I suggest adding the ability to connect directly to the server without a proxy and the ability to configure ipforwarding when connecting via bungeecord at the same time. For protection, add either a table of trusted ip addresses or a password that bungee should send to spigot. This will allow you to create networks in which you can connect to each server separately, or through a proxy. Today, when setting up ipforwarding, it is not possible to connect directly to a server without a proxy. Sorry if I made grammatical errors.