--- title: "Protection" description: "Block VPNs, datacenters, bots, VOD downloads and line scanners, block IPs and user-agents by hand, and unblock a client who was stopped by mistake." --- Some people try to scrape your playlists, download your movies, guess line passwords or watch from a datacenter to restream your channels. The protection rules stop them at the door, and the unblock tools let you help a real client who was stopped by mistake. Protection lives in a few places: - **Settings** → **Security**: the protection rules. - **Servers** → **Block IP's** and **Block User Agents**: block by hand. - **Dashboard** notifications, the client page and **Servers** → **Logs** → **Protection** tab: see who was blocked and unblock them. Only administrators can change protection. ## Step 1: Choose your rules Open **Settings** → **Security**. ### VPN Policy (Users) and VPN Policy (Restreamers) Decide how VPN connections are handled, separately for normal users and for restreamers. Click **Edit** and pick a **Policy**: - **Allow All**: VPNs are allowed. - **Block All**: all VPNs are blocked. - **Whitelist**: only the VPN providers you select are allowed. - **Blacklist**: the VPN providers you select are blocked. For **Whitelist** and **Blacklist**, pick the providers in **VPN Providers** (**Select All** and **Deselect All** help). ### Block Unauthorized Restreamers Blocks users who are not restreamers when they connect from datacenter IP ranges. Restreamers are never blocked for using a datacenter. ### Block Bots (DMCA) Blocks known DMCA bots and automated scanning tools. ### VOD Download Protection Stops movies and series from being scraped or downloaded. Click **Edit**: - **Users can download VOD**: off means your users can stream movies but not download them. - **Restreamers can download VOD**: lets restreamers download even when users cannot. ### Block playlist downloads in browser for non-restreamers Clients who are not restreamers cannot download their playlist directly in a browser. They can still use it in VLC or in apps, and API login in apps is not affected. ### Missing Line Auto Blocking Blocks IPs that keep asking for lines that do not exist, a sign of someone guessing usernames and passwords. Click **Edit**: - **Enable automatic blocking**: turn the rule on. - **Ban type**: **Temporary ban** (it expires on its own) or **Permanent ban**. - **Temporary ban duration**: **1 hour**, **6 hours**, **12 hours** or **24 hours**. - **Attempts before blocking**: how many failed requests an IP can make before it is blocked. A higher number avoids blocking real clients who mistype. > [!NOTE] > A change to the protection rules can take up to 5 minutes to reach your servers. More options that limit how clients connect, such as **Block Empty User-Agents** and **Block any second different IP in Non-Restreamers**, are in **Settings** → **Streaming (Channels & Vod)** → **Access & Restrictions**. See [General settings](/docs/general-settings). ## How a block works When the VPN, datacenter, bot or VOD rules stop someone, the block applies to their **IP for 5 minutes**. - A movie or series download from a browser blocks movies and series in **every app on that IP** for 5 minutes. Live channels keep working. - Blocks show up as notifications on the [Dashboard](/docs/dashboard) and in **Servers** → **Logs** → **Protection** tab, where you can search by IP, user, reason or rule. ## Step 2: Unblock a client (engine 2.4.0 or newer) If a real client is blocked, for example someone at an office or on a mobile network, you can let them through. ### From the dashboard The notification shows the IP, the rule and the app. Choose: - **Lift block now**: ends the current 5-minute block right away. It does not create an exception: if the rule is broken again, the client is blocked again. - **Unblock…**: creates an exception. Choose: - **Who can get through**: **This client from** that IP, **This client from any IP** (for a client who travels or changes networks), or **Whole IP** (every client on that IP, for offices or a restreamer with several lines). The recommended option is marked. - **For how long**: **1 hour**, **24 hours**, **7 days** or **Permanent**. - **Note (optional)**: why you unblock this client. **Whole IP** and **Permanent** ask you to confirm with a check box. ### From the client page Open the client. The **Protection** block shows whether protection is blocking that client right now, and the exceptions that apply to it. From there you can **Lift block now**, **Unblock…**, **Revoke** an exception, or click **Add exemption** to let the client through from any IP. Resellers see this block in read-only mode. ### Review active exceptions Open **Servers** → **Logs** → **Protection** tab. **Active unblocks** lists every exception. Click **Revoke** to remove one; protection applies again right away. > [!WARNING] > An exception for a whole IP lets every line on that IP skip the protection rules, including lines of other resellers. Use the shortest time that solves the problem. ## Block IPs and user-agents by hand - **Servers** → **Block IP's**: click **Block IP**, enter the **IP (IPv4 or IPv6)** and a **Reason for blocking**. Delete a row to unblock it, or click **Clear all** to remove every blocked IP. - **Servers** → **Block User Agents**: click **Block User-Agent**, enter the **User-Agent**, and choose **Exact Match** if only that exact text must be blocked. ## Common problems - **A client says movies stopped working but live channels work.** Their IP was probably blocked for a VOD download from a browser. Check the **Dashboard** notification, then use **Lift block now** or **Unblock…**. - **I changed a rule and nothing changed.** Rules can take up to 5 minutes to apply on your servers. - **I do not see Unblock… or Active unblocks.** Unblocking needs engine 2.4.0 or newer on your main server, and an administrator account. See [Update the engine](/docs/update-the-engine). - **Lift block now did not help.** The client broke the rule again. Use **Unblock…** to create an exception. ## Related - [Dashboard](/docs/dashboard) - [General settings](/docs/general-settings) - [Edit a client](/docs/edit-a-client) - [Playlist encryption](/docs/playlist-encryption) - [Configure the Reverse Proxy](/docs/reverse-proxy)