0

I wrote a stand-alone anticheat. When the client anticheat connects to its server, the server creates a firewall rule allowing the game client to gain access to the server.

The problem is the firewall creates rules by IP address. If NAT is used, then one of the NATed IPs accesses the anticheat server, this server creates a firewall rule for all IPs behind the NAT.

How can I solve this "NAT" issue? Is it possible to solve this using Windows firewall API?

I don't want to block NAT'ed connections, I want to allow it if there is a way to authenticate users' devices with Windows firewall on the anticheat server first.

The anticheat server and game server are on the same PC. Windows firewall blocks all inbound connections for the game. The only way you can connect to the game server is to authenticate first with the anticheat server. But, firewall add rules by IP address. If I have two users with the same external IP, one of them accesses with anticheat client and the other has no need to do it because the server already made a rule for the IP.

Improve this question
12
  • 3
    I think this is an XY problem. You decide for whatever reason to implement your anticheat service in a specific (but unknown to us) way and now you run into problems with this kind of approach you did not anticipate in the design. Instead of changing the design you want to work around the particular problem. Maybe this is possible but I think more information are needed about the design in general, the objectives you try to achieve with it, why it was implemented to rely on IP addresses in the first place etc.
    – Steffen Ullrich
    Dec 12, 2020 at 7:10
  • It is not xy problem. Im giving the problem and enough information. The anticheat system was mainly made for LAN's but network grown up and now some IP address are behind NAT. Thats why i'm facing this problem now. The idea was use Windows firewall API in order to restrict game client connections. Of course, the anticheat server is in the same pc along with game server. The only way you can connect to game is connect with anticheat server first. If you don't do this, firewall does not create a rule for you
    – David Figueras Tamame
    Dec 12, 2020 at 7:23
  • The way I understand your problem then is that it is not about detecting cheating but to make sure that a firewall rule allows access by an IP address if at least one client is behind this IP? I.e. it is more about preventing denial of service attacks against your service than to prevent actual cheating. Because at the IP level you would not be able to detect a specific client/user anyway, this would require some authentication at the application level. Am I right?
    – Steffen Ullrich
    Dec 12, 2020 at 8:01
  • 2
    Correct. This means that the IP address alone is not sufficient as a feature to authenticate a specific client. No firewall rules magic can work around this inherent limitation. Authentication of a client need to be done at a different level than the IP address. And that's why I still think it is an XY problem - where X is the problem that you somehow want to authenticate a client and Y is the way you choose to implement it, i.e. authentication by IP. Only approach Y cannot work by the inherent limitations of this approach if NAT is involved.
    – Steffen Ullrich
    Dec 12, 2020 at 8:18
  • 2
    What you are describing is the idea of "authenticated sessions" that has been used by the web for a very long time. The game server should be managing sessions.
    – schroeder ♦
    Dec 12, 2020 at 8:35

1 Answer 1

Reset to default
1

Contrary to what you state in the comments, this is an xy-problem. An xy-problem is "how can I use x to do y" while not even considering whether x is an appropriate method to do y.

If you want to distinguish between clients behind a NAT (your y), an IP-based firewall (your x) is not the appropriate solution. Possible solutions are

  • use VPNs if you must (seems disproportionately heavy in this context)
  • authenticate the sessions and allow only authenticated sessions, for example via a proxy
  • separate the anticheat and game server on different (possibly virtual) machines
  • et cetera.

In short, the answer to your question is, that Windows "firewall" is an IP based filter and you cannot reliably distinguish between host behind a NAT router.

Improve this answer
3
  • Great, I've been reading about proxies but I've only seen them work on web and not desktop applications. Let's say that the proxy's ip will always be allowed in the firewall and the authentication will be done by the proxy. That is valid for me. Now where can I find useful information to achieve this. Take into account that the language I master is C #. I'm learning C ++ to create kernel-mode drivers but that's another matter.
    – David Figueras Tamame
    Dec 12, 2020 at 10:25
  • Look at SOCKS proxies. Disclaimer: I don't know anything about your original problem, so I cited this as an option only. It may not be applicable either.
    – Ljm Dullaart
    Dec 12, 2020 at 12:50
  • Ok, after a lot of researching I finally make a proxy and a login session at the protocol level
    – David Figueras Tamame
    Oct 16, 2022 at 8:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .