Skip to main content

Anti-VPN & WARP Evasion Guard

A major challenge on large public networks is handling players who use Cloudflare WARP (1.1.1.1) or VPNs to evade bans. Because Cloudflare assigns shared egress IPs (104.28.x.x) to thousands of mobile and desktop users, careless IP bans can accidentally lock out innocent players.

BharatMC Login solves this with a Dual-Layer Registration Trap and selective CIDR range filtering.

🛡️ Anti-Ban Evasion SOP (Staff Procedure)​

1. The Cardinal Rule: NEVER IP-Ban a Cloudflare WARP IP​

  • If staff executes /ban-ip on a player connected via Cloudflare WARP (104.28.0.0/14 or 8.29.230.0/23), every innocent player sharing that WARP data-center node will be locked out.
  • Action: Always apply a standard UUID Account Ban (/ban <player>) first.

2. How the System Traps WARP Ban-Evaders​

If a banned player tries to reconnect via Cloudflare WARP:

  1. Existing Account Blocked: Their banned username/UUID cannot connect regardless of which IP WARP assigns them.
  2. Alt Creation Blocked by Registration Guard:
    • The banned player will attempt to register a new alternate account (/register).
    • Because allow-cloudflare-registration: false is enforced in antivpn.yml, the proxy immediately rejects the registration attempt: 
      ✕ REGISTRATION RESTRICTED
      You cannot register a new account while using a VPN, WARP, or Proxy.
      Please disconnect from your VPN/WARP and register directly.
  3. The Trap: To create an alt account, they must turn off WARP. The moment they turn off WARP, their Real Residential ISP IP is exposed and blocked by the existing IP ban!

3. Account-Chaining & Registration IP Audits (/dupeip)​

When investigating a malicious user who switches VPNs:

  1. Run /dupeip <player> on Velocity to fetch all accounts that have ever authenticated from that IP history.
  2. Cross-reference the player's first_address in the PostgreSQL database (users.first_address), which stores the raw ISP IP used during initial /register.

⚙️ Full Configuration: antivpn.yml​

Below is the complete verbatim configuration for antivpn.yml:

# ==============================================================================
#                      BHARATMC ANTI-VPN & PROXY SYSTEM
# ==============================================================================
# Standalone configuration for Anti-VPN / Proxy detection and bypass controls.
# Toggle the entire system on/off directly from this file or via /forceantivpn.
# Changes can be reloaded on the fly using /forceantivpn reload or /bl reload.

# Master switch: Set to false to completely disable Anti-VPN and Proxy checks
enabled: true

# Kick message shown when a player connects using a detected VPN or proxy
kick-message: "<gradient:#FF416C:#FF4B2B>✕ VPN / PROXY DETECTED</gradient>\n\n<white>Please disconnect from your VPN or proxy to play on BharatMC.</white>\n\n<gray>If you believe this is a mistake, please reach out to our team on Discord:</gray>\n<gradient:#00C9FF:#92FE9D>discord.gg/bharatmc</gradient>"

# Registration Protection:
# When true, /register will strictly reject players connecting through ANY VPN or Proxy,
# preventing malicious users from creating infinite alt accounts by switching VPN locations.
# Existing accounts can still be allowed to /login with VPN if prelogin checks are not blocking.
registration:
  block-vpn: true
  # Set to false so players CANNOT register new accounts over Cloudflare/WARP (prevents alt-account spam).
  # Once registered on their real IP, they CAN freely connect and /login with Cloudflare/WARP.
  allow-cloudflare-registration: false
  kick-message: "<gradient:#FF416C:#FF4B2B>✕ REGISTRATION RESTRICTED</gradient>\n\n<gray>You cannot register a new account while using a VPN, WARP, or Proxy.</gray>\n<dark_gray>Please disconnect from your VPN/WARP and register your account directly.</dark_gray>"

# Lookup service settings
# Uses blackbox.ipinfo.app (response: 'Y' for VPN/Proxy, 'N' for clean residential/mobile)
lookup:
  url: "https://blackbox.ipinfo.app/lookup/{ip}"
  timeout-ms: 2000
  cache-days: 7

# Cloudflare & Cloudflare WARP Handling
# Cloudflare WARP and edge routing utilize Cloudflare's published IP ranges.
# Set 'whitelist-cloudflare-ranges: true' to permit Cloudflare / WARP client IPs to bypass the VPN check.
cloudflare:
  whitelist-cloudflare-ranges: true
  auto-fetch-latest: false
  # Official Cloudflare Edge + Cloudflare 1.1.1.1 WARP Client Egress Blocks
  ranges:
    - "104.28.0.0/14"    # Primary Cloudflare 1.1.1.1 WARP Client Egress block (104.28.0.0 - 104.31.255.255)
    - "104.16.0.0/13"
    - "104.24.0.0/14"
    - "8.29.230.0/23"    # Cloudflare WARP Asia & Global egress pool
    - "103.21.244.0/22"
    - "103.22.200.0/22"
    - "103.31.4.0/22"
    - "108.162.192.0/18"
    - "131.0.72.0/22"
    - "141.101.64.0/18"
    - "162.158.0.0/15"
    - "172.64.0.0/13"
    - "173.245.48.0/20"
    - "188.114.96.0/20"
    - "190.93.240.0/20"
    - "197.234.240.0/22"
    - "198.41.128.0/17"
    - "2400:cb00::/32"
    - "2606:4700::/32"
    - "2803:f800::/32"
    - "2405:b500::/32"
    - "2405:8100::/32"
    - "2a06:98c0::/29"
    - "2c0f:f248::/32"

# Whitelisted IP addresses (Exact IP or CIDR) that always bypass the Anti-VPN check
whitelisted-ips:
  - "127.0.0.1"

# Whitelisted usernames (case-insensitive) that permanently bypass all VPN checks.
# Note: You can also manage player bypasses in real-time with /forcevpnwhitelist add <player> [reason]
whitelisted-players: []

🛠️ Management Commands​

CommandUsagePermissionDescription
/forceantivpn on/forceantivpn onbharatmc.adminImmediately enforce Anti-VPN across all proxies
/forceantivpn off/forceantivpn offbharatmc.adminTemporarily suspend Anti-VPN checks
/forceantivpn reload/forceantivpn reloadbharatmc.adminHot-reload antivpn.yml CIDRs and IP whitelists
/forcevpnwhitelist add/forcevpnwhitelist add <user>bharatmc.adminAdd an exempt player to whitelisted-players