Should You Block VPN Players?

You banned the same person three times last month and he was back inside the hour each time, from a different address. Somebody in your staff channel says the words anti-VPN plugin, you install one that evening, and the evasion stops. Something else stops too, and you will not find out what for about six weeks — probably when a regular mentions in passing that their mate could not get in and gave up.

That is the whole trade-off, and it is worth taking seriously in both directions rather than picking a side because of one bad week. Here is the order the costs actually bite in.

1. Work out who is behind the addresses you are about to reject

Ban evaders are on that list. So are five other groups, and together they outnumber the evaders on almost every server.

People on carrier-grade NAT. Their ISP has run out of IPv4 and shares one public address across many subscribers by splitting the port range — RFC 6598 reserves 100.64.0.0/10 for the carrier side of that translation. A subscriber with their own address has 64,512 usable ports; a subscriber behind CGNAT gets an allocated slice of one address's range. The practical effect is that a lot of unrelated households appear as one address, which looks structurally identical to a shared proxy.

People on mobile and 5G home broadband. Effectively all of it is CGNAT, and some carriers hand traffic off through infrastructure that classifies as datacentre-adjacent.

People in restricted regions. The game, the platform, or the route to your host is blocked or degraded from where they live. The tunnel is not a disguise; it is the only way they can reach you at all.

People on university halls and corporate networks. Outbound game ports blocked, or the whole estate behind a filtering proxy. They tunnel out because the alternative is not playing.

Habitual VPN users. They turn it on in the morning for everything and never think about it again, and they will not turn it off to get into a server they have never played on. This group is larger than owners expect and is the cheapest one to lose, because they will simply pick another listing.

2. "VPN detected" is a probability wearing the clothes of a fact

Detection works from address reputation databases and ASN classification, and the plugins are thin wrappers over those. AntiVPN uses proxycheck.io with ip-api.com as a fallback; McAntiVPN uses IPHub; VPN Cop combines proxycheck.io and vpnapi.io. On Rust, uMod's Steam Checks does the account-side equivalent instead.

They go wrong in four repeatable ways.

Address space gets recycled. A range that hosted a VPN exit two years ago carries that reputation long after it was reassigned to a residential ISP, and nobody is paid to go back and clear it. ASN heuristics are blunt: this is a datacentre network flags a self-hosted WireGuard box, a cloud-hosted remote desktop, and a mobile carrier whose transit happens to look like one. Keyword rules on ASN names miss anything new — fresh providers, white-label resellers, rebrands — until a human updates the list, which is exactly the population your ban evader is using. And CGNAT trips shared-IP heuristics by construction, because it genuinely is a shared IP.

The part that causes the damage is presentational. Most providers return a confidence score, and most plugins render any non-zero score to the player as a flat "VPN detected". Read the score, set your own threshold, and know that a medium-confidence verdict means this address has properties often associated with proxies, which is not the same claim at all.

One configuration trap specific to Minecraft: behind a Velocity or BungeeCord proxy, backend servers see the proxy's own address unless player information forwarding is enabled. Velocity's player-info-forwarding-mode takes modern for 1.13 and above (which uses a shared secret so the backend can verify the proxy), legacy for 1.12 and below, or none. With none, a backend anti-VPN plugin is happily evaluating your own infrastructure. Run the check at the proxy, where the real address arrives first.

3. The cost of a false block is the one number you cannot see

A wrongly rejected player gets a disconnect string. They do not open a ticket, they do not join your Discord to complain, and they do not email you. They go back to whatever list they found you on and join something else within about ninety seconds.

Nearly everything else about a server is measurable. JoinGG queries every listing every fifteen minutes over the game's own protocol, keeps one history reading per server per hour for seven days, and computes uptime and a busiest UTC hour from that — all of which is set out at /methodology. Every one of those figures describes people who got in.

A VPN block is the only change you will make to your server where everybody it affects disappears without appearing in a single number you can look at.

So make it visible before you decide. Log every rejection with the address, the provider's verdict and score, and the account name, and leave it running for a fortnight without acting on it. Then read the log. It converts an argument in your staff channel into a list of names you can recognise, and it is usually the recognisable names that settle the question. Silent departure is the same failure that sits underneath most of the reasons nobody joins your server: the people you lose never tell you why.

4. Sometimes the VPN is making their ping better

This surprises owners who have filed VPN use under cheating, so it is worth understanding the mechanism.

Packets from your player cross several networks before they reach your box, and where those networks hand off to each other is decided by peering arrangements and commercial convenience, not by geography. An ISP will commonly pass traffic to the next network at the earliest opportunity, so a player who is physically close to your host can still be routed a long way around, or across a link that saturates every evening at nine. Tunnelling to a provider with better-connected transit replaces that first, bad leg with a different one.

The tunnel normally costs latency — encryption overhead, plus the detour to the endpoint — so it only wins where the default path is genuinely poor. Which is precisely the situation of anyone who went to the trouble of testing one. That is also why VPN use tells you nothing about cheating: a tunnel changes the path, not the client. If your player base is spread across regions and you are seeing this pattern, the underlying issue is more likely covered by choosing a region to host in than by anything at the connection gate.

5. The middle options, where most servers should end up

Flag, do not block. Same discipline as running a new chat rule in alert-only mode: the check writes a line to your moderator channel, the player joins, and you get two weeks of data instead of two weeks of silence.

Gate on the account, not the address. Steam's Web API gives you GetPlayerBans, which returns VACBanned, NumberOfVACBans, DaysSinceLastBan, NumberOfGameBans, CommunityBanned and EconomyBan — and works regardless of the player's privacy settings. GetPlayerSummaries gives you timecreated for an account-age rule, but only for public profiles, so an age gate quietly rejects everybody with a private profile as a side effect. Use ban history as the hard gate and account age as a soft signal, and say in the kick message which check failed.

Let the whitelist be the gate. If entry already requires an application, a VPN check is redundant — you have a name and a human decision attached to every player. Running a whitelist people actually apply to does more here than any address list will.

Block only on a repeat offence. Treat the VPN verdict as a multiplier on other evidence rather than evidence in itself. A flagged connection that also matches a banned account's name pattern, join time and behaviour is a fair auto-kick; a flagged connection on its own is not. That layering is the core of detecting ban evasion and alt accounts.

Always ship a bypass and an appeal route. Whatever you run, include a per-account exemption permission and put the appeal link in the disconnect message itself. A kick that reads proxy detected — appeal in our Discord costs you nothing and turns a silent loss into a ticket you can fix in thirty seconds.

6. The recommendation, by server type

Whitelisted or application-gated servers, and small communities of roughly forty regulars or fewer: do not block. The application is your gate, your ladder handles the rest, and every rejection is a meaningful fraction of a population you cannot afford to thin. Flag and log only.

Public Source-engine servers — Counter-Strike 2, Team Fortress 2, Garry's Mod: do not block on address. Steam identity is the handle you actually have; use ban history and playtime checks instead. On a twenty-four slot server, address blocking costs you more joins than it saves you moderator hours, and the real work is done by published rules and a consistent ladder — see handling toxic players and writing server rules people read.

Large public Minecraft servers with genuine griefing and evasion problems, running three figures of concurrent players: this is the one case where blocking earns its place. Run the check at the Velocity proxy, set the threshold to high-confidence verdicts only rather than any non-zero score, ship the bypass permission, and put the appeal link in the disconnect message. Review the rejection log monthly, not never.

Servers being attacked: an anti-VPN plugin does nothing about a flood. That is a different layer with different tools, covered in stopping DDoS attacks on a small game server, and reaching for a connection filter instead will cost you players without buying any protection.

The rule underneath all of it: block addresses only after you have logged rejections for a fortnight and read the log. Until you have read it, you are not weighing a trade-off, you are guessing which side of it you are on.