Block VPNs and Proxies
Block VPN, proxy and mobile data users from verifying in your Discord server. How RestoreCord VPN detection works, false positives, allowlists and logs.
Block VPNs & Proxies stops anyone from verifying in your Discord server while their real IP address is hidden behind a VPN or proxy. It is one switch on your server's Firewall tab and needs Premium or higher. A second switch, Block Wireless Connections (Enterprise), blocks mobile data.
Go to Firewall › Block VPNs & Proxies
Why block VPNs
A VPN hides a member's real connection, which weakens other checks. It lets one person:
- Get around country, IP and network rules by picking an exit in a place you allow.
- Hide from your logs, so the IP and location you see belong to the VPN, not to the member.
Blocking VPNs makes those checks reliable again. It works best alongside alt detection and your other firewall rules. For a full anti-raid setup, see Protect Your Server from Raids. For an overview of the feature, see the VPN detection page.
Turn on VPN blocking
Open the Firewall tab
In the dashboard, open your server and go to Firewall. The Protections cards sit at the top of the Rules sub-tab.
Switch on Block VPNs & Proxies
Turn on the Block VPNs & Proxies switch. It saves straight away and shows "VPN/Proxy blocking enabled!". You can also turn it on from the Add Security Rule picker, where an enabled protection shows a green ENABLED badge.
Test it
Open your verify link with a VPN turned on. You should see error 990044, and the attempt shows up as Blocked (VPN) in the activity logs.
Turning the switch off asks you to confirm first. You can also turn this on with the API.
How detection works
Each time someone verifies, RestoreCord checks the IP address they verify from. If the address belongs to a VPN, a proxy or another service that hides the member's real address, the attempt is blocked.
These count as VPNs or proxies:
- VPN apps and browser VPN extensions
- Proxies, including proxies set on a router or across a whole network
- iCloud Private Relay
- Cloudflare WARP (the 1.1.1.1 app)
The check runs at the moment someone verifies, before they get the verified role. It does not kick or re-check members who already verified.
What members see
A blocked member sees Error: 990044 with the message “VPN/Proxy not allowed” on the verify page, and they don't get the verified role. They can try again as soon as they turn the VPN off.
Point them to VPN/Proxy Detected, which walks through turning off VPN apps, network-wide proxies and iCloud Private Relay. The full error reference is under error 990044.
False positives
Some members are blocked without knowingly using a VPN. The usual causes:
| Cause | What's happening | Fix |
|---|---|---|
| iCloud Private Relay | On iPhone, iPad and Mac with iCloud+, Safari traffic goes through Apple's relay, which counts as a VPN | Turn off Private Relay, or verify in another browser |
| Cloudflare WARP | The 1.1.1.1 app routes traffic through Cloudflare | Turn off WARP while verifying |
| Browser VPN extensions | The extension keeps working after the VPN app is closed | Disable the extension |
| School, workplace or public networks | The network sends all traffic through a proxy or VPN | Verify from home Wi-Fi. Try mobile data, unless the server blocks mobile connections (error 990043). |
| Router-level VPN | Every device on the network uses the VPN | Use another network, or ask whoever manages the router |
If a member still can't verify after ruling these out, give them a bypass.
Allow a member through
You don't need to turn VPN blocking off to let one person in. Pick the option that fits:
| Option | Lasts | Skips | How |
|---|---|---|---|
| Temporary bypass | 15 minutes to 7 days | Every firewall check | /bypass grant, right-click → Apps → RC - Bypass, or Grant Temporary Access in the activity logs |
| User ID rule: allow through firewall | Until you delete it | Later rules and the VPN check. Alt and wireless blocking, captcha, Enforce Passwords and Minimum Account Age still apply. | Add Security Rule › Custom Rule |
| User ID rule: bypass all checks | Until you delete it | Every check | Add Security Rule › Custom Rule |
| ASN rule: allow through firewall | Until you delete it | The VPN check, for anyone on that network | Add Security Rule › Custom Rule |
- Staff on a VPN: a User ID rule is the safest choice, because it only lets that one account through.
- ASN rules let in everyone who uses that VPN provider, not just your staff member, so use them with care. You can find a provider's ASN on the Provider line of a webhook log, for example
(AS64500). An IP address rule works too, but VPN addresses change often. - Rule order matters. Rules are checked from oldest to newest and the first match decides. If an older block rule matches the member, for example a country block, your allow rule never runs. bypass all checks rules always run first.
Staff who use the Discord commands need the User Bypass permission. See Bot Commands and Bypasses.
Block mobile data
Block Wireless Connections is a separate switch next to Block VPNs & Proxies. It needs Enterprise and blocks verification from mobile networks such as LTE, 4G and 5G. This switch makes members verify from a fixed connection instead of mobile data.
Go to Firewall › Block Wireless Connections
- What members see: Error: 990043, “Wireless connections not allowed”. They need to switch to Wi-Fi or a home connection. See error 990043.
- False positives: some home internet, such as 4G or 5G home broadband, can be treated as mobile data. Members on a phone hotspot are blocked too.
- Bypasses: only a temporary bypass or a bypass all checks rule skips wireless blocking. An allow through firewall rule does not.
- You can also turn this on with the API.
Many people only have mobile data, especially on phones. Turn this on only if you're willing to turn those members away or handle their bypasses.
Logs and monitoring
Every VPN block is recorded on the Activity Logs sub-tab as Blocked (VPN). To find one member's attempts, search for their User ID. Each denied entry has a Bypass button for Grant Temporary Access.
Go to Firewall › Activity Logs Go to Activity Logs › Search
If you have Discord webhook logs set up, they post:
- VPN / Proxy Blocked for each VPN block.
- Access Denied or Blocked Wireless Connection for wireless blocks.
- On Business or higher, a Connection Info field on every log with the connection Type and VPN
yesorno, plus the VPN operator's name when it is known. Watching this for a few days before you turn blocking on shows how many of your members use a VPN.
The IP Info field, with the provider and ASN, needs IP Logging turned on. For trends across all your servers, open Analytics › Firewall, where Blocked includes VPN blocks.
Go to Security › Discord Webhook Logs Go to Analytics › Firewall
Enterprise custom webhooks also receive a member.denied event with the reason vpn or wireless.
Plans
| Feature | Plan |
|---|---|
| Block VPNs & Proxies | Premium or higher |
| Block Wireless Connections | Enterprise |
| Custom rules to allow a member | Premium or higher |
| Connection Info (VPN yes/no) in webhook logs | Business or higher |
See Plans & Billing for everything each plan includes. Teammates you add as sub-users need the Manage Firewall permission to open the Firewall tab. Every setting is described in the Firewall settings reference.