Server leaking ips (fB's Weekly)

[FrostBeule]

Hey. As some of you know, I'm hosting an endurance race called "fB's Weekly". Last season I had prizes for the first time, and often up to 200 players participate in the event which is really cool and something I never expected to happen. But as the event started to become bigger, these mysterious disconnects started to happen to the players, and especially to the top players of the season. JaviFlyer for example who started off the previous season the best wasn't able to finish any of the last races which essentially made him lose the season and the first prize.
At first I thought maybe it was just the server not being to handle the amount of people on it, but as these disconnects started to happen more frequently - especially in the last race of the season - I came to realize it had to be someone trying to deliberately ruin the competition and the event. People then told me that it was possible to access peoples' ips just through the server which further confirmed my suspicions.

I'd love to start hosting the race again, and I know a lot of people have grown to like playing in it too and are eagerly awaiting the next season (I constantly get questions about it), but I hesitate doing it because I feel like If there's no way to protect the players then these attacks are just going to happen again and again, and it would just be pointless to have it organized.

I guess I'm just making this topic to hear if there is maybe some sort of solution to this issue? I don't have much knowledge about stuff like this myself, and honestly I feel a bit hopeless about the situation at the moment. So I appreciate any help or suggestions.

[TGYoshi]

By default P2P is enabled, in which case the server must share the players ips. P2P is also used to synchronize maps etc. and offloading the server.
Players can disable P2P individually, no idea how it influences the server distributing ips though. You can probably test it while messing around with some settings, though.

I think that's the only case where replicating the players ip makes sense, though.

[novationx]

I hope this can be fixed. Looks like a serious bug ( if its actually due to bad intentions )

[TGYoshi]

It isn't really a bug, P2P works exactly as it should. Replicating ips when they aren't needed is a nice thing to filter out, of course.

[weerwolf]

If one did get ip's by looking at its computers connections on the p2p part, it is impossible for u to find out. If one has gained access to your server controller though, the logs could show some admin commands requesting players info. In that case u could get i bit further in the investigation.

[FrostBeule]

My server-host says he hasn't been able to track anything through the server-controller as the server itself wasn't attacked. And apparently by information I've received, turning off p2p -whether it's on the server or by the players themselves - have no affect and you can still attain ips by using something called "wireshark".
Someone said a possible solution might be to install a proxy on the server somehow, or use "cloudflare" to protect the players. Maybe that's something worth looking into, but not sure.

[oliverde8]

if it was indeed through the server controller there would be a message in game. Then again it would be possible to connect to the server throught the xmlprc and do kick commands. But normally the xmlprc port should be closed in all events.

I am wondering if a simple ddos attack to the player can cause him to disconnect from the server. This is interesting actually and actually not omplicated to test. I might actually try it on myself this weekend if I have time XD and let you know if I found anything.
For proxy, I am not sure how that could help in anyway, If the player was behind a proxy it would protect him from harm but this kind of attack arent really harmfull they have short term effects and a proxy wouldn't help.
The only solution is not to share the ip's so that whoever does this can't attack that player.

[FrostBeule]

That would be be cool. Any help is appreciated.

I suppose it could also be possible that whoever are doing these attacks didn't even get a hold of peoples' ips through the server, and instead got them through some other vulnerable software like Skype for example, but in that case it would be up to the players themselves to protect their ips. All I know is that the server has been attacked in the past according to my previous server-hoster, and since it apparently is possible to acquire ips through TrackMania-servers I'm lead to believe that's the method used.
I just want to make sure it's completely safe to play on the server so I can guarantee at least that for the players. Hopefully it's doable. Otherwise I don't think I can ever host the race again since I wouldn't be able to have a fair competition anymore.