AntiVPN plugin for Velocity: installing and setting up Kordon

What you need

Velocity 3.4 or newer; the 4.x branch works too. Java 21 or newer. Velocity 4 itself requires Java 25, so if your proxy starts, Kordon will start as well.

If the console shows UnsupportedClassVersionError after you install it, the proxy is running on an old Java version and you need to update Java.

Kordon recognises Bedrock players who join through Geyser and Floodgate on its own. You do not need to set anything up for them.

Installation

1. Create an account and add your server in the panel.
2. Open the server's Plugin page and download Kordon.jar. Your server key is already written into this file.
3. Put the file into the plugins folder next to velocity.toml.
4. Fully restart Velocity and look at the console.

Once the plugin has connected, the console prints a line with the server name, the mode and what happens when Kordon is unavailable. A new server starts in observe mode:

Kordon connected to server "My Server". Mode: monitoring only. If Kordon is unavailable: let nobody in.

In about a minute the panel shows "Plugin is online".

If you downloaded the generic Kordon.jar from SpigotMC or Hangar, there is no key inside. Link it with a command in the proxy console. The key is on the same Plugin page, and you do not need to restart:

/kordon link <key>

Permissions and commands

Velocity gives players no permissions until a permissions plugin is installed, usually LuckPerms. For a moderator to use Kordon commands, give them kordon.command plus the permissions for the commands they need:

/lpv user Steve permission set kordon.command true
/lpv user Steve permission set kordon.command.whitelist true
/lpv user Steve permission set kordon.command.lookup true
/lpv user Steve permission set kordon.notify true

What the commands do:

• /kordon status shows the connection to Kordon, the protection mode and the online count;
• /kordon lookup <nickname> shows what Kordon knows about a player; to see and search IPs, the moderator also needs kordon.command.lookup.ip;
• /kordon whitelist add and /kordon blacklist add put a nickname, IP or range on the lists, optionally for 1d, 7d, 30d or never;
• the kordon.notify permission turns on Kordon's staff messages in chat.

kordon.command does not include /kordon link; keep that one for the owner. The proxy console can run every command. On Velocity the /kordon suggestion in chat is visible to all players, but the command will not run without permissions. If you do not want in-game commands at all, turn them off in the panel under "Plugin", then "In-game commands". This switch also turns off the list and lookup commands in the console.

Several proxies

Large networks run several Velocity instances behind a load balancer. Install the plugin on each proxy with the same file and the same key. Every proxy shows up in the panel by itself, on the "Proxies" tab of the "Plugin" section. A proxy that has sent no signal for seven days drops off the list.

How many proxies Kordon checks depends on your plan: one on the free plan, more on higher plans. A proxy over the limit is marked in the panel, and Kordon does not serve it: the plugin there lets players in or not according to the "If the check is unavailable" setting, and by default it does not let them in. You choose which proxies count.

If Kordon is unavailable

The plugin waits up to three seconds for Kordon to answer. What happens when no answer comes is decided by the "If the check is unavailable" setting. By default a player who could not be checked does not get in. You can switch it to "Let everyone in". Players who are already in the game are not affected. One exception: right after the proxy starts, until Kordon has answered once, the plugin lets everyone in.

Common console messages

• Kordon is not linked to a server: there is no key, and players join unchecked. Link the plugin with /kordon link <key> or download the file from your own Plugin page.
• The Kordon panel does not accept this server's key: the key was reissued or the server was deleted. Get a new key in the panel.
• Kordon did not answer: Kordon did not reply within three seconds. The player was handled according to "If the check is unavailable".
• Kordon.jar was replaced while the proxy was running: the file was swapped on a running proxy. Restart it.
• A new Kordon version ... is available: a new version is out. Download it in the panel.

Next, pick a protection level and look at who Kordon would have kept out in observe mode. The guide on how to block VPNs and proxies covers this.