VelocityLayer checks connecting player IP addresses through Proxycheck and provides an administration UI. Its 2.0r release includes a compiled UI; the inspected main-branch source does not. Detection is an external service decision, not proof that a player is abusive or that the server is secure.
Choose the release and configure the service
The verified release-2.0r.zip contains the velocitylayer-antivpn folder with fxmanifest.lua and ui/dist/index.html. Keep that folder intact before ensure velocitylayer-antivpn. The source archive requires a separate UI build. Set your own API key in server/main.lua, review support text and select the intended permission mode before starting it.
The plugin sends player IPs to the Proxycheck v2 API and fetches account usage for the dashboard. The service has free and paid query limits; free plugin code does not imply unlimited API usage. Current provider documentation still supports v2. Do not change only the URL to v3, which has a different response structure. Keep the key server-side and restrict access to player IPs and identifiers shown in the UI.
Repair permissions and filtering behavior
isAdmin checks configured roles, but its ESX, QB and OX branches can fall through to true when no allowed group matches. An unknown mode also falls through. The txAdmin authentication listener is registered as a network event without an origin check. Use explicit deny-by-default checks and a server-only trusted authentication source before exposing player data or settings.
The shipped empty settings.json replaces ENABLE_ANTIVPN with an unset value at startup. Fresh lookups consult that toggle, while cached proxy results reject connections regardless of it. Correct both paths and test logging-only mode with fresh and cached addresses. Cache data is memory-only, and entry expiry is checked by periodic cleanup rather than each cache hit.
Many API-error paths allow the connection. Decide how your server should handle unavailable or malformed responses and test it. Do not label that behavior reliable blocking. Country blocking, whitelisting, Discord notifications and historical attempt logs remain listed as future work in the README.
Verify the administration UI
In the inspected Vue source, the refresh button has no click binding and the cache-duration input does not update its settings value. Success feedback appears before a server acknowledgement, while NUI callbacks do not send a response. Verify saving, refreshing, denied access and restart behavior against the package you deploy; the rendered dashboard alone proves none of these.
Reviewed on 11 September 2026 at source revision 0b86252a5e8f238ae691600a3bb6689b4c0e0fe8. The release ZIP passed integrity checks; its server Lua and manifest match this source byte for byte. Lua, configuration and Vue source were read; compiled JavaScript was not fully audited. No API key, player IP, connection block or FiveM runtime was used. Retain attribution and review the supplied custom license.
Open the creator’s 2.0r release