MineWall is a toolset for mitigating Layer 7 Attacks targeting applications using protocol specifications like Minecraft. It uses forensic data from multiple providers and experience working with 4 figure player Minecraft networks.

It is mainly targeted at Minecraft servers, or applications having a similar networking footprint as the former. However, it may work well for other applications where proxies are the main tool used for attacks. It is highly recommended to test pre-deployment and to take proper measures to optimize for your own end use-case.

It can significantly slow an attack, as you can see below with it and 2ls antibot managing to mitigate a 10k attack without it seem like much.

Before & After




Hosting provider friendly
Because this runs 100% in the firewall, you can set this up for port ranges you rent out to your clients to also protect them of attacks. Not only that, but they will together build a safe, and secure shield to further improve the firewall long-term

A 3 layered approach

The application is comprised of 3 different layers of mitigation, depending on the validity of the source user:

• The whitelist is used for IPs that are already validated as safe users.
• The graylist is based on low risk countries that rarely are the source of bots. The behavior is to limit the connection speed with a permissive ratelimit.
• The graylist (default) behavior is to strongly limit incoming connections via strict ratelimit.

Test Server
Are you unsure about this firewall's potential to mitigate attacks? No worries, we have you covered with our own testserver. Visit

• minewall.entryrise.com

We grant anybody permission to run Layer 7 attacks on it, for as long as you wish, for the purpose of testing the product.

Sources
We believe transparency in our forensic research is key to replicability and the effectiveness of our solution. We've appended our sources below:

https://radar.cloudflare.com/ https://github.com/herrbischoff/country-ip-blocks

Additionally, we have used some proprietary data from EntryRise and it's customers in designing the early predecessors of this firewall, available here

Explanatory Schema



FAQ

• Q: Can everybody just whitelist their bots to bypass this?
  A: No, the whitelist works by "vouching" for specific IPs so the checker doesn't have to deal with large amounts of traffic, but it checks each and every IP to make sure they are not malicious. (proxy check, compromised server check, etc).
• Q: This is just a firewall, this won't help nobody.
  A: Being a firewall means it is more performant than a plugin and that it can handle larger attacks. I'm in the process of also providing a plugin to finalize the full optimization, from top to bottom.