Why VPNs are a problem for a server
Most players never use a VPN to play. The ones who do usually have a reason that matters to you as an owner:
- Ban evasion. An IP ban stops working the moment the player turns on a VPN or picks another proxy.
- Alt accounts. One person can join on a dozen accounts from a dozen addresses, farm rewards, vote several times or grief anonymously.
- Bots. Bot attacks are run through large lists of proxies, so every bot looks like a different player.
- Hidden location. A VPN hides the real country, so country rules and statistics stop meaning anything.
The address is the one thing every connection has to show, so checking it at login is the simplest place to stop all of this.
Ways to block VPNs on Minecraft
Banning addresses by hand
Works for one stubborn player for a day. VPN providers own thousands of addresses and rotate them, so the list never ends and real players who later get the same address are blocked by mistake.
A free AntiVPN plugin
Free plugins send each address to a detection service. You usually have to register there, paste an API key into a config file, keep an eye on the daily request limit, and set up the same thing again on every proxy.
A protection service
The check runs on the service side: one plugin on the proxy, settings in a web panel, a shared database of addresses that grows with every server using it. This is how Kordon works.
Setting up Kordon step by step
Kordon runs on the proxy that players connect to: BungeeCord, Waterfall and their forks (BungeeCord API 1.16 and newer) or Velocity 3.4 and newer. It needs Java 21 or newer. You do not install it on the backend servers.
- Create an account and add your server in the panel.
- On the server's Plugin page, download
Kordon.jar. This copy already contains your server key. - Put the file into the proxy's
pluginsfolder and restart the proxy. - Check the console: when everything is ready it shows the line below, and the panel marks the plugin as online within a minute.
Kordon connected to server "My Server"If you installed the generic Kordon.jar (for example from Modrinth), link it from the proxy console instead. The key is on the same Plugin page:
/kordon link <key>Treat the downloaded file and the key like a password. If either leaks, issue a new key in the panel and the old one stops working at once.
Start in observe mode
A new server starts in observe mode. Kordon checks every login and writes down who it would block, but lets everyone in. Leave it like this for a day or two and look at the login log: you will see how many VPN and proxy connections your server really gets and whether any regular players are among them.
When the picture looks right, turn protection on. Nothing else changes for players who were already fine.
Choosing a protection level
- Soft keeps out open proxies and Tor and lets in players who use a VPN. It suits a server with many players from abroad.
- Balanced fits most servers: VPNs, proxies, Tor and hosting networks are refused.
- Strict also refuses residential proxies (on higher plans) and suspicious addresses. Use it on servers that get attacked often.
You can also filter by country, by nickname patterns, by mobile carrier or by whole networks (AS). What is available depends on your plan.
When a real player is blocked
No check is perfect: some home internet providers share addresses with hosting networks, and some players genuinely need a VPN. Add such a player to the whitelist by nickname or IP, in the panel or right from the game:
/kordon whitelist add SteveThe whitelist always wins over the VPN check. A blocked player also sees a clear reason on the kick screen, written in your own words, so they know whom to ask.
One more setting worth a look: what the plugin does if Kordon cannot be reached for a moment. By default it does not let in addresses it could not check; you can switch it to let everyone in.