The address changes by itself
Many providers give a subscriber an address only for a while. Reboot the router and the address is different. The banned address later goes to another customer of the same provider who has never heard of your server, and that person cannot join.
One address for hundreds of people
There are not enough IPv4 addresses for everyone, so mobile carriers and many home providers put hundreds of subscribers online through one shared address. This is called CGNAT. Dorms, schools, gaming cafes and ordinary families with one router also go online through a single address.
Banning such an address hits everyone behind it. The rule breaker, meanwhile, toggles flight mode on their phone and gets a different shared address.
IPv6
With IPv6 the provider gives a subscriber a whole block of addresses, usually /64 or larger, and the device itself keeps changing its address inside that block. Banning a single IPv6 address is almost useless. If you ban, ban the whole block, for example 2001:db8:1234:5678::/64. Kordon accepts IPv6 ranges as wide as /32 and IPv4 ranges as wide as /16.
VPNs and proxies
A VPN or a proxy gives a new address in seconds, and an IP ban does nothing against them. More in the guides on how to block VPNs and proxies and residential proxies.
What to do instead
- Ban the account by nickname or UUID. On an online mode server the UUID stays the same even if the player changes their nickname.
- Close VPNs and proxies, so a new address is no longer one click away.
- Before banning an address, open "Related players" in the rule breaker's profile, or the login log: you will see who else joins from that address.
- If you do ban an address or a range, set a duration, for example
1dor7d. - To find a new account of the same person, the Premium plan has the account links graph.
When a range ban makes sense
A range ban helps when one person keeps coming back from addresses inside one provider and none of your regular players are in that range. Check the login log, set a duration and whitelist anyone the ban might hit. In Kordon, ranges in the blacklist are available from the Pro plan.