From 5ad8483ba546ffe59184d46f6ba8397e69606e56 Mon Sep 17 00:00:00 2001 From: 2cwldys Date: Wed, 19 Jun 2024 15:59:08 -0400 Subject: [PATCH 1/4] automatically marktks ban evading users --- vpnmonitor.sh | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/vpnmonitor.sh b/vpnmonitor.sh index 35fbfd7..a09d988 100644 --- a/vpnmonitor.sh +++ b/vpnmonitor.sh @@ -15,7 +15,7 @@ fi currentTime="date +%T" connectFormat="^(?:\s|[0-9])+[0-9]+:[0-9]+\sClientConnect:.*IP:\s[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" -echo "VPN monitor - original version by devon, modified by Spaghetti" +echo "VPN monitor - original version by devon, modified by Spaghetti, further modified by 2cwldys" echo "version 1.1 - 2021/9/12" echo "`$currentTime` Monitoring `echo $logpath | awk -F '/' '{print $NF}'` for server at $rconip:$rconport" @@ -58,12 +58,18 @@ do printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' svsay ^3Potential VPN detection for client '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null echo "`$currentTime` $connectIP : allowed & warned" elif [[ $vpn == 1 || $vpn == 2 ]]; then - echo "`$currentTime` $connectIP : VPN detected" + echo "`$currentTime` $connectIP : VPN detected, kicked in 5 seconds!" sqlite3 "$databasepath" "INSERT INTO iplist(ip, vpn) VALUES ('$connectIP', $vpn)" printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' addip '"$connectIP"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null + printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' marktk '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null + sleep 2s + echo "`$currentTime` $connectIP : VPN detected, kicked in 3 seconds!" + printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' marktk '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null + sleep 3s + printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' marktk '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' kick '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' svsay ^1Banned client '"$connectID"' for VPN use\n' | nc -u -n -w 1 $rconip $rconport > /dev/null - echo "`$currentTime` $connectIP : banned & kicked" + echo "`$currentTime` $connectIP : banned & kicked." else echo "invalid response, doing nothing" fi From cd04f0abcc29ccc3cead8682ac8537afefb90dba Mon Sep 17 00:00:00 2001 From: 2cwldys Date: Wed, 19 Jun 2024 16:35:25 -0400 Subject: [PATCH 2/4] increases duration of marktk check for late joins --- vpnmonitor.sh | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/vpnmonitor.sh b/vpnmonitor.sh index a09d988..8a4a72d 100644 --- a/vpnmonitor.sh +++ b/vpnmonitor.sh @@ -58,15 +58,20 @@ do printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' svsay ^3Potential VPN detection for client '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null echo "`$currentTime` $connectIP : allowed & warned" elif [[ $vpn == 1 || $vpn == 2 ]]; then - echo "`$currentTime` $connectIP : VPN detected, kicked in 5 seconds!" + echo "`$currentTime` $connectIP : VPN detected, kicked in 15 seconds!" + printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' svsay ^5[Bot] ^1VPN ^7use detected! ^3'"$connectID"' ^7kicked in 15 seconds!\n' | nc -u -n -w 1 $rconip $rconport > /dev/null sqlite3 "$databasepath" "INSERT INTO iplist(ip, vpn) VALUES ('$connectIP', $vpn)" printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' addip '"$connectIP"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' marktk '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null - sleep 2s - echo "`$currentTime` $connectIP : VPN detected, kicked in 3 seconds!" + sleep 5s + echo "`$currentTime` $connectIP : VPN detected, kicked in 10 seconds!" + printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' svsay ^5[Bot] ^1VPN ^7use detected! ^3'"$connectID"' ^7kicked in 10 seconds!\n' | nc -u -n -w 1 $rconip $rconport > /dev/null printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' marktk '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null - sleep 3s + sleep 5s + echo "`$currentTime` $connectIP : VPN detected, kicked in 5 seconds!" + printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' svsay ^5[Bot] ^1VPN ^7use detected! ^3'"$connectID"' ^7kicked in 5 seconds!\n' | nc -u -n -w 1 $rconip $rconport > /dev/null printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' marktk '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null + sleep 5s printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' kick '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' svsay ^1Banned client '"$connectID"' for VPN use\n' | nc -u -n -w 1 $rconip $rconport > /dev/null echo "`$currentTime` $connectIP : banned & kicked." From 3d9a25b99778bef29463a58636570c5b429a55b1 Mon Sep 17 00:00:00 2001 From: 2cwldys Date: Thu, 20 Jun 2024 12:58:02 -0400 Subject: [PATCH 3/4] auto mutes vpn users --- vpnmonitor.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/vpnmonitor.sh b/vpnmonitor.sh index 8a4a72d..00d28e1 100644 --- a/vpnmonitor.sh +++ b/vpnmonitor.sh @@ -63,6 +63,7 @@ do sqlite3 "$databasepath" "INSERT INTO iplist(ip, vpn) VALUES ('$connectIP', $vpn)" printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' addip '"$connectIP"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' marktk '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null + printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' mute '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null sleep 5s echo "`$currentTime` $connectIP : VPN detected, kicked in 10 seconds!" printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' svsay ^5[Bot] ^1VPN ^7use detected! ^3'"$connectID"' ^7kicked in 10 seconds!\n' | nc -u -n -w 1 $rconip $rconport > /dev/null @@ -73,7 +74,7 @@ do printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' marktk '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null sleep 5s printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' kick '"$connectID"'\n' | nc -u -n -w 1 $rconip $rconport > /dev/null - printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' svsay ^1Banned client '"$connectID"' for VPN use\n' | nc -u -n -w 1 $rconip $rconport > /dev/null + printf '\xFF\xFF\xFF\xFFrcon '"$rconpass"' svsay ^5[Bot] ^1Banned client ^3'"$connectID"' ^1for VPN use!\n' | nc -u -n -w 1 $rconip $rconport > /dev/null echo "`$currentTime` $connectIP : banned & kicked." else echo "invalid response, doing nothing" From 1f481ca118868232782c8b677f532e95777a25e5 Mon Sep 17 00:00:00 2001 From: Wookiee- Date: Sun, 29 Sep 2024 07:22:08 +0000 Subject: [PATCH 4/4] fixed connectFormat to detect and enabled debug API --- vpnmonitor.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/vpnmonitor.sh b/vpnmonitor.sh index 00d28e1..964e7ec 100644 --- a/vpnmonitor.sh +++ b/vpnmonitor.sh @@ -14,7 +14,7 @@ else fi currentTime="date +%T" -connectFormat="^(?:\s|[0-9])+[0-9]+:[0-9]+\sClientConnect:.*IP:\s[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" +connectFormat="^(\s|[0-9])+[0-9]+:[0-9]+\sClientConnect:.*IP:\s[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" echo "VPN monitor - original version by devon, modified by Spaghetti, further modified by 2cwldys" echo "version 1.1 - 2021/9/12" echo "`$currentTime` Monitoring `echo $logpath | awk -F '/' '{print $NF}'` for server at $rconip:$rconport" @@ -37,7 +37,7 @@ do echo "`$currentTime` $connectIP : was not found in database" echo "`$currentTime` $connectIP : checking for VPN" response=$(curl -s http://v2.api.iphub.info/ip/"$connectIP" -H "X-Key: $apikey") - #echo "`$currentTime` $connectIP : $response" # uncomment if you need to debug the API response + echo "`$currentTime` $connectIP : $response" # uncomment if you need to debug the API response if [[ "$response" =~ '"block":0' ]]; then vpn=0 elif [[ "$response" =~ '"block":1' ]]; then