Enable prevent-proxy-connections on Bungee

    This is not a suggestion to completely block VPNs/Proxies, unlike the name suggests. Instead it's a official, Mojang-provided, way of blocking Authentication Proxies like TheAltening/MCLeaks which are frequently used by bad actors to evade and circumvent punishments.

    Essentially, having this option enabled will result in the server checking the IP the player is connecting from against the IP address they made to the Minecraft authentication server's API.

    TheAltening makes an authentication request on the behalf of a player, or at least that's how I think it probably works (I haven't spent the time inspecting traffic they send so this is my best guess), on their VPS' connection. Thus, the IP address they're making the request to the Minecraft authentication server won't match the one connecting to the server.

    Unfortunately, what may occur here is that either TheAltening is somehow making these authentication requests with the same IP address as the player trying to log in with a TheAltening account using some sort of proxy and password changing when their session expires. But I'm not entirely sure they do that, so that's why I'm making this suggestion.

    What should also be noted is that this might block VPNs/Proxies unintentionally but I don't think it should as the entry for this in the Minecraft wiki states the following:

    Quote

    If the ISP/AS sent from the server is different from the one from Mojang Studios' authentication server, the player is kicked.

    I think it actually does it per IP address instead of Internet Service Provider/Autonomous System Number, but due to a lack of official documentation on Mojang's end, I can't say for certain.

    This option exists in the Bungeecord configuration as well.

    Hopefully this might be a better alternative to completely blocking VPNs/Proxies, which if enacted, might be detrimental to some legitimate players and admins who use VPNs.

    I think this should be tested to not affect the above mentioned possible side-effects, however I don't currently own suitable infrastructure to test them.

    Quote

    ↩  Allink Unfortunately, what may occur here is that either TheAltening is somehow making these authentication requests with the same IP address as the player trying to log in with a TheAltening account using some sort of proxy and password changing when their session expires. But I’m not entirely sure they do that, so that’s why I’m making this suggestion.

    With the amount of users on TheAltening, I think this would eventually trip something on their end if accounts are being accessed by multiple different IP addresses in a short amount of time, as that goes well beyond the norm.

    ピバラ。

    I assume since this is related to development and freedom 01 by extension I'm going to approve this. I'll have that feature enabled sometime today.

    ↩  Paldiu

    i forgot to make a post last night -- i poked ryan and apparently it was already enabled on bungee itself, so ive already enabled it on both the freedom and the hub servers.

    1gaah.png