How Bans Are Enforced

A ban has to work at the moment a player connects, and that moment cannot depend on a web request that might fail. So MonoAdmin enforces bans in two layers: your server keeps its own copy of every ban and checks it first, then it asks MonoAdmin for a second opinion. This page explains both layers, what happens when the second one is unavailable, and what the banned player sees.

The same machinery holds mutes and community service. Kicks and warnings are one-off deliveries and are not part of the copy.

The Local Copy

The MonoAdmin resource on your server saves every active ban, mute and community service order in the server’s own storage. It loads that copy when the resource starts, before any player can connect.

That has three consequences:

• Bans hold through a MonoAdmin outage and through a server restart. Nothing has to be reachable for a banned player to be refused.
• Timed bans carry their end time and expire on schedule on the server, with no help from MonoAdmin.
• monoadmin unlink does not let anyone back in. Cached bans stay in force while the server is unlinked, and monoadmin status says how many.

The copy stays current on its own. When you issue or revoke a punishment, MonoAdmin pushes the change to your server immediately. When the server reconnects, it asks what changed since the last version it has and catches up. A failed catch-up is retried, and the existing copy stays in force the whole time.

Two cases reset the copy: linking the server to a different project discards the old project’s bans, because they are not this server’s to enforce, and a brand new link starts empty until the first sync.

What Happens When a Player Connects

1. The local copy is checked first. A connecting player matches a ban when they share any one identifier with it, or at least two hardware tokens. A match is refused at once with the ban message. This works with MonoAdmin unreachable, which is the point of the copy.
2. MonoAdmin is told who is knocking. Even when the local copy has already said no, the server still sends MonoAdmin the identifiers and tokens of the attempt. That is how a sticky ban learns about someone evading it. See Sticky Bans and Linked Accounts.
3. MonoAdmin is asked for a second opinion. If the local copy allowed the player, the server holds them at the connecting screen for at most 1.5 seconds and waits for MonoAdmin’s answer. This catches a ban the local copy has not received yet. If MonoAdmin says the player is banned, they are refused with the ban message.
4. If MonoAdmin does not answer in time, or the link is down, the player is let in. This is the default and is called fail-open.

If several bans match one player, the one that lasts longest is the one reported. A permanent ban beats any date.

The 1.5 second limit is the same for every project. Nobody is ever held longer than that, unless you turned the whitelist on: then the server waits up to 6 seconds for MonoAdmin’s answer, because the whitelist is checked in the same answer, right after the ban check. A ban always comes first, whatever the whitelist says. See Whitelist.

Fail-Closed

Fail-closed is a safety setting that refuses entry when a check cannot be made, instead of letting everyone in. Turn it on under Settings > Game Settings, in the section When MonoAdmin Cannot Be Reached, with the switch Block joins while MonoAdmin is unreachable. You need Edit Settings.

With it on, a player whom the local copy does not refuse, but whom MonoAdmin could not be asked about in time, is turned away with this message:

This server cannot check your access right now. Please try again in a few minutes.

The panel asks you to confirm first, with Block Joins When MonoAdmin Is Unreachable? and Turn On and Save, because the consequence is real: while the setting is on, an outage, or your server losing its internet connection, keeps everyone out, staff included.

	Fail-open (the default)	Fail-closed
Player in the local copy	Refused	Refused
MonoAdmin answers “banned”	Refused	Refused
MonoAdmin answers “allowed”	Let in	Let in
MonoAdmin does not answer in time	Let in	Refused with the message above
Link to MonoAdmin is down	Let in	Refused with the message above

Fail-open can miss a ban that your server has not received yet, such as one issued while the server was disconnected. Choose fail-closed if letting someone in unchecked costs your community more than a locked door does. When it is on, monoadmin status prints a line starting “Connect check: fail-closed”.

The whitelist does not wait for this switch. While it is on, a player MonoAdmin could not be asked about is always turned away, with its own message, whatever this setting says.

Players Who Are Already Online

A new ban is also enforced on the people already playing. When your server receives it, anyone online who matches is removed at once, with the same ban message. That includes other accounts of the same person when the ban is sticky.

The server also re-checks everyone online every 30 seconds, so a ban that arrives or an expiry that passes does not wait for the next join.

What the Banned Player Sees

When a banned player is refused at the door, or removed while playing, their game shows this:

You are banned from this server.
Reason: Random deathmatch at Legion Square
This ban ends on Oct 12, 2026, 2:05 PM GMT+8.

The last line has three forms:

Line	When
This ban is permanent.	The ban has no end.
This ban ends on a date and time.	The ban is temporary. The date is written in your project’s time zone, with the zone named.
This ban is temporary.	The server could not write the date. The ban holds either way.

The reason is the one staff wrote, with control characters removed and shortened to 300 characters if it is longer. A ban with an empty reason says “no reason given”.

A kicked player sees a similar screen:

You were kicked from this server.
Reason: Please read the rules before returning.

When a Ban Ends

A timed ban ends by itself:

• The server stops enforcing it at the end time, even if MonoAdmin is unreachable. The end time is MonoAdmin’s, so a wrong clock on your server does not shift it.
• The panel shows the ban as Expired as soon as the end time passes.

A ban can also be lifted early by revoking it. The panel tells the server immediately, and if the server is offline it lifts the ban when it reconnects. See Punishments.

Keeping an Eye on It

• Server Logs. Each time a player is turned away while MonoAdmin is reachable, a line “was refused at the door” appears under the Connections type. See Server Logs.
• The console. Run monoadmin status in the server console. The “Punishments” line shows how many entries the server is enforcing from its local copy and which revision it has, or “not synchronised yet” if it has never received any. See Console and Chat Commands.
• The dashboard. The server badge shows whether the server is connected right now. See The Dashboard.

What Is Not Part of This

MonoAdmin does not use IP addresses to match bans, and it has no appeals flow. Both are covered in Sticky Bans and Linked Accounts and Punishments. If bans do not seem to work, start with Troubleshooting.