paper on the wireguard network (so the paper server could be reached directly on the 192.168.99.0/24 network) and it is still exactly the same thing where packets going to the server have a source IP that is the VPS' eth0 public IP

i can ping the host just fine and luckperms is also able to reach a database thats on the same 10.0.0.0/24 network too so this is looking like something with waterfall to me but im not entirely sure what is going on

that was very weird, i had the listener host set to the public IP of my VPS on port 25565, setting it to 0.0.0.0:25565 fixed this issue

[fallen latch]

how fix it?

spammed my console

[viscid silo]

That's normal?

It's people pining your server from their server list

[fallen latch]

local host?

isnt normal in local

😐 fixed

[craggy trout]

Well that's logic

Disable logs on waterfall.yml if they ass you

[wooden parrot]

chill out

shut up

you posted the same exact message in three help channels

[stark lagoon]

Hello, otherwise than in bungeecord config, Is there a way that will allow me to force the player join to the server that will be designated? plugin for example 🙂
I have correctly set up everything to connect people to the lobby but just dont work, throws people randomly onto different servers

[reef fulcrum]

Outside of the fact that bungee stores the last server people joined, which you can disable by enabling force default in the config, the thing otherwise just runs through the prioritise list

[compact timber]

does anyone know an alternative to https://www.spigotmc.org/resources/commandsync.52093/

It looks like it would fit our needs but their networking doesn't work with pterodactyl containers

[unkempt girder]

https://www.spigotmc.org/resources/synccommands-1-8-1-19-✨-redis-socket-rabbitmq.99596/

[compact timber]

socket has the same issue as the other plugin and I dont have a redis or rabbitmq server

[reef fulcrum]

I mean, unless you're using some shared host, you should just be able to create a second port bind and use that

otherwise, if you can't use anything like that, you're gonna have to use something generally not reliable

[compact timber]

im on our own dedi and have opened a 2nd port on the panel and it still doesn't work. I have tried 127.0.0.1 + 172.18.0.1 like we do for our spigot&bungee servers and I have tried opening it on our public ip

[reef fulcrum]

if you have your own dedi, just install redis?

[compact timber]

both methods result in the plugin not sending commands to spigot server

[compact timber]

I tried even tried the pterodactyl egg and still no joy bungee server can't connect to it

[stoic frigate]

Hello so could somone help me? https://github.com/PaperMC/Waterfall/issues/780#issuecomment-1265713750

[reef fulcrum]

Provide logs from the proxy

but, This is probably going to be a "how are you hosting the server" talk

[stoic frigate]

I truly dont know

ik one thing

its a private hosting

with unlimited resources apparently

like i mean it

[reef fulcrum]

that explains nothing

[stoic frigate]

So what do u wanna know?

[reef fulcrum]

Like, surely you're paying some company or something

[stoic frigate]

Nope its a free hosting

[reef fulcrum]

glhf

[tidal musk]

free
unlimited resources

[stoic frigate]

XD

[reef fulcrum]

I can't see your logs, but 99% of issues around that message is generally stupid stuff like "the server isn't running", or, network configuration issues

One would hope that a hosting company is actually even remotely familiar with the ecosystem outside of small SMP servers

[stoic frigate]

So what do you need to help me?

[reef fulcrum]

logs

But, once again, most of that's gonna probably just be telling you to go speak to your host

[stoic frigate]

latest right?

[reef fulcrum]

Yes

[stoic frigate]

I did but they r dumb af

https://pastebin.com/RdXdNumN

Do u wanna see our chat?

It was mostly yt vids on how tos etup

[reef fulcrum]

So, yea, connection timed out

[stoic frigate]

*setup

[reef fulcrum]

that's generally means that a firewall or something is blocking connections

or, well, no

generally means that a firewall is configured to drop traffic, or, the routing isn't working

[stoic frigate]

So what am i supposed to do?

[reef fulcrum]

Does the proxy have the sam IP address as the backend server you're trying to connect to?

I mean, if either of those things are the case, there is literally nothing you can do

[stoic frigate]

As in for example?

Well yes i think but the port is different

[reef fulcrum]

Yea, that can cause issues

[stoic frigate]

Oh so um

[reef fulcrum]

easy option is to basically have the proxy hosted on a different IP address to all your other servers

otherwise, it would be on the host to try to advise around routing issues

[stoic frigate]

hahah only one nodes available xD

Oh and is everything correct with my config?

[reef fulcrum]

on the surface, yes

[fading rampart]

hi

i need help

[reef fulcrum]

https://nohello.net/

[stoic frigate]

Even after the fix if it doesnt work

what would the prob be

[reef fulcrum]

"the fix"

[stoic frigate]

The firewallla nd dif ip

[reef fulcrum]

No idea

[stoic frigate]

Alright

i gotta test tmrw

but IM POSITIVE

it wont work

since anything i do wont work

[stoic frigate]

And btw in the sub servers only the join throttle to -1 and online mode false and bungee true in spigot need to enabled right?

[reef fulcrum]

enabling bungee mode disables the throtle already

all you need to do is set that and online mode

But, you're not even getting far enough into the connection to matter

[stoic frigate]

Ah ok

[stoic frigate]

Mk REMEMBER in 10 hours i will be back here complaining tht it doesnt work xD

[misty fern]

Is there a website where I can look at the best config entries for Waterfall?

[reef fulcrum]

that makes 0 sense

outside of disabling useless things like the entity metadata rewriting thing, and tablist rewriting if you're in an environment where you can, theres not really anything "better" between configs

[misty fern]

ok

[grand tendon]

Does anyone know of a direct link that I can use to download waterfall/paper from? I want to automate my server updating using powershell and batch scripts.

[elder cradle]

@grand tendon You need to request it from the api. I sent you a DM with more information.

[tiny robin]

Don't know what these mistakes are?

and there are many such requests

[craggy trout]

Seems a tipic l7 ddos into your minecraft port.

[craggy trout]

The only thing I can tell you here, is to get a good firewall, buy a proper antiddos system, more machines to absorb the impact or toggle the handlerboss exceptions with a logfilter

[tiny robin]

Ty

[tiny robin]

the waterfall started crashing frequently with this error

Yes, but there are still 12g of RAM free on the server and 2g are allocated for the proxy

everything worked when there was 80 online at 512 mb, now at 20-30 it drops with 2 gigabytes

The other servers don't crash, only the waterfall

[tulip surge]

dmesg_.txt by @tiny robin: https://paste.gg/c874650379ba4c13a4ed9956ba7a3202

[tiny robin]

Before the fall, there is a lot of this https://paste.gg/p/anonymous/924a3f5021064a11919ad8eca31776a9

[reef fulcrum]

I mean, the thing was basically told to sod off by the OS

Nothing to do with waterfall

Looks like SkinRestorer was inducing a thread being created, but 🤷‍♂️

[tiny robin]

You are talking about antibot, can try it at the plugin level?

[reef fulcrum]

what?

You had like 35k threads running in the proxy apparently

[craggy trout]

You should do what i said you

That attack completly fucked up your vmemory

No, skinrestorer makes poor but not like that

[reef fulcrum]

$ cat /Users/shane/Downloads/hs_err_pid146263.log | grep JavaThread | grep SkinsRestorer | wc -l
   14189

LP ain't doing so great either

$ cat /Users/shane/Downloads/hs_err_pid146263.log | grep JavaThread | grep LuckPerms | wc -l
   18194

oofers

but, yea, the attack generally just seemingly drained you out of resources

[craggy trout]

.

[craggy trout]

Seems that yes, if you have a cracked server a software like that would avoid that huge load into your server

If you have +20 players seems that no

At least if you don't want to pay

[tiny robin]

https://www.youtube.com/watch?v=lytXykobSvo )))

[reef fulcrum]

idk why you're menioning me

It's a typical resource drain

and, software which is generally expected to do stuff, generally doesn't cope well when it's given a lot to do

setup basic security measures, i.e. rate limiting

[tiny robin]

No, I'm already solving the problem) just wanted to share it) sorry

and by the way, at this moment the server did not crash)

[dry wagon]

What are the benefits of using waterfall and does it have much overhead?

My VPS only has 8GB of ram, does it even make sense to set up waterfall on there?

[reef fulcrum]

it's a proxy, unless you're doing things which need a proxy, it would make 0 sense

given that 8GB is really not all that much for even a singular server, you probs don't need or want a proxy

[dry wagon]

Reasonable, thank you

[craggy trout]

Is framing it good

Is caching the exception

[late grail]

im sorry if this is an annoying question but can anyone help me setup waterfall? there is only a few tutorials online and none of them have worked for me

im currently hosting on scala cube so any help would be nice

[delicate phoenix]

I'm not sure what kind of software scala cube uses to run serburs, but usually you either have to select the server type "waterfall", or you can download the jar from the downloads page, and point your startup command to the jar.

[uncut flower]

And why not velocity

[craggy trout]

And why not waterfall

[uncut flower]

Because waterfall is obviously worse

[craggy trout]

Worse on exactly what?

I suggest you make a pull request if you see something bad :)) seems you can make it better.

I don't think you need velocity for a new network, even you can split Waterfall to balance the load.

[reef fulcrum]

Waterfall ain't exactly amazing, I wouldn't recommend bungee for many new networks, but, velocity is still in a bit of a weird area where if you wanna go too far, you'll need devs, something in which the ecosystem of bungee can push out a good chunk

[marble kelp]

if you are serious about building a network as something commercial you should have devs though 👀

[craggy trout]

Why a network should be something commerciable? Most of people does it for funny, because they like it, making a Minecraft network on 2022 for that seems stupid.

[marble kelp]

I didn't say that

[craggy trout]

commercial for me means that

[marble kelp]

I said that >if< you are doing that then you should have devs

if you are not doing it commercially then the chances that you reach a point where you will have issues with a bungee based setup are very low

(of course it never hurts using better software if you have the chance to do so)

[old swallow]

how to solve this

[misty fern]

evening there is a good plugin for proxy fulljoin

[craggy trout]

Wym

You can set the max amount of players on bungee's config

[reef fulcrum]

not enough info

see logs

environment? i.e. version? client? server?

have you tried without plugins?

[craggy trout]

Any stacktrace

[humble thistle]

Hi i want join in a server but appear this message

[reef fulcrum]

99% of the time, stuff like that is borked plugins

[humble thistle]

i have 0 plugins in the server

[reef fulcrum]

And on the proxy?

[humble thistle]

luckperms

only

[reef fulcrum]

can you reproduce on a vanilla client?

[humble thistle]

ok

[reef fulcrum]

server log? proxy log?

[tulip surge]

latest.log by @humble thistle: https://paste.gg/dfd1247e1e3141bdb2c03665b34fd23c

[faint plover]

Can anyone help me with troubleshooting the terra plugin?

[faint plover]

@hardy marsh Any ideas?

[reef fulcrum]

1. don't ping random people

2. wrong channel

3. don't they have a discord?

[faint plover]

No they dont

Sorry

Which channel?

[reef fulcrum]

I mean, it's a paper plugin

That's on terra's plugin page?

[faint plover]

oh what

[eternal fulcrum]

hello

how can we put hex in the messages?

[craggy trout]

Waterfall only handles Legacy colours, use a plugin or modify for your private usage Waterfall

[dusty lichen]

If I'm not mistaken, it's bug in 1.19 and instead of error there should be message that server doesn't support your version

[bright tulip]

Why when I disconnect from my network, it does not take me to the lobby but to the last mode where I disconnected?

I should connect to lobby first before skyblock.

but when entering, it sends me directly to skyblock.

[steel surge]

set force_default_server to true

[vagrant linden]

Hello i have encountered an error in my waterfall server. I dunno what is going on. Is this a plugin side issue? Or something wrong with my jar file? And what is the solution of this issue?

Thanks.

[reef fulcrum]

bad config

[craggy trout]

Your config is wrong

[vagrant linden]

Oh ok thanks!!

[orchid isle]

Is it possible (not with waterfall specifically) to route mc servers using a domain name? Eg. multiple servers reachable via the same port (Basically virtual hosts)

[craggy trout]

Then why you ask here if is not a waterfall specify issue or question

[stoic fog]

There is "way"

If you have domain and on same subdomain you connect multiple servers..

But don't do this. Use proxy

[marble kelp]

@orchid isle yes, you can set "forced hosts" in the waterfall config (and velocity has that functionality too)

if you want to do it without a proxy then no, that's not possible. you would need to have them listen on different ports and route the domains via srv records

[orchid isle]

Yep. I consider using a proxy. The entire thing is just because I want to host multiple MC servers on the same server (via a different domain).

Is there any link you can provide which explains how it'd do that using waterfall?

[orchid isle]

Well, i heavily thought that it would support it, since it is quite verbose.

[marble kelp]

@orchid isle if your goal is to only do the routing by (sub) domain and not specific bungee/waterfall plugins then I would suggest using Velocity over Waterfall/Bungeecord as it's more modern and performant

velocity doc on that: https://docs.papermc.io/velocity/configuration#forced-hosts-section

[craggy trout]

Nice spam of Velocity on these channel

Out of scope

[marble kelp]

I mean they asked here (and velocity chat isn't available) so ¯_(ツ)_/¯

[marble kelp]

@cold creek yes, all commands are sent through the proxy. pretty sure you can just listen to the chat event

ChatEvent even has an isCommand method

[cold creek]

I realised thanks 😄

[hoary blade]

quick question, did i need protocollib in waterfall plugin folder?

[gritty umbra]

No

[mint bison]

When using Velocity, when kicked from the playing server, it is connected to lobby, but Waterfall is disconnected from the server.

How can I solve this?

(It can be unnatural because it uses a translator.)

[reef fulcrum]

Use a plugin

[fervent latch]

could someone point me in the right direction, when the first server listed in priorities is full players attempting to join do not get sent to the second server in priorities and instead just get the kicked while connecting / server full message from the first server.

if the first server is offline the player gets sent to the second server on the priorities list but if the first server is full they just get kicked

[marble kelp]

@fervent latch pretty sure you need a plugin for that usecase, the inbuilt way just looks for servers going down

(or being down I guess)

[fervent latch]

oh i thought the default behavior included checking other servers if the priority ones were full but online

okay thanks, any suggestions for a plugin; ill look for one though

thanks

[wise patio]

Hi, maybe not waterfall related question but does anyone have tutorial how to make patches in my own repo like they are in waterfall repo?

[reef fulcrum]

depends on usecase, but, er; Basically, just copy the scripts and add the project you're forking as a submodule

[buoyant spindle]

Hello. I am creating reverse proxy using VPS. Players would know only VPS's IP (not backend server). The reverse proxy would just redirect all traffic on port 25565 to backend server.

My question is how to make server get real players IP? Becouse now all players would have the same IP address

[craggy trout]

Enable proxy-protocol

[buoyant spindle]

Where?

[wise patio]

um, i've done it and renamed all directories etc. to fit with my project
I've to copy source git directory to basedir /work directory, then what script i need to run to create .patch files?

[buoyant spindle]

Okay, I see. In the waterfall config

[marble kelp]

@wise patio those are just normal diff patch files e.g. like how git can generate them. (also that's more suited for a development channel or #general if not paper/waterfall specific)

I recommend just readin the paper/waterfall scripts, they do exactly that

[pulsar steeple]

Hello, i have a problem with waterfall permissions. the commands to move with /server do not work for me

[marble kelp]

have you set your permissions in the config.yml or setup a permissions plugin on the waterfall proxy?

[pulsar steeple]

if I configure from the server but I put luckperms, does it cause a problem with premissions

[reef fulcrum]

if you want to use luckperms to manage that stuff, you need to have LP installed on the proxy too

and if you wanna have it all linked together, you need to setup the network stuff

[pulsar steeple]

if you ready install and configure LP

i already saw that the problems is i put all the permissions in LP

Thank for your attention

🙂

[molten jackal]

is it possible to keep just one server in offline mode while the rest of the servers are in online mode?

[craggy trout]

Why would you do that?

Seems that some servers haves that system like ->

premium.yournetwork.com
yournetwork.com or np.yournetwork.com

But seems stupid for me, you can just use a login system if you want cracked | online players

[buoyant spindle]

hello, I need help with "proxy_protocol" config in Waterfall's config. There is so little information about it in the Internet but I really need this. I am creating reverse proxy using VPS. And it is working well but all players have the same IP. (VPS's IP).

But when I am enabling proxy_protocol in waterfall's config then nobody can join :/

[marble kelp]

that's for haproxy support iirc

[buoyant spindle]

I am using haproxy in my VPS

to forward traffic

and the traffic is well forwarded, people can join but has the same IP

[marble kelp]

I think haproxy has an option to forward data? not sure, never used that

[buoyant spindle]

data? You mean users IPs?

[marble kelp]

yes

[buoyant spindle]

it can send client's IP but via HTTP header "X-Forwarded-For"

waterfall can handle it?

[marble kelp]

apparently it's the send-proxy-v2 option in haproxy

at least according to this config in the (now unnecessary) BungeeProxy plugin https://github.com/MinelinkNetwork/BungeeProxy#example-configuration

[buoyant spindle]

thanks a lot. It is working! I just add "send-proxy" to backend section at my haproxy config and enabled "proxy-protocol" in waterfall's config. Now everything works. I see real IPs and no one can connect to my server directly (even can't ping directly). Thanks again!

[arctic island]

I dont know what I am doing wrong. Maybe this is the wrong place to ask?
I try to use MySQL as storage backend for Luckperms. But I dont get it to connect.
If i use the same adress, username password and database outside of Waterfall it connects just fine. But using luckperms and waterfall i get connection refused.

20:59:32] [main/INFO] [me.lucko.luckperms.lib.hikari.HikariDataSource]: luckperms-hikari - Starting...
[20:59:32] [main/INFO] [me.lucko.luckperms.lib.hikari.HikariDataSource]: luckperms-hikari - Start completed.
[20:59:37] [main/ERROR] [LuckPerms]: Failed to init storage implementation
java.sql.SQLTransientConnectionException: luckperms-hikari - Connection is not available, request timed out after 5001ms.
        at me.lucko.luckperms.lib.hikari.pool.HikariPool.createTimeoutException(HikariPool.java:696) ~[?:?]
   ...

I am quite used to servers and I am at a loss here what could be wrong.

[hoary blade]

is there anything in waterfall to do for the messagne signature message for chats?

[craggy trout]

All your proxy-plugin databases timed out? If yes, you got probably a ddos or your machine died

[tidal musk]

Not yet

There isn't even api for it yet in paper

[celest gull]

Why its happening that?, The server kick us to the lobby

[tulip surge]

message.txt by @celest gull: https://paste.gg/24d11158aa764284af1992485d73a6a0

[reef fulcrum]

Your server took too long to tick

and you have a plugin inducing network IO on the main thread

[celest gull]

That was does it mean

The plugin

[reef fulcrum]

what?

[celest gull]

ok

one question the plugins is in the Server or in the bungee?

[celest gull]

Or in the fallback server?

[reef fulcrum]

Given that you only provided a log from the server, I can only see what the server said

[celest gull]

You need a log?

[reef fulcrum]

if you see in there, you'll see that you have a plugin which stalled the server

[celest gull]

But you say logs from bungee or the server?

[reef fulcrum]

what

You provided a log

I commented on that log

[celest gull]

I am connecting a vps to a vultam server is that causing the error?

[reef fulcrum]

[13:09:27 ERROR]:               java.base@17.0.2/java.net.InetSocketAddress.getHostName(InetSocketAddress.java:366)
[13:09:27 ERROR]:               PebbleAntiVPN.jar//pebbleantivpn.evnets.PlayerQuit.onDisconnect(PlayerQuit.java:20)

that plugin named in there is doing something which isn't good for performance

your server stalled, maybe you have deeper network issues or something, I can only guess, but, that plugin is trying to make a network request to work out some info about an IP address

[celest gull]

by the way What types of Networks issues

[celest gull]

could be?

[reef fulcrum]

Literally all I can see is that a plugin on the main thread induced a DNS reverse lookup

The fact that it shows up in watchdog suggests that it's a slow request, i.e. maybe a slow DNS server or something, idk

[buoyant spindle]

Hi! Maybe one of you was doing security to prevent bots attack but on the iptables level? (Not just on waterfall). Maybe someone want help?

[median phoenix]

How can I make it so only staff can directly connect to a server with a direct IP but other people not?

[craggy trout]

Probably using some plugin like bungeeguard that bypasses the whitelisted address.

[marble kelp]

that's not really possible without modifying the server/using some hacky plugin

nobody should be able to directly connect to a server behind the proxy. if your goal is to have them join the server instead of your lobby then use forced hosts or a plugin on the proxy that auto-moves the player due to permissions on join

@median phoenix ^

[median phoenix]

Yea forced host but than limit it only to staff

[quartz mauve]

You can set restricted: true on that server in the proxy setting and set right permission for staff that are allowed to join that server

[marble kelp]

that really depends on the rest of the setup if that would work like that though

[tidal musk]

Hi i would have an information how do i change the name of my server version? when i change the name it comes out waterfall (name) how do i stay the name? only? att?

[lunar plover]

hey guys, why when I do /server Test it says "you are already connected to this server"

Test: address: 172.18.0.1:25503 motd: HyperNetwork - Test restricted: false

server-port=25503 debug=false transport-to-use=default server-ip=0.0.0.0

bungeecord is true

check the message above please

[tidal musk]

Does anyone know how to solve it?

[lunar plover]

some motd plugins do that iirc, like cleanmotd

[finite grail]

Hi,
I am not sure if I am over thinking this or under thinking this.... But, how do ender chests work with Bungee?

[proud saffron]

unless you installsome sort of linking plugin each server will have its own enderchest and inventory for each player

[wooden parrot]

no server data is shared between bungee servers

unless you install a plugin yeah

[craggy trout]

on waterfall.yml you can handle that stuff

Any ways i don't see why would you change that, you're using a free open source, at least keep those low credits

[buoyant spindle]

Hi, I have an idea. What do you thing about setting up a waterfall on a different server than paper backend servers? I mean I want to my backend IP (whole dedicated server) be protected.

Additionaly, my Waterfall would be on well ddos protected vps from ovh + I would add some iptables flags (for example limit connections per second) + my waterfall has good bots protection. Is it a good solutiion?

[craggy trout]

if the proxy dies, the backend connection stop working

You're using online-mode?

You mean to protect your server? With OVH and activating their permanent mitigation, you should have no problems. If using iptables to block typical invalid packets, fragmented packets, rate-limit connections is fine.

[buoyant spindle]

I know it

[buoyant spindle]

But I have dedicated at hetzner, and only vps at ovh

Vps is fair enought for just waterfall

[craggy trout]

You want to do a reverse proxy?

Then you can make your hetzner dedicated only accepts connections trougth your OVH filtered connections, you could even use HaProxy.

[buoyant spindle]

I am using haproxy now but I have issues. I mean during bot attack, ovh start mitigating and their vac is cutting my connection between vps and dedi. Maybe their vac things that my dedi is a attacker (I dont know why).

Maybe it is caused that haproxy send a lot of data (bots) to my backend and then backend is sending a lot of data to my vps

My idea would solve this issue. Am I right?

[craggy trout]

Is your server cracked?

OVH wouldn't filter "bot" attacks because they're legit connections, so the "antiddos" solution without a human layer verification would be imposible.

[craggy trout]

Surely haproxy has been saturated with connections and has stopped giving response? Did you have a proper firewall

[buoyant spindle]

During every bot attack I am receiving an email that my server is attacked now. And then the connection between frontend and backend is cut. Yes, this is offline mode server. I just want to know if my solution is ok

[craggy trout]

Yes, because the bandwich usage under a bot attack is huge, then OVH starts triggering

Normal, i get attacked but i could handle nowdays any dumb with 5$ can get a powerfull ass system

[craggy trout]

What can i say you, you should use some anti-bot plugin or Waterfall fork with integrated system, cracked here isn't supported at all

@reef fulcrum Sorry for ping, but wouldn't be good toggle bungee's handlerboss exceptions with some start property for example, by doing some testings the CPU usage due logg-in was pretty

I know that some or you yourself will say that it is important to know what happens, debug information and so on, or even out of scope, but anyone can enable or disable the property and greatly improve the consumption because the logs are tremendous in an attack.

@buoyant spindle Try tuning your Kernel with some properties that strict packets and that stuff

https://javapipe.com/blog/iptables-ddos-protection/

Also, there is a "issue" on Fedora systems, that accept low sockets https://stackoverflow.com/questions/880557/socket-accept-too-many-open-files/32699260#32699260

[buoyant spindle]

It is very useful but I Additionaly want to hide my real backend IP

I will read these docs

[craggy trout]

TCPShield?

[buoyant spindle]

100$ per mounth, vps is 20

[craggy trout]

My server is exposed a lot because is called as "test server", and they're a lot of players some times. My backend IP is public, and attacks are easily mitigated.

I recommend you to disable the ping logs, Waterfall/bungeecord connections which will improve the attack performance a little bit

[craggy trout]

TCPShield is free if you have 20 players or something like that

[buoyant spindle]

Even I add a lot of useful iptables rules and someone ddos attack then hetzner starts mitigating and it is very bad mitigating, a lot of players cant join

[buoyant spindle]

I have a lot more

[buoyant spindle]

So I just hide this IP one year ago and it is fine now. I used tcpshield but is too expensive and now I want to use ovh

[craggy trout]

hm

[craggy trout]

I can recommend you at your PM some "hacky" solutions that here i think that are definitly not supported

[buoyant spindle]

Thanks a lot, it would be very nice

(i will response slowly becouse I am not home)

[gritty umbra]

You can use ovh loadbalancer

[light peak]

Okay, so. My problem is, I can't run /server, I am op in every server, i have installed everything correct. I added myself also as admin in the waterfall config, but doesn't really seem to work

[steel surge]

i'd recommend installing luckperms since managing permissions with the builtin thing is not really ideal

[light peak]

fair enough

[steel surge]

also note that having op on the backend servers does not affect proxy perms

[light peak]

okay thanks

yeah, so i can only go to a other server, when i type in the waterfall server /send (player) (server)

but i actually need it so my console can just send me also with /server (player) (server)

[light peak]

fixed ^^

[dry osprey]

Is there a way to edit this message?

[brave crescent]

hmm is 22w42a snapshot will going to work on waterfall with viaversion & viabackward?

Oof i see

[dreamy iron]

Hey when i run the server with waterfall download it doesnt create the config.yml how do i fix that?

[royal hawk]

Not till I am no longer sick/can work on this stuff again

[brave crescent]

Aww its fine

[royal hawk]

This update season the proxies will have an official 「beta」designation

But I don’t have the mind for it at the moment

[uneven mauve]

Wow, waterfall hasn't received any updates for a while now.

[craggy trout]

hm?

Latest waterfall update was 1 month ago, not that long

[tired phoenix]

hello since the update I have this problem that I go to another server

506

[reef fulcrum]

Waterfall has nothing to do with that?

Like, waterfall doesn't understand the concept of signs, etc, and pretty much nothing changed outside of some library updates

[tired phoenix]

Okay I'll then look for the source of the problem

[craggy trout]

Seems like your plugin issue, probably a skywars issue

[rose blaze]

Hi there, I'm using Waterfall in my server and since yesterday it appears offline in the server list and in the status check websites but I can access the server as normal. Here is my config.yml I don't know how to fix this issue... 😦

https://pastebin.com/ZWFAub3g

[craggy trout]

Not sufficient valuable information. Send logs/any usefull information, enable decoder debug/ make sure that your firewall isn't making random stuff

[robust tusk]

Hello everyone,

I have a problem, I would like to use Waterfall to link my modded servers 1.16.5 (I use mohist).

Except that it is impossible to join the server. Error code: rejected vanilla connections
[19:03:07 INFO]: Disconnecting VANILLA connection attempt: This server has mods that require Forge to be installed on the client. Contact your server admin for more details.

In advance, the mods put on the server are the same as in my .mods (there are only 2)

https://pastebin.com/6xMc64qT

[reef fulcrum]

Modern forge is basically unsupported

There are projects like lightfall which try to add support but they have their own caveats

[tough vale]

also https://s.u11.io/mohist

[robust tusk]

i have I also tried to use magma.

[robust tusk]

I understand, but I already used this system in 1.12.2.
Except that developing in 1.12.2 is so lame!
So I prefer to switch to 1.16.5, the versions are updated regularly.

[reef fulcrum]

Wat

[robust tusk]

?

[reef fulcrum]

I dont understand what 1.12 has to do with anything

[robust tusk]

I just tell you that in version 1.12.2 (magma + waterfall) it works.

[reef fulcrum]

Yes.

And that's not modern forge.

[robust tusk]

Except that I am desperately trying to do the same thing in 1.16.5, and there the bugs are unknown to me.

[reef fulcrum]

Legacy forge "works"

[robust tusk]

Ah ok I see, the old versions work but not the new ones?

[reef fulcrum]

Forge 1.13 made some changes which are basically incompatible with how proxies work

[robust tusk]

Oh no...

However some very well known servers work in 1.16.5 with a proxies, I don't understand how they did it.

(Paladium)

[reef fulcrum]

Yes, there's been a few smaller hacks out there to coax stuff into working

[robust tusk]

ok I understand

so, either I stay in 1.12.2, or I switch my server to 100% plugin ?

[buoyant spindle]

Hello. I have waterfall and paper server on different machines. The issue is that I see ping on TAB (bungeetablistplus) only from me to waterfall (not from me to paper) but when I am typing /ping (chatmanager) I see normal ping from me to paper. Can I fix it?

[fiery pagoda]

How much does 1 server cost

Understandable, have a great day.

[viral gale]

yo

Can anyone help me/

My proxy is currently only showing the playercount of the hub

none of my other servers

This suddenly started happening, I'm not sure if i've accidentally changed something on the proxy side but I can't spot anything

I'm currently showing as "0" players online when there's actually more than that

its horribly affecting getting new players

resolved^

[old swallow]

After IP forwarding is enabled, does the waterfall server forward the player's uuid to the sub-server? Will the sub-server accept and replace it.

[sharp belfry]

yes, if you set it up correctly

[robust storm]

Is this where I go for crossplatform help?

[robust storm]

Has anyone had an issue where bedrock users cant like craft and stuff

[royal hawk]

You can try velocity + ambassador. That’s the only official semi-supported solution

[lunar plover]

how do I block /tab on bungeecord? I dont want my plugin to be tab completed

I already tried modifying tab complete to -1 in waterfall.yml but it didnt work

[reef fulcrum]

it's not disablable

either use perms to hide it to people who can't run it

or remove it from the ProxyDefineCommandsEvent as a fallback, but, that's kinda shoddy

[lunar plover]

thanks

[craggy trout]

https://www.spigotmc.org/resources/commandwhitelist-spigot-waterfall-velocity.81326/

You can use that plugin

[lunar plover]

oh my god, thank you so much!!!

[craggy trout]

[golden shadow]

Hi, I enabled enforce-secure-profile on both my waterfall config and paper server.properties, restarted both, but when joining players still get the "Chat messages can't be verified" banner. Any way to fix this?

[reef fulcrum]

no

That thing isn't supported on proxies atm

[golden shadow]

Oh gotcha, is there any way to like intercept the packet that is sent to client on login so that it thinks messages will be signed or something?

That banner is the bane of my existence

[reef fulcrum]

There are plugins like freedomchat which basically entirely disable that system

[craggy trout]

probably he can make a hacky native thingy tho

[reef fulcrum]

People are working on a solution for the thing properly, it's just complex

[golden shadow]

it disables the banner that is sent as well?

[reef fulcrum]

I believe so

[craggy trout]

Mojang moment

[golden shadow]

sweet going to trty

[reef fulcrum]

It seems that theres some changes coming from mojang in the next release that might make it easier, but as it stands, the entire system is a state nightmare

[golden shadow]

ah gotcha :/

Well the plugin disables the toast and thats all i need tbh 🤩

[craggy trout]

Clients now reset their chat session on receiving a login packet - 22w43a

😢

🖥️ Servers can now lazily distribute players’ profile public keys along with their first chat packet
📥 Profile public keys will now be refreshed without reconnecting

BRUH

[royal hawk]

Hey it took us enough convincing to get that through

[craggy trout]

😢

[tribal bloom]

Don't know why, because yesrtday everything was normal, but starting from today, before a player join, it has to connect at least 2-3 times because he gets (Disconnected)

Any idea on what could be the main reasons?

[craggy trout]

Send some useful information such as Proxy/backend logs, enable decode debug etc (Also try on "vanila")

[tribal bloom]

Proxy doesnt show errors, same as backends

how to enable decode debug?

[craggy trout]

Could you send them?

[tribal bloom]

I can't, there are ips of players

[craggy trout]

censore them

[craggy trout]

-Dwaterfall.packet-decode-logging=true

[tribal bloom]

I understand but there are so many lines

I will try to see with decoder

[craggy trout]

I mean, who cares about some public addresses, here people helps each others, they're dumbs but meh

[craggy trout]

Btw, normaly this happens by plugins, Waterfall never will kick you like that without external software modifications/add-ons

Or aswell you can break the config, but that's not default.

[tribal bloom]

Its important data, and In my country there are strict rules and I have to protect this type of data. However I am cheking, thanks for the help

I have made a clean re-install of Waterfall and everything now seems fine

[royal hawk]

Use https://mclo.gs then. It censors out ips

[rancid linden]

How i create a new group?

[reef fulcrum]

Look at the configuration object and see what it expects?

I mean, really, you'd be better off managing all that stuff yourself isntead of dealing with bungees built in crud, but 🤷‍♂️

[autumn plank]

I started using Waterfall to connect to a vanilla server and a forge server and it started to appears this when I try to connect to the forge one:
[00:33:03 ERROR]: Channels [pixelmon:main] rejected vanilla connections
[00:33:03 INFO]: Disconnecting VANILLA connection attempt: This server has mods that require Forge to be installed on the client. Contact your server admin for more details.

I have the same version of forge/mod, and I can directly connect to It, but not through waterfall, does anybody knows?

[reef fulcrum]

proxies don't support modern forge, basically

[autumn plank]

ohh then there is no way to do a bungee with modern forge?

[reef fulcrum]

no

There is like, 1 or 2 proxies which have added support for it that relies on a client mod

[craggy trout]

Try ligthfall but depends on a mod

[autumn plank]

Just in case that you know, im using only pixelmon, do you know if it works?

[craggy trout]

https://github.com/ArclightPowered/lightfall

Try and seeig

[gusty spade]

I just saw about that

[primal hearth]

how can i hide tab complete for non permission users ? . my users can see /ban command 😶

[reef fulcrum]

if plugins define their commands properly, that's how it works already

if not, you'll need a plugin

[buoyant spindle]

Hello. I have a Network issue, maybe someone want to look? Someone, who is good at Networking? I will paste a link to serverfault

https://serverfault.com/questions/1114446/ovh-vps-as-a-reverse-proxy-udp-ddos-attack-causing-invalid-packets

This is deep problem (not like "my plugin can't load"). I really don't know where to ask.

[tribal bloom]

is it possible to disable tab complet for only non OP players?

[marble kelp]

@buoyant spindle UFW is not what is doing the ddos protection on an ovh server

most likely whatever OVH is using for filtering out the packets is also filtering out your connection between the vps and the dedicated server

I suggest trying out a different VPN (or if you are not using one, any VPN as a connection between the VPS and dedicated server)

(or just host directly with OVH 👀 )

[craggy trout]

I think you didn't understand good.

He's using OVH as filter for DDoS attacks because hetzner sucks. When a UDP ddos is sent, it just stops framing connections for hours.

[marble kelp]

I fail to see at which point you came to the conclusion that I don't understand what they are doing?

I literally suggested to just host everything directly with OVH implying that I know that their dedicated server was not hosted with OVH. Otherwise it wouldn't make sense to use a VPS in the first place

[buoyant spindle]

I hope there is a solution for it - I just want to know what is happening. Maybe I will do some more investigation. I just dont want to give up - buying more more more expensive dedicated in OVH is not good solution to me. If I can't solve my issue I will use TCPShield but as I said, I dont want to give up

but just for curiosity - using GAME dedicated server in OVH is super safe and then I wouldn't need tcpshield or even hiding my real dedicated's IP?

[buoyant spindle]

and I don't understand this part - using VPN between dedi and VPS? What? How?

[marble kelp]

well usually you want to have a vpn between all your machines so that you don't need to expose ports and (potentially unencrypted) traffic to the public internet

both of those are kinda important in the case of minecraft proxies as a) has access to the port (and there is no other protection in place like a firewall) you can join from a different proxy and b) connections between the proxy and the paper server aren't encrypted

also using a vpn connection instead of (lots of) individual ones for each player can help in situations like for ddos protection

also it's more easy to whitelist (but I doubt you can do that with OVH/have any control over that)

[buoyant spindle]

But how to get started with it? How to put my dedicated and vps in one virtual private network (VPN) ?

[marble kelp]

by choosing one of the many VPN programs, installing them and setting them up how you want

most people tend to use Wireguard nowadays

[buoyant spindle]

And maybe it can help resolve my issue? TCP packets going from VPS to dedi wouldn't be invalid anymore?

[marble kelp]

maybe, no idea

best to ask ovh support directly

[buoyant spindle]

ovh is replying to me something like that "did you read our tutorial how to configure firewall?" or other useless things

[marble kelp]

well did you?

[buoyant spindle]

of course, I have tested a lot of firewall configs, it is not the problem. I even dont know how to monitor what exactly happening. I only have UFW logs and I see that ufw is blocking packets from ovh becouse these packets are invalid. Thats all

[marble kelp]

again, OVHs ddos protection is not a software firewall thing on your system

and if your software firewall is blocking packets that you want then just unblock them? (of course with a VPN that would not be an issue as you could just unblock all your VPN traffic directly)

[buoyant spindle]

I am blocking invalid incoming packets. I dont want to remove this rule becouse it is very important firewall rule. I just don't know WHY these packets are invalid.

Maybe I would just allow ALL traffic (via iptables) from VPS's IP. But I am afraid these invalid packets can damage my dedi

[marble kelp]

wat

if the packets stem from your own vps then they should be fine, if not then you have issues on your vps that you need to address

I suggest figuring out why it thinks that they are "invalid"

[buoyant spindle]

this is part of ufw logs. UFW "thinks" that these packets are invalid. How to investigate more than this?

[marble kelp]

no idea, I don't use UFQ

[buoyant spindle]

"ACK PSH FIN" - at the end of the lines. I read that those packets are invalid if have these flags

[marble kelp]

*UFW

ask their support

[buoyant spindle]

And if I decide to buy dedi from OVH (with GAME anti-DDOS) then I dont have to worry about anything? Then I can stop using tcpshield or any reverse proxy and show my server real IP to the world?

[marble kelp]

if you want a game-focused ddos-protection tool like tcpshield then no

ovh only offers normal ddos protection, not minecraft-specific one (at least not for the prices of normal servers)

[buoyant spindle]

I thought that ovh game antiddos is something more than ovh standard antiddos

[marble kelp]

it probably is but it wont do packet-level inspection like tcpshield does (or at least claims)

like you wont get protection from minecraft-specific dos exploits

[buoyant spindle]

so I probably stay with tcpshield

[marble kelp]

yeah, Java Minecraft is no listed as a compatible game with OVHs Anti-DDoS GAME protection: https://us.ovhcloud.com/products/security/anti-ddos

or wait

it is

they just forgot a comma

can't say anything on how it compares to TCPShield though

[reef fulcrum]

game is just standard anti DDoS with some UP tining afaik

UDP Tuning*

[marble kelp]

well they claim they have "developed an Anti-DDoS protection specifically adapted to Game servers"

and list a bunch of compatible games

"the OVH engineers analyzed how the most popular gaming platforms (Counter Strike, TeamFortress, Minecraft) and communication modules (TeamSpeak and Mumble) operate. In a lab and by looking at real user tests, they studied the vulnerabilities of these applications and documented the various attack strategies."

of course there is no knowing how deep they looked into stuff

[buoyant spindle]

so if it is just a standard antiddos but with some UDP Tuning it is useless for me becouse I dont need any UDP traffic (I blocked all UDP traffic in my dedi 2 years ago and nothing bad happened)

[fossil blade]

I have a waterfall network set up and when trying to connect to a server running All the Mods 7: To the Sky I receive this error:

[reef fulcrum]

modern forge is unsupported by bungeecord

[fossil blade]

If I use velocity instead would that work?

[reef fulcrum]

No

[fossil blade]

So there is currently no support for linking a forge server to a network hub?

[reef fulcrum]

Like, only real options atm are lightfall, with its client mod

or velocity, with a plugin I forget the name of

[fossil blade]

Ok so Velocity would work if I have the necessary plugin

[reef fulcrum]

"""yes"""

[fossil blade]

So now I just need to figure out what plugin that is

[reef fulcrum]

It was called like ambassador or something

[fossil blade]

Alright

[marble kelp]

@buoyant spindle read the page, they clearly say that they also do tcp filtering

[covert portal]

https://posili.me/i/MBZzgiXA-2022-11-01_20-11-15.png

[reef fulcrum]

You're inside the netty pipeline essentially

stuff like that is often down to something in the pipeline mishandling an exceptional state

given that it threw again inside of ensureOpen, something isn't handling a closed connection properly

[covert portal]

And I have no idea what it is.

The best part is, it totally breaks Waterfall.

[reef fulcrum]

I mean, it's in the bootstrap

r i p

[covert portal]

Good thing that whole error doesn't tell my what plugin is responsible.

[reef fulcrum]

2 easy

only way you can often tell is through a heapdump and seeing what's inside of netty

outside of, you know, the whole typical "start yanking stuff"

[covert portal]

Usually, it happens without any errors, so that's nice.

[wide ledge]

hello there

im having some issues with waterfall

https://prnt.sc/5zUJczKGk6RI

[reef fulcrum]

The server is kicking you

and your client is bork

[wide ledge]

yes i know but all the settings are correct

[reef fulcrum]

TCPShield

You probably don't want that installed on the backend server

[sullen quartz]

a question, is it possible that servers connected to bungee have problems with plugins that require an internet connection?

[wide ledge]

???

[reef fulcrum]

the servers are still individual servers, the existence of bungee has literally 0 impact on their ability to talk to the internet, etc

[sullen quartz]

im having the problem that JDA (discord api wrapper for java) and multiple other plugins have connection issues, but when i run it without bungeecord on the same root they have a good internet connection

[wide ledge]

who's this one for?

[reef fulcrum]

for racer

[wide ledge]

oh okok

[sullen quartz]

weird...

[sullen quartz]

do you have an explanation for this?

[reef fulcrum]

can't comment with 0 errors

[wide ledge]

what about my issue?

[reef fulcrum]

as I said, remove the TCPShield plugin

[wide ledge]

the thing is i will need that

im removing it

[reef fulcrum]

For the backend server, no

[sullen quartz]

i dont get "errors" its just the update feature says no connection and a jda discord bridge often times out and has to reconnect, but when running every server subserver without bungee it works fine....

[reef fulcrum]

if you're gonna do TCPShield, you shove it before the proxy, and the proxy deals with it; not between the individual servers and the proxy

[wide ledge]

i didn't understand properly what you said

[reef fulcrum]

You don't TCPShield the connetion between bungee and the backend servers

so the backend servers don't need the plugin

[wide ledge]

so i dont have to install the plugin

right?

[reef fulcrum]

On the backend servers? no; that's why I keep saying to remove it

[wide ledge]

this one was on the hub

maybe thats the error

[sullen quartz]

the server logs the There was an I/O error while executing a REST request: timeout and the DNS resolution failed: discord.com: Temporary failure in name resolution and some warnings connected to it, running the exact same plugins without a bungee network, just every server inividually and it works all perfectly fine, but when used in a bungee network im gettings these errors like every 5-10min...

[reef fulcrum]

as I said, running inside of bungee doesn't change anything there

when you're having DNS issues too, that generally suggests somethings wrong with your network setup

[wide ledge]

https://prnt.sc/24CeyLv0uzRh

ip forwarding is enabled

[reef fulcrum]

No idea, something on that server is intentionally kicking players

oh, nvm, brain fart

I mean, that basically either means that ip forwarding isn't enabled in the proxy, or, something is mangling it

[wide ledge]

do you want to screenshare?

[reef fulcrum]

no

[wide ledge]

idk

[sullen quartz]

yeah but why does it work when i run it with the same settings and without bungee.... the server can handle traffic with 2gbit/s

[reef fulcrum]

I can't tell you

[sullen quartz]

ok

[reef fulcrum]

That bungeecord setting literally does nothing bar enable a few small little bits of logic in the server

[wide ledge]

then i still dont know what to do

[reef fulcrum]

it has 0 bearing on your hosts network

[sullen quartz]

yea thats what i thought and i have no idea why it doesnt work..

[reef fulcrum]

How are you hosting?

[sullen quartz]

root server

[reef fulcrum]

if ptero, try purging docker

idk if they have any advice on that, otherwise it's generally gonna boil down to more headache inducing joyous things

[sullen quartz]

xD

yea..

it already gave me and some friends a lot of headaches...

[reef fulcrum]

I've had people have cases where docker networking just somehow goes sideways in the most amazing of ways

[sullen quartz]

ok

the internet itself cant be the problem, as i said earlier we have 2gbit/s traffic and we're using around 1gbit/s

ill check if its something docker, thanks for your help

[wide ledge]

what can i do then

[reef fulcrum]

double check your configs

reproduce without plugins™

[wide ledge]

checked and rechecked

[wide ledge]

done also

[reef fulcrum]

logs?

[wide ledge]

the ones of the screenshot i sent you

[reef fulcrum]

or, well, actually, server screenshot shows that that's fine

show the waterfall config

[wide ledge]

https://prnt.sc/xPxRQiE1tcoh

[wide ledge]

im gonna try now

https://prnt.sc/izVHq5iMP8Tw

[reef fulcrum]

and make sure that you're actually connecting to the proxy and not the hub server itself

outside of that, I'm out

[wide ledge]

.

[novel dome]

I might be wrong but set your port to 25565

[winged oar]

You are not connecting to the proxy

[novel dome]

25565 is the default as I stated before

[wide ledge]

its already that

[reef fulcrum]

No

[novel dome]

It's 25577

[reef fulcrum]

You connected to the hub server

You need to connect to the proxy, which is on 25577

[wide ledge]

in waterfall

[winged oar]

^^

[reef fulcrum]

generally, sane people set the proxy to listen on 25565

and then set the servers onto different ports

[winged oar]

Makes things a bit more ordened indeed

[wide ledge]

where should i modify that

[winged oar]

I have no experience with hosting root, but I would say in the server.properties

[novel dome]

in the waterfall config set to 25565
in the paper server config set to 25577 or anything

[wide ledge]

i forgot the line to stop the bungeecord

which is it?

[marble kelp]

end

[wide ledge]

thanks

https://prnt.sc/mj5HinRMUGJi

also restarted the waterfall

what can i do

[novel dome]

What's your config file now

Can you post it here?

[reef fulcrum]

they're connecting the proxy to itself

[tidal musk]

Hello

at java.lang.Thread.run(Thread.java:833) ~[?:?]

[18:49:37] [main/INFO]: Command not found
[18:50:06] [Netty Worker IO Thread #1/ERROR]: Error authenticating uncharted with minecraft.net
io.netty.channel.ConnectTimeoutException: connection timed out: sessionserver.mojang.com/13.107.246.53:443
at io.netty.channel.epoll.AbstractEpollChannel$AbstractEpollUnsafe$2.run(AbstractEpollChannel.java:613) ~[proxy.jar:git:Waterfall-Bootstrap:1.19-R0.1-SNAPSHOT:f708acc:unknown]
at io.netty.util.concurrent.PromiseTask.runTask(PromiseTask.java:98) ~[proxy.jar:git:Waterfall-Bootstrap:1.19-R0.1-SNAPSHOT:f708acc:unknown]
at io.netty.util.concurrent.ScheduledFutureTask.run(ScheduledFutureTask.java:153) ~[proxy.jar:git:Waterfall-Bootstrap:1.19-R0.1-SNAPSHOT:f708acc:unknown]
at io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:174) ~[proxy.jar:git:Waterfall-Bootstrap:1.19-R0.1-SNAPSHOT:f708acc:unknown]
at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:167) ~[proxy.jar:git:Waterfall-Bootstrap:1.19-R0.1-SNAPSHOT:f708acc:unknown]
at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:470) ~[proxy.jar:git:Waterfall-Bootstrap:1.19-R0.1-SNAPSHOT:f708acc:unknown]
at io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:406) ~[proxy.jar:git:Waterfall-Bootstrap:1.19-R0.1-SNAPSHOT:f708acc:unknown]
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) ~[proxy.jar:git:Waterfall-Bootstrap:1.19-R0.1-SNAPSHOT:f708acc:unknown]
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[proxy.jar:git:Waterfall-Bootstrap:1.19-R0.1-SNAPSHOT:f708acc:unknown]
at java.lang.Thread.run(Thread.java:833) ~[?:?]

why? Fully online server

[reef fulcrum]

network issue

[tidal musk]

On server?

[reef fulcrum]

Your proxy failed to connect to mojangs server

either their thing is having issues, or you're having network issues

[tidal musk]

Thanks! It's hosting troubles

[reef fulcrum]

Make sure that you're using sane DNS servers

[tidal musk]

mojang banned russian ip's BRUH

[craggy trout]

pretty

[astral mortar]

does WaterFall support 1.7?

[reef fulcrum]

no

[reef fulcrum]

Which is

1. Not waterfall

2. No longer maintained

[astral mortar]

now how will i enable 1.7 ouch

[reef fulcrum]

update travertine yourself or find a piece of software which supports it, such as velocity

[astral mortar]

i ain't developer

[reef fulcrum]

That doesn't change what I've said

Please don't mention

[astral mortar]

huh?

velocity supports 1.7?

[reef fulcrum]

Yes

[astral mortar]

is it proxy?

like bungeecord?

[reef fulcrum]

yes

[astral mortar]

alr

lemme try it

[astral mortar]

i can't connect to the server anymore

[reef fulcrum]

Well, what did you do?

[astral mortar]

replace waterfall with velocity

[reef fulcrum]

have you configured velocity?

[astral mortar]

ooo

i didnt

[craggy trout]

1.7 on 2022 is funny

[craggy trout]

Why was 1.7 Travertine discontinued? Is it because having 2 forks was lazy? As far as I can see it can still be maintained without "problems"?

Where did i see what

[reef fulcrum]

It's because maintaining it was not worth the effort especially with my health and it didn't seem to be missed all that much

[craggy trout]

I see, and since hardly anyone else but you notices Waterfall got closed

Rip

[royal hawk]

I think there were some folks who did continue it for a while

They’ve now dropped off of the face of the earth

[reef fulcrum]

honestly, if I was to add 1.7 support, I'd rather just do it in waterfall and drop that patch

[royal hawk]

Yup I checked seems like the network ran out of money

[reef fulcrum]

well, rewrite that patch

[royal hawk]

Website is still up

[royal hawk]

Don’t

[reef fulcrum]

The way it was implemented was pretty meh and it just caused a lot of horrors in terms of diff noise

but, I mean, my commitment to waterfall given health, upstream, etc; just, not something I care to deal with

[craggy trout]

cmon 1.7 🥵

I don't need anyone to implement, i know for myself but sadly my server is 1.16 up =))

[wide forge]

i have bungee server and more's but i dont know how to fix that:

-> Can you explain to me how to make it so that when survival restarts, it sends you to the Lobby and not kicks you out of the entire server

[royal hawk]

You’ll need a plugin like Redirect plus

[wide forge]

yes, i have it, but he is not working, or im not fix it?

bungeecord #maniamc here is my plugin redirect plus

[lunar plover]

Hey, what does this mean?

[reef fulcrum]

It means that a packet wasn't recieved by the proxy in 30 seconds

[lunar dust]

Hello, is there any way to use server icon with waterfall?

[craggy trout]

Yes, it need to be called server-icon.png

[lunar plover]

And which could be the reason why?

[reef fulcrum]

I mean, generally, it's either oddball things creating a connection to the proxy improperly, or network issues

given that it's apparently coming from localhost, I'd be tryna work out what alls running on your machine, but 🤷‍♂️

[buoyant spindle]

What do you thing about set up a waterfall on raspberry pi on my home internet? I have public IP and 1000/1000mbps

[tough vale]

I mean that in and of itself is probably fine, the bigger concern is likely where your pi is in relation to the backend servers

[buoyant spindle]

The ping from me to my backend is low, 30ms

But what with ddos protection? Internet providers have something like this?

[tough vale]

no, ISPs generally don't have DDoS prot, and in general don't love people hosting stuff on a residential plan

actually depending on the ISP and how you're set up, you might not even be able to port forward if you're behind NAT

[buoyant spindle]

I can port forward, I can set up waterfall, apache2 etc on my PC and I have access to it from internet

I am paying for public IP additionally 1$ monthly

[velvet laurel]

Does waterfall have support for 1.13+ forge / modern auth?

what about forge with legacy auth

[reef fulcrum]

Pretty much no proxy supports 1.13+ forge

[buoyant spindle]

what do you think about mcshield.com? can you compare it to tcpshield?

[craggy trout]

Mcshield is basicly cloudfare

Get spectrum for minecraft better

Tcpshield filters more attacks due is for that

[buoyant spindle]

spectrum has 10GB monthly data. wtf?

[reef fulcrum]

that's just what's free

[royal hawk]

“Free” already costs you 20$/month because you need at least the pro-plan to be able to use it

CF spectrum is a terrible value if you can’t negotiate your own terms as enterprise

[buoyant spindle]

https://github.com/BlockhostOfficial/ddos-prot-mc-servers

Maybe I will use infinity filter, sounds good

[craggy trout]

TCPShield haves really better protection.

Also as you're using offline-mode most of that "ddos" guide doesn't work at all. Mostly they offer a basic layer7 ddos protection

There are very few Layer7 attacks that can be mitigated by detecting them as illegitimate traffic, as it is quite difficult without passing a verification like a captcha (cloudfare) and is bypasseable tho

[buoyant spindle]

Tcpshield does not have captcha etc

I heard some big network are using infinity filter or cosmicguard

I can handle bot attacks on my side (iptables, better waterfall etc).

It is not neccesary for me to proxy protect layer 7. For me the most important is that the proxy will protect layer 3,4. Layer 7 I can protect by myself

[craggy trout]

TCPShield haves a lot of backends that can absorb hugely the impact as a load balancer

[craggy trout]

Cloudfare is your solution then

[craggy trout]

Bigger networks are using tcpshield

[craggy trout]

Well, i know you're using a waterfall with some improvements for that. But if you want l4 antiddos protection cloudfare is the best.

[buoyant spindle]

Mcsiehld.com is using a cloudflare spectrum

[craggy trout]

If is more cheap, then use it.

[coral ether]

Could anyone please direct me to a tutorial for creating a plugin in 1.19.2, like a hello world? Doesn't seem to be a single site on google

[cosmic agate]

Waterfall.. You can make a Spigot plugin.

[dapper oyster]

How can l download waterfall 1.16.5?

[steel surge]

from the downloads page

latest version supports all versions from 1.8 onwards iirc

[dapper oyster]

thx!

[flat iris]

Wtf

[flat iris]

Cosmic guard is better if you run a large game server network

[marble kelp]

better how?

[flat iris]

Especially for games outside of minecrsft

[marble kelp]

also what's wrong with spectrum only including 10GB for free?

[flat iris]

I thought he was talking about the ISP but 10gb is very tiny

Any server can use that up

[marble kelp]

and?

spretty sure it's 10GB of malicious traffic, not 10GB total

[flat iris]

oh lol

[marble kelp]

actually hm, their plan overview looks like it's for everything

[craggy trout]

No

[marble kelp]

but they only charge $1/GB after that ¯_(ツ)_/¯

[craggy trout]

Seems pretty

[marble kelp]

and I would assume that's only inbound

the majority of most game server traffic will be outbound

[reef fulcrum]

If you're using it for MC, you basically wanna volume order

The free allowance is really just there to cover SSH usage

[flat iris]

It’s funny because I remember there was a thing that happened inside TCPShield where the staff running it took over for like a week and changed the name to Neutrino and everyone was confused but what actually happened was they tried to kill TCPShield and make their own service but it went literally nowhere

https://neutrino.gg

[royal hawk]

@acoustic adder and @flat iris it is in fact 10gb of legit traffic for cf spectrum. They don’t charge for malicious traffic. And for those 10gb you already pay 20$ since you need at least a pro-plan to have the option.

Strongly recommend against using it unless you can negotiate your own terms

[marble kelp]

inbound or outbound too?

[royal hawk]

Routed traffic so that means both ways

[marble kelp]

meh

[royal hawk]

It’s a really poor deal for the casual user

[reef fulcrum]

Yea, I mean, it boils down to usecase

Like, I don't recall them really advertising its usage outside of just for providing protected access for things like SSH into your network without having to expose it publically, etc

it's only in the past little while that even their advertising seems to address much outside of that?

[royal hawk]

Oh lol

10gb is only free for business plans

For pro it’s only 5gb

And 1$ per gigabyte after that

[gritty fossil]

[00:06:07 ERROR]:       at net.md_5.bungee.conf.YamlConfig.getListeners(YamlConfig.java:264)
[00:06:07 ERROR]:       at net.md_5.bungee.conf.Configuration.load(Configuration.java:96)
[00:06:07 ERROR]:       at io.github.waterfallmc.waterfall.conf.WaterfallConfiguration.load(WaterfallConfiguration.java:67)
[00:06:07 ERROR]:       at net.md_5.bungee.BungeeCord.start(BungeeCord.java:279)
[00:06:07 ERROR]:       at net.md_5.bungee.BungeeCordLauncher.main(BungeeCordLauncher.java:67)
[00:06:07 ERROR]:       at net.md_5.bungee.Bootstrap.main(Bootstrap.java:15)```
Any idea whats causing this ?
Server was working fine and i updated waterfall to latest commit (just 1 version newer from version existing in server) and i get this error messages

[tough vale]

either the config changed between the old version and the new version, or your config is invalid

[gritty fossil]

yaml lint didn't report any error and yaml is valid
i just swapped the waterfall jar with newer (from #505 to #506)
server was working fine with #505 🤔 what might be the cause

[reef fulcrum]

Nothing changed in the thing, was literally just me disabling the build date checker