## VPN and proxy blocking that actually knows what it is looking at

Every ban evader, every ad spammer and every returning troll on a CS 1.6 server
arrives through the same door: a VPN, an open proxy, or a cheap datacentre box.
Ban the SteamID, ban the address, and they are back in ninety seconds on a
different exit.

This plugin closes that door. Every connecting address is checked live against
[antivpn.io](https://antivpn.io), and anything classified as a commercial VPN,
an open proxy, a hosting range or a TOR exit is removed before it can play.

---

## Why not an IP list

Downloadable VPN range lists are stale the day they are published. Providers
rotate exits continuously, and no static file can tell a rotated NordVPN exit
from a residential ISP allocation.

An API answers per address, live, and tells you *what* it found:

```
KICKED: nick [STEAM_0:1:12345678] ip=185.220.101.34
provider=TOR Exit Node asn=AS4224 country=DE risk=98
```

That is something you can show a player who disputes the kick. `matched list
entry #48213` is not.

---

## It costs your server nothing

| | |
|---|---|
| **Threaded** | Requests run on a libcurl worker thread. Not a frame, not a tick, not a millisecond of choke |
| **Coalesced** | Ten players behind one NAT cost **one** request, not ten |
| **Cached** | A verdict is reused for an hour by default — on a busy public server that removes more than half of all calls |
| **Pre-filtered** | Private ranges, reserved ranges and whitelisted addresses never reach the API at all |

Your monthly quota goes on addresses that actually needed checking.

---

## It tells you whether it works

Most plugins let you find out they are broken when the first cheater slips
through. This one probes the API at boot and prints the answer in your console:

```
[AntiVPN] plugin loaded successfully.
[AntiVPN] endpoint: https://api.antivpn.io/v2/check
[AntiVPN] API key: av_live_9f... (72 chars)
[AntiVPN] fail mode: fail-open | risk threshold: off | cache: 3600 s

[AntiVPN] SELF-TEST OK - key accepted, endpoint answered.
[AntiVPN] 8.8.8.8 -> proxy true, risk 88, Google LLC (AS15169)
```

Anything other than `SELF-TEST OK` names the exact cause — rejected key,
exhausted quota, missing CA bundle, DNS failure. Re-run it any time with
`avpn_test`.

The key is never printed in full. Only enough to identify it.

---

## Tuning that matches how servers actually run

| | |
|---|---|
| **Risk threshold** | Trust the `proxy` flag alone, or also kick anything scoring above a line you set. Datacentre ranges and freshly rotated exits often score high before they are classified |
| **Fail-open or fail-closed** | An API outage must not empty your server — so by default it does not. Flip it if a bypass is worse than a false kick |
| **Immunity** | By admin flag, or by SteamID for staff who genuinely need a VPN. The check still runs and the hit is still logged, so you can see it |
| **Whitelist** | Exact addresses, `/24` and `/16` wildcards, SteamIDs. Reloadable live |
| **Hold** | Freeze an unverified player until the verdict lands, so there is no window in which a VPN user is playing |

Everything is configured from
`configs/CodeStrikePlugins/antivpn.cfg`, which the plugin writes itself, fully
commented, from its own compiled defaults. No source file is ever edited.

---

## Admin commands

| | |
|---|---|
| `avpn_check <ip\|name>` | Check any address or connected player on demand |
| `avpn_status` | Key state, cache size, checked / blocked / errors this map |
| `avpn_reload` | Reread the whitelist, drop the cache |
| `avpn_test` | Re-run the credential probe |

---

## Honest about the one limitation

The GoldSrc engine offers no way to hold a connection handshake open while an
HTTP request runs. There is a short interval where an unverified client is
technically in the server — in practice the verdict lands while they are still
loading the map, and `avpn_hold` freezes them until it does.

Any plugin claiming to block a VPN *before* connect is either shipping a static
IP list or is not telling you the truth.

---

## Requirements

- AMX Mod X 1.9+ (built on 1.10)
- The AmxxEasyHttp module — **Linux binary and CA bundle included in this
package**, Windows `.dll` is a one-file download
- An antivpn.io API key

Works with both the Enterprise `/v2/check` endpoint and the standard
`/api/check` server token.

---

## What is in the package

- `plugins/antivpn.amxx` — compiled, AMXX 1.10
- `scripting/` — **full source**, four files, commented throughout
- `modules/`, `data/` — the HTTP module and its CA bundle for Linux
- `README.md` — the API contract, every cvar, quota guidance, a diagnostics
table mapping every log line to its cause and fix
- `INSTALL.txt` — five minutes, start to finish

---

**illusion @ CodeStrike** · [codestrike.store](https://codestrike.store)