How i can permanently ban someone by their ip from the server? [SOLVED]

[Darlex]

Also, since you seem to be worried about someone brute-forcing login passwords (at least that's my interpretation of "some kind of loop algorithm"): do not confirm/deny login requests right away. When the server receives a login request, let it sit idle and sleep for a little while before it sends its response. Like 1 to 3 seconds. This makes any attempt at brute-forcing passwords completely futile.

I have to agree with Hippyman though. Making a "massive online game" requires a lot of expertise and manpower, not to mention infrastructure, since "massive" implies the need for much more than a single server running Lua code on your home PC.

Technically im not going to host any server, i want to make a totally hackable server for the community, Look at all these Minecraft™ mods! Mojang™ is just offering the game and Microsoft™ invented Realms™ (but are expensive (compared to homemade) and Microsoft™ is just forcing everyone to use that (and bedrock™)). Millions of full modded servers to make everything more fun but where is the problem? The server itself, look at them, are expensive, uses a lot of internet and the client suffer the same pain as the server. But wait if.. I make a totally hackable server that uses his own easy-to-learn API, that can run in maximum graphics in a cellphone! or even a server! Maybe i sound crazy but if i make it, then making games and servers online will be a lot easier and comfy!

EDIT: wow is really late and i sound like some crazy inspirational business lizard-man or something lol

[Darlex]

When the server receives a login request, let it sit idle and sleep for a little while before it sends its response. Like 1 to 3 seconds. This makes any attempt at brute-forcing passwords completely futile.

Even if the response is delayed, somebody could still queue a lot of requests therefore the system would be vulnerable to brute force attacks.
A better approach is to store a timestamp of the "last login attempt" and ignore requests when the last login attempt was less than 5 seconds ago. So it's good to know the last login attempt per account.
This is just one part of the problem, a malicious script could try to login with different accounts at the same time, so you absolutely need to store the client's IP and ignore repeated requests coming from the same IP.
A good and secure login system is a big and difficult project and it's very easy to get it wrong. You really should use something established like oAuth if you can help it.

Yup, that would be a really good idea! Thanks

[zorg]

The entire purpose of banning via IP was trying to not save data in the client. People is really intelligent and love "exe" compression is weak so everyone with a minimum love/lua/coding knowledge can just bypass everything and destroy the servers making unhappy players. Unhappy players go to another games and that is how you lose players and the game goes out of "trendings". Sorry if i'm too analytic and soulless but is true :/

Yes, clients, whether löve or not, can be cracked... still, i feel like you haven't read past my first sentence though.

The gist of my post was that just using IP based bans can be easily circumvented as well. So to answer the topic itself, there's NO WAY to permaban someone by their ip, they will be circumvented.

So, what you could do, is to either use a UUID as well, in conjunction with IP addresses, or better yet, get the MAC address since that's way harder to spoof.

Edit: And now you're replying to grump that you want the server to be hackable?
...at this point, i don't even know what ideas you have about security to be honest.

[grump]

Edit: And now you're replying to grump that you want the server to be hackable?
...at this point, i don't even know what ideas you have about security to be honest.

I'm pretty sure he's talking about the good kind of hacking, like mods, and not in the sense of cracking,

[pgimeno]

Technically im not going to host any server, i want to make a totally hackable server for the community, Look at all these Minecraft™ mods! Mojang™ is just offering the game and Microsoft™ invented Realms™ (but are expensive (compared to homemade) and Microsoft™ is just forcing everyone to use that (and bedrock™)). Millions of full modded servers to make everything more fun but where is the problem? The server itself, look at them, are expensive, uses a lot of internet and the client suffer the same pain as the server. But wait if.. I make a totally hackable server that uses his own easy-to-learn API, that can run in maximum graphics in a cellphone! or even a server! Maybe i sound crazy but if i make it, then making games and servers online will be a lot easier and comfy!

Um, have you tried Minetest? https://minetest.net/

[Darlex]

The entire purpose of banning via IP was trying to not save data in the client. People is really intelligent and love "exe" compression is weak so everyone with a minimum love/lua/coding knowledge can just bypass everything and destroy the servers making unhappy players. Unhappy players go to another games and that is how you lose players and the game goes out of "trendings". Sorry if i'm too analytic and soulless but is true :/

Yes, clients, whether löve or not, can be cracked... still, i feel like you haven't read past my first sentence though.

The gist of my post was that just using IP based bans can be easily circumvented as well. So to answer the topic itself, there's NO WAY to permaban someone by their ip, they will be circumvented.

So, what you could do, is to either use a UUID as well, in conjunction with IP addresses, or better yet, get the MAC address since that's way harder to spoof.

Edit: And now you're replying to grump that you want the server to be hackable?
...at this point, i don't even know what ideas you have about security to be honest.

I have a anti-hack system already done, Uses a lot of CPU when there is a lot of people connected but it is harder to hack. Client gives what keys are being pressed. Server gets its keys, calculates and throw x movement and y movement (or prime things like buying objects, hit damage, or bullets x,y movement (a game mechanic..) ) , everything (more complicated) else is calculated every 1 second passed and client pre-calculates that too making estimated x,y with the x,y movement of players on his area. when the data thrown comes to the client, the client update the everyone's data (in his area) and that's it!

[Darlex]

Technically im not going to host any server, i want to make a totally hackable server for the community, Look at all these Minecraft™ mods! Mojang™ is just offering the game and Microsoft™ invented Realms™ (but are expensive (compared to homemade) and Microsoft™ is just forcing everyone to use that (and bedrock™)). Millions of full modded servers to make everything more fun but where is the problem? The server itself, look at them, are expensive, uses a lot of internet and the client suffer the same pain as the server. But wait if.. I make a totally hackable server that uses his own easy-to-learn API, that can run in maximum graphics in a cellphone! or even a server! Maybe i sound crazy but if i make it, then making games and servers online will be a lot easier and comfy!

Um, have you tried Minetest? https://minetest.net/

The problem of that game is a lot of people look at him like a "weird minecarft rippoff" (I played it on my time and i liked it really much).
My game will be something else, like some weird game with his own personality.

[Darlex]

Edit: And now you're replying to grump that you want the server to be hackable?
...at this point, i don't even know what ideas you have about security to be honest.

I'm pretty sure he's talking about the good kind of hacking, like mods, and not in the sense of cracking,

Exactly, Graphical mods for clients (Like shaders and pretty cool stuff that people do with their games)
and Function mods for servers (Like PVP modes, and etcetera)