Tunnel = Internet -> VPS -> Minecraft Dedi Server. Login/session servers blocked?

Can anyone explain me how Minecraft sessions/login servers work? What packets to what ports do I need to whitelist for it? I set up my tunnel with the vps, but when I try to connect to the server it says:

"Failed to connect to the server
Error occurred while contacting login servers, are they down?"

And on bungeecord console:
[SEVERE] Error authenticating <myname> with minecraft.net
io.netty.handler.timeout.ReadTimeoutException

I made my server offline mode just to test, and I successfuly...

Tunnel = Internet -> VPS -> Minecraft Dedi Server. Login/session servers blocked?