`KickProxyUsers` does not work when activated on config

[Hexagonforce12]

This problem has been a long time but hasn't been fixed

[hakusaro]

Have you tried updating the GeoIP database manually?

[Hexagonforce12]

How to update it?

[sgkoishi]

It is a database of MaxMind GeoIP (and retired in 2022), just download another version and replace the original GeoIP.dat.

[hakusaro]

I suppose we could either update the database in TShock or remove it.

[hakusaro]

I updated TShock to use https://mailfud.org/geoip-legacy/'s database, in 757e6f3. I'm not sure if we should remove the feature or keep it.

[bartico6]

The problem of ensuring each player comes from a residential connection and not a commercial IP space (either self-hosted or commercial VPN) is as old as time, and is the type of countermeasure where if you publish any solution to it in a FOSS program like tShock, people will immediately start bypassing it.

Entire websites like ipinfo and getipintel exist and make huge money precisely on selling that rapidly-changing information. I'm not sure a static ip database file can solve this.

TL;DR - I think some countermeasure is better than no countermeasure, but I'm not sure if the false sense of security it provides is worse than the actual protection it might provide if not outdated, that's the main takeaway from this

[hakusaro]

TL;DR - I think some countermeasure is better than no countermeasure, but I'm not sure if the false sense of security it provides is worse than the actual protection it might provide if not outdated, that's the main takeaway from this

Honestly the false sense of protection is why I'm inclined to remove the feature

[abdullahdevrel]

I work for IPinfo. If you want to slightly improve security measures with minimum engineering investment, I recommend using the Lite API service.

It is free and includes ASN data. However, the challenge is that the free Lite API service does not provide VPN detection data. If the community is inclined, they can curate a list of ASNs associated with popular VPNs. VPN companies work with specialized VPN hosting service platforms like Datacamp, who provide multi-region VPN infrastructures for many commercial VPN providers.

It won't match the quality of our commercial VPN detection data, but I think as a community effort with our free Lite API service, it could significantly improve the current setup. Let me know if you have any questions for me. Cheers!

Best Regards,
Abdullah (DevRel @ IPinfo.io)

[bartico6]

For this message, ignore the 'Member' tag, as I'll be speaking entirely personally, not on behalf of anyone:

• Someone who is serious about preventing proxy abuse likely is already aware that grabbing a semi recently updated autonomous system list and checking their ip ranges + manually blacklisting ones they deem to be hosting providers/VPN services & where abuse comes from is a relatively cheap way to cut down abuse significantly, and is already intuitively aware with what you're suggesting
• Meanwhile, the average Joe Schmoe (someone who actually needs help preventing proxy abuse on their small server) doesn't know how to do that & won't be able to make use of this advice - all while thinking that the "KickProxyUsers" config option is a magical silver bullet that prevents ban evasion

That's basically the issue at hand - I believe repo maintainers are generally aware how to prevent or at least significantly reduce proxy abuse in their own backyard, but the problem is trying to do it in a generic and simple way available to all tShock users that doesn't burden the server admin with something they might deem as confusing to work with.

And then, imposing our defaults and our choices for what ASNs to ban and which ones not to would also come with the aspect of potential false positives due to stale ranges and ip reassignment etc etc

I do think implementing an optional lookup service into tShock that would use $asn_lookup_service_of_choice and provide this info to the admin as part of a whois command would probably help, when coupled with a command to drop an entire ASN if needed.

Reality is most larger public Terraria servers already have their own in-house anti-evasion systems that usually consist of similar methods, so this feature would probably be geared towards smaller servers, as larger servers running modified forks of tShock will probably disable this in favour of their own solutions.

(I do genuinely appreciate the thought & effort to pop in, by the way, this isn't meant to be a discouragement :-))

[bartico6]

Also, the above completely glosses over the problem of "using residentials, lul" that the most obnoxious malicious actors do, where ASN banning is entirely not going to cut it unless someone's savage enough to say "ok comcast you go byebye because some kid is using your ip space to grief my spawn area" and nuke their playerbase by banning their whole isp xD

[sgkoishi]

For reference, we also have

• Maxthegreat99's
  uses iphub.info, proxycheck.io, getipintel.net, iptrooper.net, ipqualityscore.com, iphunter.info, vpnblocker.net, ip2location.io, shodan.io for detection
• UnrealMultiple's
  uses ipinfo.app
• Frank's
  basically identical clone of the previous one