Firewall Settings
The firewall checks every verification attempt. It needs Premium, and some features need a higher plan. Sub-users need the Manage Firewall permission to open this tab. The entries below are a summary; see the Firewall guide for rules, passwords and logs in depth.
The firewall checks every verification attempt. It needs Premium, and some features need a higher plan. Sub-users need the Manage Firewall permission to open this tab. This page is a reference for each control; see the Firewall guide for strategy, examples and bypasses.
The tab has three sub-tabs: Rules, Passwords and Activity Logs.
Go to Firewall Go to Firewall › Passwords Go to Firewall › Activity Logs
How the firewall decides
- Order: an active bypass wins first. Then your bypass all checks rules run, then every other rule from oldest to newest. The first rule that matches decides; later rules are not checked.
- Protections (VPN, wireless and alt blocking) are checked after your rules. Only a bypass all checks rule or a bypass skips all of them; see the decisions under Custom Rule.
- Saving: everything on this tab saves as soon as you click it. There is no Save button.
- Summary bar: the bar at the top of the tab counts Allowed, Denied and Password Used attempts over the last 30 days.
Block VPNs & Proxies
Requires Premium or higher.
A switch in Protections, at the top of the Rules sub-tab. When it is on, anyone whose IP looks like a VPN, proxy or other anonymous connection cannot verify. They see error 990044 and the attempt is logged as Blocked (VPN).
- Turning a protection on takes effect straight away. Turning it off asks you to confirm first.
- To let one staff member through on a VPN, add an allow through firewall or bypass all checks rule for them instead of turning this off. See Allowing staff on VPNs.
Block Wireless Connections
Requires Enterprise or higher.
Blocks verification from mobile data, such as LTE, 4G and 5G. RestoreCord decides this from the network information of the member's IP address, so members on a phone usually need to switch to Wi-Fi. They see error 990043.
Block Alt Accounts
Requires Premium or higher.
Stops a second Discord account from verifying when another member of this server already verified from the same IP address or the same browser. Blocked members see error 990045 and the attempt is logged as Blocked (Alt).
- With the switch off, matches are still reported: if you have a Discord webhook set, it posts an Alt Account Warning and the member is let in.
- Housemates, school networks and public Wi-Fi share IPs and can look like alts. Watching the warnings for a while before you block is a safe way to start.
Enforce Passwords
Requires Enterprise or higher.
Every member must enter one of your verification passwords before they can verify. Any active, unexpired password with uses left works, and if it has an Assigned Role, the member gets that role too.
- A member who gives no password sees error 990032; a wrong, disabled, expired or used-up password gives error 990033.
- Members who match a bypass all checks rule or have an active bypass skip the password.
Create at least one active password before you turn this on. With no usable password, nobody can verify.
Filter rules by type
A dropdown above the rules list that shows only one kind of rule. It changes the view only; it does not turn rules on or off.
| Option | Shows |
|---|---|
| All Rules | Every rule (the default) |
| Allow | allow through firewall rules |
| Block | block rules, including imported bans |
| Require Password | require password rules |
| bypass all checks | bypass all checks rules |
Add Security Rule
Requires Premium or higher.
Opens the Add Security Rule picker with three kinds of option:
- The four protections. Click a card to turn that protection on or off. A green ENABLED badge shows which are on. Turning one off from here does not ask you to confirm.
- Custom Rule, to build your own condition.
- Import banlist from Discord Server, to block everyone on your Discord ban list.
Custom Rule
Requires Premium or higher.
Found inside Add Security Rule. Each rule reads If field, operator, value then decision, and the Live preview shows it as a sentence while you build it. Rule name (optional) can be up to 100 characters; without one, the list shows the rule's value.
| Field | Operators | Value |
|---|---|---|
| Discord role | contains, does not contain | A role in your server. Matches members who already have it. |
| Server membership | contains, does not contain | A Discord server ID. Matches members who are in that server. Needs Business or higher. |
| Username | is, is not, contains, does not contain | Text or a regex, up to 200 characters |
| Email domain | is, is not, contains, does not contain | A domain such as example.com, or a regex |
| User ID | is, is not | A Discord user ID (17 to 19 digits) |
| IP address | is, is not | An IPv4 address |
| IP range | is within, is not within | An IPv4 CIDR range, for example 192.168.1.0/24 |
| Country | is, is not | One or more countries, picked from a list |
| Continent | is, is not | One or more continents, picked from a list |
| ASN | is, is not | A network number such as 13335 (a leading AS is removed) |
- Regex: for Username and Email domain, write the value as
/pattern/flags, for example/^staff[-_].+/i. Patterns use RE2 syntax, can be up to 200 characters and accept the flagsi,mands. A Regex ✓ badge shows when the pattern is valid, and you can't save while it is invalid. Plain text is must match the whole value exactly, including upper and lower case. - Email domain asks members for their email on Discord's authorize screen. Server membership and Discord role rules are checked live, so if RestoreCord can't read that information, verification fails instead of letting the member in.
| Decision | What happens |
|---|---|
| block | The member can't verify and sees error 990031 (990046 for Server membership rules). |
| allow through firewall | Lets the member through without checking later rules or the VPN check. Enforce Passwords, captcha, alt and wireless blocking and Minimum Account Age still apply. |
| require password | The member must enter the Required password you pick. The password must be active, or the rule won't save. |
| bypass all checks | Skips every check: other rules, protections, passwords, captcha and Minimum Account Age. |
With any decision except block, Add action gives up to 5 roles (Give role) when the rule matches. Each role can be added once.
Import banlist from Discord Server
Requires Premium or higher.
Found inside Add Security Rule. It reads your Discord server's ban list and shows who will be imported, with each user's name and ban reason. Click Import to turn each one into a block rule on their User ID.
- Users who already have a block rule are skipped, so you can run the import again later to pick up new bans. If there is nobody new, it says All bans already imported.
- Your bot needs the Ban Members permission, or the import fails with "Bot is missing BAN_MEMBERS permission".
- To block new bans automatically from now on, turn on Auto-Blacklist on Ban.
Firewall Rules
All your rules, grouped as Blocked, Password required, Allowed and Bypass all checks, with a count for each group. Each row shows the rule's name (or its value) and the field it checks. Country and continent rules with several picks show how many are selected.
The ⋯ menu on each rule has Edit Rule, Disable Rule / Enable Rule and Delete Rule. A disabled rule stays in the list, faded with an Inactive badge, and is ignored until you enable it. Deleting asks you to confirm and cannot be undone.
Add Verification Password
Requires Enterprise or higher.
Creates a password for Enforce Passwords or require password rules.
| Field | Rules |
|---|---|
| Password Label | Required, up to 50 characters. A name only you see; it must be different from your other labels. |
| Password | Required. Members must type it exactly; it is case-sensitive. |
| Max Uses (Optional) | Leave empty for unlimited. Once it is used up, the password stops working. |
| Assigned Role (Optional) | A role given to members who verify with this password |
| Expires in (Optional) | A slider: 30 minutes, 1 hour, 6 hours, 12 hours, 1, 3 or 5 days, 1 to 4 weeks, 1 to 3 months, or No expiry (the default) |
Passwords
Every password with its label, an Active or Inactive badge, its uses (for example Uses: 3/10) and its expiry date. The ⋯ menu has Edit Password, Disable Password / Enable Password and Delete Password. Without Enterprise, the menu is greyed out.
- Edit Password changes the label, max uses, role and expiry. It does not change the password itself, so to change what members type, create a new password and delete the old one.
- A disabled or expired password is rejected as wrong.
Refresh firewall logs
The Refresh button on the Activity Logs sub-tab reloads the log. After each refresh it waits a few seconds (it shows a countdown) before you can click it again.
The log shows 10 entries at a time, newest first; Load More fetches the next page. Each entry shows the event, the time and, where known, the member's name, User ID, IP address, country and the password label. Click any of these to copy it. If a rule decided the attempt, its name and value are shown too. IP addresses only appear when IP Logging is on.
Search firewall logs
Shows only one member's entries. Enter a Discord User ID; the search accepts numbers only, and anything else shows "Enter a valid User ID (numbers only)" and is ignored. Click × to clear it.
Denied entries with a User ID have a Bypass button. Its Grant Temporary Access menu lets that member skip every firewall check for 15 Minutes, 1 Hour, 6 Hours, 24 Hours or 7 Days. A member who already has a bypass shows Bypassed with the time left instead. See Bypasses.
Filter by Event
The settings button next to the search box filters the log to one event type. It works together with the search.
| Option | Shows |
|---|---|
| All Events | Everything (the default) |
| Allowed | Attempts the firewall let through |
| Denied | Attempts denied by a block rule or wireless blocking. VPN and alt blocks are separate events and are not included. |
| Password | Successful password entries |
| Blocked (Server) | Attempts blocked by a Server membership rule |