Bedrock players can't join one of my servers, getting invalid handshake.

[nuttapillar]

When any bedrock players try to go to my lobby server, they get an error. ingame it says: Kicked whilst connecting to the lobby: Unable to authenticate - no data was forwarded by the proxy.
This is a new server I recently set up. I have a few other servers that bedrockers can join fine. I made sure to only put Geyser on the proxy, and bungeeguard on the proxy and the other servers.

In the lobby server console it says:
[19:54:37 WARN]: [BungeeGuard] Denying connection from 127.0.0.1 - MTg4LjEyNy4zLjIzNQBeRmxvb2RnYXRlXj55UXREOXA1MnpFUmhtTVBMIVY1T1lqMlcvZzM5ODJPR2NPTytWZDlpbTZpc0N5N
lUvU0ptTmh2c1oxUUx6eWNMK3I0ZjVKbVdNY09lVHVEQkt6STREZGlhNkpQVlpna0dkSUZNS2paVFNkeGY1SnlYZkRwWUh4c1FSNjMyUG9yMi9rR2VReWxSdWVWNFpYWVVpNlIvODZDczJ5MDdSWTNrL0RBPT0AMTExL
jIyMC4zMi4yNDkAMDAwMDAwMDAwMDAwMDAwMDAwMDkwMWY4NjYyZjk3ZTkAW3sibmFtZSI6InRleHR1cmVzIiwidmFsdWUiOiJld29nSUNKMGFXMWxjM1JoYlhBaUlEb2dNVGN5TlRjNE9UUXlOREF5T0N3S0lDQWljS
Ep2Wm1sc1pVbGtJaUE2SUNKa056VTJPVGM0TVdVeVlqWTBPV0l5WWpWbE1qVmxZVEpoTkRaa09HUXhPU0lzQ2lBZ0luQnliMlpwYkdWT1lXMWxJaUE2SUNKRWNrdGhjR1J2Y2lJc0NpQWdJbk5wWjI1aGRIVnlaVkpsY
1hWcGNtVmtJaUE2SUhSeWRXVXNDaUFnSW5SbGVIUjFjbVZ6SWlBNklIc0tJQ0FnSUNKVFMwbE9JaUE2SUhzS0lDQWdJQ0FnSW5WeWJDSWdPaUFpYUhSMGNEb3ZMM1JsZUhSMWNtVnpMbTFwYm1WamNtRm1kQzV1WlhRd
mRHVjRkSFZ5WlM4eU16aGxZemRrTm1Sa1l6ZGpOalJtTnpZeU0yTmxNekkzWTJSak9HRmtZamc0WW1KbU1EZzRPRFZpWVdZeE5tRTVOelV3TURWbFltWmxOamRsT1RJNUlnb2dJQ0FnZlFvZ0lIMEtmUVx1MDAzZFx1M
DAzZCIsInNpZ25hdHVyZSI6ImxtOUhWZlpQcmFDa21tbTdIQlZZTHdQUEp1KzFQU0x4MVIyN21vNmxvY0c1bCtLVHhpWUpCVWN6aDkvTzZxYWpsVW1Ld0dBam9hTS8xWU1FaVFuNkQzMFBQczNLT0EwQWJwaHExSUltO
C95dTVENXlPUDlqVGVxOUFWVTc4NUhoZ0xZR2F1RS8xRkdHcm9lb3pMZnBpUEFiaWNsb254UW0vNjJWM1FlQ0s5enI3T2F5Znc2QU4xRHZ0T2h2aWlrcjJRN3dqQitjS2hjYWFwZVpSMHlnZStaa3pyN2JqallXbkM4Y
0ZCY3pFc0lORktVWUJlWTVwelhRMFBzWXEvV2xpdjNJekFVRWJadnJINHY0bjR4Q1ZxQUc4OWlKQmpVUG42VUt1WU5QdFZ2QXo2anpMTW5OUE1CaWtzejNkV3N0RDlkU1VqcXArU2w1R3d6eDlLdTJSWmpQdVlWQ2gvd
FZuQkg2ajA0QTVDRFNyS1JxTHVhQUlyQk81dmpNUFI2a0xWaHlLNnhCek9RYUxqYmJGTzE5ZVR2VmgzV3dNUzdtaTF5MDlEL01IQTM5Y2JtMHd4MzZwbUErMlpOL0ZFM0x3amZrYXpJZTN6OHppd0ZXaU1pR1p6bmtvM
nlzR2FGWHh2TEFzV090bk1rOXZ6MXVxR3ZMaXNOeGJHVkwzTVdOMDViOURXWVpwN0tHUU1LTmhPR3V1bWN4NVJxTXFIYkJBamh6YVhFR0lzOVo3U0JSL1ZXYzlHSFJpV1VUUzE1eUVTcHJIRlZSaW5Icks5VkdmSU8rR
URHdXM5VkNZZGxzKzZLOUM0UHhMOGdWblNFWjIwQ1pxOFBHOENROXFGVlhLWkVSN1VpR2ROeEFCSDdzWTVyeDEzUmhKcG56RSs4QWZrQlBuSVdxN21vXHUwMDNkIn0seyJuYW1lIjoiYnVuZ2VlZ3VhcmQtdG9rZW4iL
CJ2YWx1ZSI6IlJWaWd3QnRTT0o4UWF5MlV3T0g0UFlsRlpqWTlEY2lTS21ISk00OExkalpKdWdlMklIbG5LSXVRTWpqTHZDWWYiLCJzaWduYXR1cmUiOiIifV0= - reason: INVALID_HANDSHAKE
[19:54:37 INFO]: /127.0.0.1:62584 lost connection: Unable to authenticate - no data was forwarded by the proxy.

[SpigotRCE]

you just leaked your bungeeguard token...

[SpigotRCE]

and put floodgate on your backend servers as well

[nuttapillar]

This issue is from about 3 months ago. In that time I switched to Velocity, so I don't even use Bungeeford or Bungeeguard anymore.

[nuttapillar]

I had floodgate on the backend servers though. Still do.

[SpigotRCE]

report it to floodgate then, even though I've never had this issue it's not good to put data inside the hostname but rather should be put inside properties which is supported by bungee and spigot.

And I think I found the issue, BungeeGuard expects 3 or 4 components separated with a null byte, but floodgate combined with BungeeGuard on the proxy creates 5 components which BungeeGuard on the Spigot server rejects,

BungeeGuard/bungeeguard-spigot/src/main/java/me/lucko/bungeeguard/spigot/BungeeCordHandshake.java

Line 87 in 5adea6c

if (split.length != 3 && split.length != 4) {

The ideal fix should be is Floodgate to use the Properties JSON which is supported natively by bungee and spigot

[SpigotRCE]

import base64

a = base64.b64decode("MTg4LjEyNy4zLjIzNQBeRmxvb2RnYXRlXj55UXREOXA1MnpFUmhtTVBMIVY1T1lqMlcvZzM5ODJPR2NPTytWZDlpbTZpc0N5NlUvU0ptTmh2c1oxUUx6eWNMK3I0ZjVKbVdNY09lVHVEQkt6STREZGlhNkpQVlpna0dkSUZNS2paVFNkeGY1SnlYZkRwWUh4c1FSNjMyUG9yMi9rR2VReWxSdWVWNFpYWVVpNlIvODZDczJ5MDdSWTNrL0RBPT0AMTExLjIyMC4zMi4yNDkAMDAwMDAwMDAwMDAwMDAwMDAwMDkwMWY4NjYyZjk3ZTkAW3sibmFtZSI6InRleHR1cmVzIiwidmFsdWUiOiJld29nSUNKMGFXMWxjM1JoYlhBaUlEb2dNVGN5TlRjNE9UUXlOREF5T0N3S0lDQWljSEp2Wm1sc1pVbGtJaUE2SUNKa056VTJPVGM0TVdVeVlqWTBPV0l5WWpWbE1qVmxZVEpoTkRaa09HUXhPU0lzQ2lBZ0luQnliMlpwYkdWT1lXMWxJaUE2SUNKRWNrdGhjR1J2Y2lJc0NpQWdJbk5wWjI1aGRIVnlaVkpsY1hWcGNtVmtJaUE2SUhSeWRXVXNDaUFnSW5SbGVIUjFjbVZ6SWlBNklIc0tJQ0FnSUNKVFMwbE9JaUE2SUhzS0lDQWdJQ0FnSW5WeWJDSWdPaUFpYUhSMGNEb3ZMM1JsZUhSMWNtVnpMbTFwYm1WamNtRm1kQzV1WlhRdmRHVjRkSFZ5WlM4eU16aGxZemRrTm1Sa1l6ZGpOalJtTnpZeU0yTmxNekkzWTJSak9HRmtZamc0WW1KbU1EZzRPRFZpWVdZeE5tRTVOelV3TURWbFltWmxOamRsT1RJNUlnb2dJQ0FnZlFvZ0lIMEtmUVx1MDAzZFx1MDAzZCIsInNpZ25hdHVyZSI6ImxtOUhWZlpQcmFDa21tbTdIQlZZTHdQUEp1KzFQU0x4MVIyN21vNmxvY0c1bCtLVHhpWUpCVWN6aDkvTzZxYWpsVW1Ld0dBam9hTS8xWU1FaVFuNkQzMFBQczNLT0EwQWJwaHExSUltOC95dTVENXlPUDlqVGVxOUFWVTc4NUhoZ0xZR2F1RS8xRkdHcm9lb3pMZnBpUEFiaWNsb254UW0vNjJWM1FlQ0s5enI3T2F5Znc2QU4xRHZ0T2h2aWlrcjJRN3dqQitjS2hjYWFwZVpSMHlnZStaa3pyN2JqallXbkM4Y0ZCY3pFc0lORktVWUJlWTVwelhRMFBzWXEvV2xpdjNJekFVRWJadnJINHY0bjR4Q1ZxQUc4OWlKQmpVUG42VUt1WU5QdFZ2QXo2anpMTW5OUE1CaWtzejNkV3N0RDlkU1VqcXArU2w1R3d6eDlLdTJSWmpQdVlWQ2gvdFZuQkg2ajA0QTVDRFNyS1JxTHVhQUlyQk81dmpNUFI2a0xWaHlLNnhCek9RYUxqYmJGTzE5ZVR2VmgzV3dNUzdtaTF5MDlEL01IQTM5Y2JtMHd4MzZwbUErMlpOL0ZFM0x3amZrYXpJZTN6OHppd0ZXaU1pR1p6bmtvMnlzR2FGWHh2TEFzV090bk1rOXZ6MXVxR3ZMaXNOeGJHVkwzTVdOMDViOURXWVpwN0tHUU1LTmhPR3V1bWN4NVJxTXFIYkJBamh6YVhFR0lzOVo3U0JSL1ZXYzlHSFJpV1VUUzE1eUVTcHJIRlZSaW5Icks5VkdmSU8rRURHdXM5VkNZZGxzKzZLOUM0UHhMOGdWblNFWjIwQ1pxOFBHOENROXFGVlhLWkVSN1VpR2ROeEFCSDdzWTVyeDEzUmhKcG56RSs4QWZrQlBuSVdxN21vXHUwMDNkIn0seyJuYW1lIjoiYnVuZ2VlZ3VhcmQtdG9rZW4iLCJ2YWx1ZSI6IlJWaWd3QnRTT0o4UWF5MlV3T0g0UFlsRlpqWTlEY2lTS21ISk00OExkalpKdWdlMklIbG5LSXVRTWpqTHZDWWYiLCJzaWduYXR1cmUiOiIifV0=")
print(len(a.split(b'\x00')))

5