Barbican

Barbican

Antibot and security for your BungeeCord or Velocity network.

What is Barbican?

Bot attacks fill your server with fake players, spam the chat and can bring your network down. Barbican sits on your proxy and checks every connection
before the player reaches your servers: it detects attacks on its own, blocks bots, VPNs and weird names, and asks new players to type a short code in the chat to prove they are human.

Real players barely notice it: they type the code once and they're done.

One jar for both proxies: the same file works on BungeeCord, Waterfall and Velocity. No other plugins needed.

Features

• Automatic attack detection: when connections per second go over your limit, attack mode turns on by itself, and off again when the attack is over
• Chat captcha: new players type a short code (shown in the chat and as a title) before they can play. Only once: verified players are remembered
• Unverified players wait on a server of your choice and can't go anywhere else or use commands until they pass
• Kick after too many wrong codes or after a time limit, and the IP is blocked for a moment
• Connection limit per IP: blocks IPs that connect too fast
• Server list check: during an attack, new players must refresh the server list before joining. Most bots never do
• VPN and proxy blocking: also blocks hosting/datacenter IPs, where most bots come from. Free service, no key needed (ip-api.com), or proxycheck.io
• Country blocking: allow or block players by country (blacklist or whitelist)
• Name filter: blocks invalid names and names used by bot tools, with your own patterns (regular expressions)
• Players online per IP limit
• Discord alerts: a webhook message when an attack starts and when it ends, with a summary
• In-game alerts for staff, which each one can turn off
• Whitelist (names or IPs that skip every check) and IP blacklist with reasons
• /barbican status: attack mode, connections per second, peak, and what was blocked and why
• /barbican lookup: country, VPN and lists of any player or IP
• Bedrock players (Geyser + Floodgate) don't need the captcha: they're verified by their Xbox account
• Works with Gatehouse: use the same login server for the captcha and the login
• Two languages (English and Spanish), fully editable, with a configurable color palette
• Database storage: SQLite by default (no setup needed), or MySQL/MariaDB
• Update notifications: admins get a message on join when a new version is available

How it works

• Every connection goes through the checks: blacklist, connections per IP, name, server list (during attacks), players per IP, VPN and country
• New players then get a code. They type it in the chat (or use /captcha <code>) and they can play
• During an attack the checks get stricter for new players. Players who already passed the captcha can still join
• Local network addresses (your own PC, LAN, Geyser on the same machine) are never limited

Commands

• /captcha <code> - Type the captcha code (typing it in the chat also works)
• /barbican status - Attack mode, connections and blocks (alias /barb)
• /barbican lookup <player|ip> - Country, VPN and lists of an IP
• /barbican verify <player> - Skip the captcha for a player
• /barbican unverify <player> - Ask for the captcha again
• /barbican whitelist <add|remove|list> [player|ip] - Names or IPs that skip every check
• /barbican blacklist <add|remove|list> [ip|player] [reason] - Blocked IPs
• /barbican attack <on|off|auto> - Force attack mode on or off
• /barbican alerts - Turn attack alerts on or off for you
• /barbican reload - Reload the config and language

Permissions

• barbican.admin - All /barbican commands
• barbican.alerts - Get attack alerts in game
• barbican.bypass.captcha - Never asked for the captcha
• barbican.update - Get notified on join about new versions

Give them with your proxy's permissions plugin. The console can use every command.

Configuration

• language - en or es
• storage - sqlite (default) or mysql, with the MySQL/MariaDB connection settings
• attack - Connections per second that start an attack, seconds to end it, block new players or unchecked players during attacks
• captcha - When to ask (new players, only during attacks, or never), waiting server, code length, attempts, time limit, reminders, title, days to remember, allowed commands
• rate-limit - Connections allowed per IP and how long the IP is blocked
• ping-check - Require a server list refresh: during attacks, always or never
• limits.max-players-per-ip - Players online from the same IP
• name-filter - Allowed names and blocked patterns
• ip-check / vpn / countries - Service, cache, limits, VPN/hosting blocking and country list
• bedrock.skip-captcha - Bedrock players don't need the captcha
• discord - Webhook URL and which notices to send
• update-checker - Notify admins about new versions

Installation

• Put Barbican only on the proxy (BungeeCord, Waterfall or Velocity) and restart it
• Optional: set captcha.server to a small server where new players wait until they type the code (if you use Gatehouse, use the same login server)
• Optional: paste a Discord webhook URL in discord.webhook-url and turn discord.enabled on
• The database driver is downloaded once into plugins/barbican/libs
• As with any network, make sure your servers can only be reached through the proxy

Compatibility

Works on
BungeeCord, Waterfall and Velocity (Velocity 3 or newer). Requires Java 17 or newer. Works with any Minecraft version your proxy accepts. Works with
Geyser and Floodgate and with
Gatehouse (both optional). No other dependencies.

VPN and country checks need internet on the proxy. If the service is down, players can still join (you can change that).

Language

Messages are in English by default. Change
language: es in config.yml for Spanish. All messages can be edited in the lang folder.

Support

Found a bug or have a suggestion? Please use the discussion tab instead of leaving it in a review, so I can fix it quickly.