Proxy / Anti-botPublic build
FlameCord
Connection filtering where the attack actually arrives: the proxy.
Security-focused BungeeCord/Waterfall-compatible proxy infrastructure with integrated anti-bot and network protection.
Active. The 2.7.0 source line is current; the public build is distributed through ArkFlame and BuiltByBit.
Checked version 2.7.0
Evidence checked 2026-10-30
The problem
Bot floods and reconnect loops hit the front door before a backend server sees a player. Rate limits inside a Bukkit plugin are already too late; the proxy has to decide which connections deserve a login attempt.
What I built
- Built the anti-bot check sequence around the BungeeCord/Waterfall login lifecycle.
- Added per-address connection, ping and nickname accounting with a limbo verification step.
- Integrated optional host-level firewall rules while keeping the in-memory decision path available when host tooling is missing.
- Exposed the operational controls as proxy commands rather than requiring a restart for every block.
Architecture and trade-offs
Ordered admission checks
Login checks run in a fixed sequence: reconnect challenge, lockdown, latency, accounts per address and nickname rules. Each check can disconnect before the connection reaches a backend, and status pings are handled separately from logins.
Limbo before the backend
After login the proxy can hand the connection to a limbo filter, complete the login there and only release the player to the network once verification passes. That keeps bot sessions away from game servers.
Packet limits before full decode
The decoder rejects oversized frames and tracks packet volume per address. The aim is to spend as little CPU as possible on traffic that has already failed the admission test.
Host firewall is best effort
The host firewall path uses ipset and iptables and assumes Linux, root and the required packages. The plugin logs a clear failure when that is unavailable; operators still get the in-memory protection path.