SVC
Background enforcement service
The DevilGuardServer Windows service runs independently of the local dashboard, monitors configured DFBHD server instances and processes website commands using the current HawkSync player snapshot.
Server-side protection
Devil-Guard Server is the protected game-server component used with HawkSync and participating Delta Force: Black Hawk Down servers. It reads the current HawkSync player list, asks the Devil-Guard website whether each player has a valid protection session, delivers in-game compliance notices and carries out approved kick, blacklist and narrowly scoped firewall commands.
What it is
The server agent does not scan player computers. It acts on current information supplied by HawkSync and decisions returned by the Devil-Guard website.
WEB
Local administration dashboard
The included dashboard displays server status, current players, client-protection state, aliases, managed firewall rules, HawkSync bans and recent integration errors. It also provides controlled configuration and testing tools for authorised administrators.
Operating cycle
The default poll interval is ten seconds and overlapping passes are prevented.
01
Read HawkSync players
Requests the current HawkSync snapshot, including live player names, slots, public IP addresses and the active DFBHD UDP port.
02
Ask the website
Sends the current player list to the configured Devil-Guard website, which evaluates aliases, signed PC-client reports, grace periods, whitelists and current enforcement cases.
03
Deliver notices
When supported by the installed HawkSync build, sends staged private messages explaining that Devil-Guard PC is required and how much grace time remains.
04
Apply one-time commands
Processes only pending block, unblock and related commands. Completed bans are not supposed to be rebuilt or reissued on every poll.
05
Report results
Returns the kick, HawkSync blacklist and firewall outcome to the website and stores unsent results locally so they can be retried after a temporary website failure.
15m
Reconcile inventory
Reports managed firewall inventory after a change and periodically for reconciliation instead of repeatedly rebuilding correct rules.
Client-required protection
The website decides whether the joined player has a current valid PC-client session; the server carries out the resulting staged response.
JOIN
Player is evaluated
When a player appears in HawkSync, their registered name, recognised aliases and current server presence are compared with recent signed Devil-Guard PC protection reports.
WARN
In-game installation message
If protection is missing or stale, the player can receive an initial message telling them to install or start Devil-Guard PC, followed by a final warning before grace expires.
KICK
Removal after grace
If valid protection does not return, HawkSync can add a managed blacklist record and remove the current player with a clear client-required reason.
TEMP
Temporary compliance quarantine
The server can add paired scoped Windows Firewall rules for the current DFBHD UDP connection: one inbound rule and one outbound rule. Missing-client cases normally use a temporary quarantine rather than automatically becoming permanent cheat bans.
If a valid client report arrives before grace expires, pending missing-client enforcement is cancelled. If the website cannot be reached, the agent preserves existing restrictions but should not invent new client-missing decisions locally.
HawkSync integration
HawkSync remains the source of the live player list and the server-management actions associated with that list.
Private player messages
The player-message route is configurable because HawkSync builds can expose different API routes. Unsupported routes disable further message attempts for that service run without disabling kick or firewall enforcement.
Immediate kick
For an approved block command, the agent matches the current player carefully by name and IP before issuing the HawkSync kick.
Owned blacklist entries
Devil-Guard stores the HawkSync record identifiers it creates so later unblocking removes only Devil-Guard-owned name and IP entries, not unrelated administrator bans. An Admin website unblock is queued first; Devil-Guard Server then removes its HawkSync name/IP entries and both managed firewall directions before the completed enforcement case is cleared.
Recoverable results
Completed actions are saved before website acknowledgement. If reporting fails, the exact result is retried instead of blindly repeating the underlying enforcement action.
Scoped firewall enforcement
Managed rules are created as a paired inbound and outbound block for only the affected player’s DFBHD UDP connection.
IP
One remote address
The rule targets the player IP supplied by the current HawkSync presence and refuses loopback, multicast, unspecified or game-server-owned addresses.
I/O
Paired inbound and outbound rules
Devil-Guard creates both directions for the same remote player IP, UDP protocol and active DFBHD port, rather than blocking all ports or unrelated traffic.
EXE
Selected game executable
The rule is scoped to the configured dfbhd.exe or dfbhdlc.exe and selected Windows network interface.
LOW
Low-latency maintenance
Existing correct inbound/outbound rules are left untouched. Port migration occurs only when HawkSync reports a real game-port change, and inventory is reconciled after changes rather than every polling pass.
Optional network policy
Server operators can optionally enable network-intelligence policy without routing game traffic through Devil-Guard.
API
Cached IP intelligence
The website cache is checked first. Only uncached or expired addresses are sent to the configured vpnapi.io account for VPN, proxy, Tor or private-relay classification.
OPEN
Provider failures fail open
A lookup failure by itself does not create a new player block. A positive result is handled according to the server operator’s enabled policy.
Security and privacy
The server service has significant privileges and should be deployed with the same care as other game-server administration software.
Protected local secrets
The enforcer token, HawkSync credentials, profile configuration and optional provider key are stored using Windows machine-level DPAPI inside a restricted ProgramData directory.
HTTPS website connection
The configured Devil-Guard website must use HTTPS. Authentication uses the server’s enforcer token, which should be unique, private and rotated if exposed.
Local dashboard by default
The administration dashboard should remain bound to localhost. Remote access should be placed behind a trusted VPN or HTTPS reverse proxy rather than exposed directly over plain HTTP.
High service privileges
The Windows service runs with the permissions needed to manage firewall rules. Access to the host, dashboard and stored configuration should therefore be limited to trusted administrators.
Clear boundaries
No packet proxy
It is not a VPN, game relay or UDP proxy. Player traffic continues directly between DFBHD and the player.
No player-PC inspection
The server package does not read files, memory or processes on a player’s computer. Player-side protection is performed by Devil-Guard PC and evaluated by the website.
No DFBHD injection
It does not inject code into DFBHD, modify game files or write to the DFBHD process.
No broad network shutdown
Managed rules are limited to Devil-Guard-owned DFBHD UDP blocks and are removed through matching unblock commands or expiry.
For server operators
Connect HawkSync, protect the dashboard and test every enforcement stage.
Confirm the correct player-message route, use a dedicated HawkSync account with the required permissions, keep the dashboard local or behind HTTPS, and test warning, kick, temporary block and automatic unblock behavior before enabling client-required enforcement publicly.