# Why IP bans do not work and what to use instead An IP ban feels reliable: an account can be replaced, while an address supposedly cannot. In practice an address is easier to change than an account, and the same address often belongs to many people at once. Updated: 2026-10-27 ## In short - Many home and mobile users get a new address on their own, after a router reboot or a reconnect. - Mobile carriers and many providers put hundreds of subscribers behind one address, and a ban hits all of them. - With IPv6 one subscriber has a huge block of addresses, so banning one address achieves nothing. - A VPN gives a new address in seconds. - It works better to ban the account, close VPNs and look at account links. ## The address changes by itself Many providers give a subscriber an address only for a while. Reboot the router and the address is different. The banned address later goes to another customer of the same provider who has never heard of your server, and that person cannot join. ## One address for hundreds of people There are not enough IPv4 addresses for everyone, so mobile carriers and many home providers put hundreds of subscribers online through one shared address. This is called CGNAT. Dorms, schools, gaming cafes and ordinary families with one router also go online through a single address. Banning such an address hits everyone behind it. The rule breaker, meanwhile, toggles flight mode on their phone and gets a different shared address. ## IPv6 With IPv6 the provider gives a subscriber a whole block of addresses, usually /64 or larger, and the device itself keeps changing its address inside that block. Banning a single IPv6 address is almost useless. If you ban, ban the whole block, for example `2001:db8:1234:5678::/64`. Kordon accepts IPv6 ranges as wide as /32 and IPv4 ranges as wide as /16. ## VPNs and proxies A VPN or a proxy gives a new address in seconds, and an IP ban does nothing against them. More in the guides on [how to block VPNs and proxies](https://kordonlabs.com/guides/block-vpn-minecraft-server) and [residential proxies](https://kordonlabs.com/guides/residential-proxies-minecraft). ## What to do instead - Ban the account by nickname or UUID. On an online mode server the UUID stays the same even if the player changes their nickname. - Close VPNs and proxies, so a new address is no longer one click away. - Before banning an address, open "Related players" in the rule breaker's profile, or the login log: you will see who else joins from that address. - If you do ban an address or a range, set a duration, for example `1d` or `7d`. - To find a new account of the same person, the Premium plan has the account links graph. ## When a range ban makes sense A range ban helps when one person keeps coming back from addresses inside one provider and none of your regular players are in that range. Check the login log, set a duration and whitelist anyone the ban might hit. In Kordon, ranges in the blacklist are available from the Pro plan. ## Try it on your server Start in observe mode: Kordon shows who it would keep out, and you turn protection on when you are ready. [Create an account](https://panel.kordonlabs.com/register) ## More guides - [How to stop alt accounts and ban evasion on a Minecraft server](https://kordonlabs.com/guides/minecraft-alt-accounts-ban-evasion): How banned players come back on new accounts, why IP bans alone fail, and how VPN blocking, nickname and IP blacklists and the account links graph help keep them out. - [How to block VPNs and proxies on a Minecraft server](https://kordonlabs.com/guides/block-vpn-minecraft-server): Why players join through VPNs and proxies, which ways to block them exist, and how to set up the Kordon AntiVPN plugin on BungeeCord or Velocity step by step. - [Multi-accounts on a Minecraft server: how to find alts](https://kordonlabs.com/guides/minecraft-multi-accounts): Why players make alts, how they hurt your server's economy and votes, and how to find multi-accounts with account links, the login log and VPN blocking.