| | |
|---|
| ℹ️ | Summary | Detect and block VPN and proxy traffic during user registration, login, and/or globally using the ProxyTracer API. |
| 📦 | Packagist Link | https://packagist.org/packages/proxytracer/flarum-proxytracer |
| 🎌 | Compatibility | Tested and developed with Flarum 1.8 (version 1.0.0 of the extension), and the next Flarum version 2.0 (version 2.0.1 and up of the extension). |
This plugin uses the ProxyTracer API to detect and block VPN and proxy traffic in Flarum. It is fully open source (Github link) and is under the AGPL3 license.
Installation
Install with composer:
composer require proxytracer/flarum-proxytracer
Features
- It gives you fine control over blocking VPN and Proxy users during new user registrations, existing user authentication, or globally for all site visitors. If you’re fine with VPN and Proxy users having read access to your forum then you can save on API requests and only enable it for user registration and authentication.
- It uses caching to store recent IP address evaluations thus saving requests to the API and lowering latency. You can control how long to remember an IP address evaluation in the settings.
- In the event of an API timeout or network failure, the plugin prioritizes user access to prevent wide-scale lockouts. This behavior can be changed through the options.
- Built-in support for exact IP and CIDR subnet whitelisting.
Configuration
- Procure a standard API key from the ProxyTracer Dashboard.
- Navigate to your Flarum administration panel: Admin → Features → ProxyTracer to find ProxyTracer’s settings.
- Input your API key into the
ProxyTracer API Key field.
- Enable the protection parameters by toggling
Block Signups, Block Logins and/or Block All Site Access.
- Add any trusted IPs or CIDR ranges to the
IP Whitelist.
- (Optional) Adjust the API timeout and Cache Expiry limits to suit your server’s specific traffic requirements.
- (Optional) Customize the Block Message that appears to blocked users. For instance, you can add instructions for contacting the administration of the site in case they believe that the block isn’t warranted and that they’re not accessing the site through a proxy or VPN.
Settings
Include a table of settings and setting descriptions
| Name | Description |
|---|
| API Timeout (ms) | How long to wait for the API to respond before timing out. |
| Cache Expiry (hours) | How long to remember an IP address before checking the API again. |
| Fail Open on API Error | If the API crashes or times out, allow the user to register/login anyway to prevent locking everyone out. |
| Block Signups | Block proxies and VPNs when a new user attempts to register. |
| Block Logins | Block proxies and VPNs when an existing user attempts to log in. |
| Block All Site Access | Block proxies and VPNs from accessing or viewing any page on the forum. (Warning: This checks every visitor and heavily utilizes your API quota). |
| Custom Block Message | The exact error message shown to the user when they are blocked. |
| IP Whitelist | IP addresses or CIDR ranges (e.g., 192.168.1.0/24) that are strictly allowed to bypass the blocking. |
Network Configuration: Cloudflare & Reverse Proxies
⚠ For ProxyTracer to function effectively, the Flarum application must receive the true client IP address.
To ensure correct IP address forwarding you can follow these detailed instructions.
Emergency Access
If you locked yourself out you can regain access by following these simple steps.
If you want to test things then you can signup to ProxyTracer and get some free API credits for testing.
