v1.4.0 — registration that actually holds players, and VPN settings in the UI

The two things you could not do from the control panel — one of which was quietly undoing itself.

CaYaDev-Check now actually holds a player

The login system was opt-in per player, and it did not hold anyone. A name with a password connecting from an unknown address had to send /login as its first chat message — and every other packet flowed through untouched. The player was on your server, walking around and breaking blocks, while the proxy waited politely for a password. There was no server-wide mode at all, so "turn on the login system" was not something anyone could do.

Now it is, and it holds. Switch on Require every player to register and log in and a player joins frozen: movement, hitting, placing, item use and container clicks are refused and never reach your server. Only chat gets through, which is how they type the command.

/register <password>    → first time
/login <password>       → afterwards, from a new address

They are prompted on arrival and reminded periodically, because Minecraft chat scrolls and one message at join time is gone by the time anyone looks. Keep-alives keep flowing while they are frozen, so your server does not time them out mid-prompt. Once they authenticate, their address is remembered.

Registering and logging in are treated differently on purpose. Choosing a password gets as many attempts as the timeout allows — there is nothing to guess, and kicking somebody for a typo would be hostile for no gain. Proving an existing password gets one, because a wrong password against a name that already exists is the classic stolen-credential probe.

Premium-locked names skip the whole thing. Their Microsoft account has already proved who they are; a password on top would mean making the real owner prove themselves twice.

VPN settings are in the UI — and no longer deleted

They were not merely missing from the control panel: saving the Servers page deleted them. A save replaces the whole server list, the editor only knew about six fields, and VpnPolicy and UseDatacenterList were dropped — the service then silently fell back to its compiled default. Anyone who had set block for everyone lost it the first time they renamed a server, with nothing anywhere to say so.

Both are now read, written and editable per server: the policy as a three-way choice (log only / protected usernames only / everyone) and the wider datacentre list as a checkbox.

Also

The VPN dropdown shipped in an unreadable state on first attempt — a ComboBox paints its own chrome from system colours, so it came out light-on-light against this theme. It is properly templated now. Every screenshot in the README has been retaken from the installed service, including the Turkish rendering of both pages.

Downloads

File	Use it if
MinecraftFirewall-1.4.0-setup.exe	You want it installed properly. Start here.
MinecraftFirewall-v1.4.0-win-x64.zip	You would rather unzip it somewhere and run it yourself.

Upgrading from an older version? The Protection page will notice your configuration predates these settings and offer to add them — your servers and protected usernames are left exactly as they are.

490 automated tests pass.