Crash or Mass Kicks After Enabling ReHLDS Security Cvars

You followed the hardening step in the ReHLDS install guide, restarted, and now the server "crashes": players drop in groups, regulars cannot rejoin, or the process really dies. Usually nothing crashed. The ReHLDS flood limiters kick or IP-ban players by design, a few cvars change what clients receive and break plugins that depend on it, and there is one genuine crash path in the current release. This page was checked against the source of ReHLDS 3.15.0.896, the current release at the time of writing.

1. Crash, kick or ban? Read the console first

Start with timing. If the trouble began with the first restart after the config change, suspect the cvars. If it predates the change or appears every few days at a random map change, treat it as an ordinary crash: see debugging a crash with no error.

Then read the live console (the screen or tmux window, or journalctl -u <your unit>). Drop reasons go to the console, not to cstrike/logs/:

Dropped PlayerName from server
Reason:  Banned for string commands flooding (Avg)

The limiters print Kicked for or Banned for followed by string commands flooding or move commands flooding with (burst) or (Avg), or by speedhack / slowmo. "Banned" means ReHLDS ran addip on the player's address, so everyone on that IP now gets You have been banned from this server. listip shows the bans and removeip 1.2.3.4 lifts one.

Two more lines point at the batch. Too many connect packets from 1.2.3.4:27005 (6>5) in the server log means the per-IP connection limit turned someone away. User 1.2.3.4:27005 will be banned for rcon hacking means the rcon failure cvars caught a client, often your own panel or bot. With developer 1 the limiters also print the measured rate, for example PlayerName Banned for string commands flooding (Avg) (312.4), so you can see how far over the limit a real player went.

A real crash is different: the process exits with a segmentation fault and hlds_run restarts it. Only one cvar in this family does that (section 3).

2. Revert the batch, then re-enable one at a time

A cvar keeps its value until something sets it again or the server restarts, so commenting a line out of server.cfg changes nothing on a running server. Check that no other file sets the same cvars:

cd /home/steam/hlds/cstrike
grep -rn "sv_rehlds_\|sv_rcon_\|sv_filterban" *.cfg addons/amxmodx/configs/

Restore the previous config, restart, and confirm the symptom is gone. Then add the cvars back one per restart, treating the four string-rate and the four move-rate cvars as one step each. Wait for a busy evening before calling a step clean: flood limits only trip under real binds, frame rates and packet loss. Typing a cvar name alone shows its live value, for example "sv_rehlds_stringcmdrate_max_avg" is "250".

Add sv_echo_unknown_cmd 1 to the top of server.cfg while you work. Without it ReHLDS silently ignores cvars it does not know, and the README on the master branch already lists cvars (sv_rehlds_dlfile_*, sv_reconnect_timeout) that 3.15.0.896 does not have.

3. The cvars that cause trouble, and why

String and move command flood limits

sv_rehlds_stringcmdrate_max_avg / _max_burst limit text commands per second: chat, buy and radio binds, menu choices, and a setinfo each time a userinfo setting (name, rate, cl_updaterate, model) changes. sv_rehlds_movecmdrate_max_avg / _max_burst count movement commands, which a client produces once per rendered frame, so a 1000 fps player sends ten times what a 100 fps player does. Packets lost in transit are added to the move count too, so a player recovering from a lag spike looks like a burst.

The defaults compiled into current builds are 250 / 500 for string commands and 1800 / 5500 for move commands. The README still shows older, lower numbers and anti-flood configs often go lower again. Every step below the compiled defaults catches more real players. Bots are never affected: YaPB, PODBot and fake-player plugins are fake clients that send nothing over the network, and the limiters skip them.

Two traps in 3.15.0.896 and older:

• _max_avg 0 does not disable the average check. In these builds the average check is switched off by the burst cvar, so an average limit of 0 bans every player the moment they type anything. To disable a limiter there, set its _max_burst to 0, which turns off both checks. The source has since been changed so each cvar controls its own check; read the release notes of the build you run.
• Punishment is an IP ban. sv_rehlds_*_punish is minutes of IP ban, 0 is permanent, negative means kick only. Use -1 while tuning so a false positive costs one reconnect, not a locked-out internet cafe.

Speedhack detection: the one that really crashes

3.15.0.896 added a speedhack and slow-motion detector (sv_rehlds_movecmdtime_*). Punishment is off by default (sv_rehlds_movecmdtime_max_warnings -1). Set it to 0 or higher and the detector drops the player while their movement commands are still being processed, and in 3.15.0.896 the server can then segfault on the commands left over for that player. The fix landed in the source after that release, so keep it at -1 until your build includes it. Its neighbour sv_rehlds_movecmd_max_null_streak is off by default too; the source notes that legitimate clients above 1000 fps send zero-length commands, so keep it generous if you enable it.

sv_rehlds_maxclients_from_single_ip

Counts connections from one IP that are still connecting (default 5). Lower it and a group behind one address, such as a LAN centre, a household or mobile carrier NAT, gets Too many connect packets from your ip address when joining together.

sv_rehlds_userinfo_transmitted_fields

When set, only the listed userinfo keys reach other clients. The server and plugins still see everything, so nothing errors; it just looks wrong to other players. Leave out \model and plugins that change player models through that key show default models to everyone else. Leave out \*sid and the scoreboard loses Steam avatars. Keep it empty (the default), or start from the README example "\name\model\*sid\*hltv\bottomcolor\topcolor".

sv_rehlds_local_gametime

This is the one behind most "plugins with hand-built messages break" reports. Each client gets a clock counted from when it connected to the map instead of the map's running time, which the README says reduces the lag that builds up when one map runs for a long time. The engine converts the times it knows about (the clock message, entity time fields, a fixed set of weapon fields). It cannot convert an absolute game time a plugin or custom mod writes into its own message or any other field, so client-side timers, weapon animations or effects fire at the wrong moment. The server does not crash. It is not a security feature, so set it to 0 if anything client-side misbehaves.

The rest of the batch

• sv_rehlds_attachedentities_playeranimationspeed_fix stops leg animations speeding up on players with attached entities (hats, back models). The README warns it can cause animation lag at low cl_updaterate. Cosmetic; turn it off if players complain.
• sv_rcon_minfailures, sv_rcon_maxfailures and sv_rcon_minfailuretime ban an address after too many bad rcon passwords, for sv_rcon_banpenalty minutes (default 0, permanent). The usual victim is your own web panel, HLSW or Discord bot with an old password. Because the ban is an IP filter, the tool cannot even query the server and reports it offline.
• sv_filterban must stay exactly 1, its default. That is what makes the IP list a ban list; other values change its meaning and can lock out everyone not on it.
• sv_rehlds_force_dlmax 1 (full-size download fragments regardless of the client's cl_dlmax) and sv_rehlds_send_mapcycle 0 (already the default) are low risk.

4. Plugins that trip the limits

If many players are kicked at the same moment, such as round start or spawn, a plugin is pushing commands to clients. Plugins that call client_cmd or build an SVC_STUFFTEXT message by hand make the client run text, and whatever it sends back counts against the string limit, including a setinfo per changed setting. Old rate-enforcer and config-forcing plugins are typical. Find the plugin by commenting out half of plugins.ini at a time, as in finding the crashing plugin. Then update it or ask its author to stop pushing settings on every spawn, replace it, or put the limiter back to its compiled default. Do not switch the limits off on a public server for one plugin; at the defaults they only catch abnormal clients.

5. A safe baseline

For 3.15.0.896, in cstrike/server.cfg:

sv_filterban 1

// 5 bad rcon passwords in 30 s = 60 minute ban
sv_rcon_minfailures 5
sv_rcon_maxfailures 5
sv_rcon_minfailuretime 30
sv_rcon_banpenalty 60

// flood limits at the compiled defaults, kick only while tuning
sv_rehlds_stringcmdrate_max_avg 250
sv_rehlds_stringcmdrate_max_burst 500
sv_rehlds_stringcmdrate_avg_punish -1
sv_rehlds_stringcmdrate_burst_punish -1
sv_rehlds_movecmdrate_max_avg 1800
sv_rehlds_movecmdrate_max_burst 5500
sv_rehlds_movecmdrate_avg_punish -1
sv_rehlds_movecmdrate_burst_punish -1

// off until your build has the crash fix
sv_rehlds_movecmdtime_max_warnings -1

sv_rehlds_maxclients_from_single_ip 5
sv_rehlds_force_dlmax 1
sv_rehlds_send_mapcycle 0

// behaviour changes: off until you need and have tested them
sv_rehlds_local_gametime 0
sv_rehlds_attachedentities_playeranimationspeed_fix 0
sv_rehlds_userinfo_transmitted_fields ""

After a week with no false positives you can give the punish cvars a positive ban time. Windows uses the same cvars in the same file; only the engine binary differs (see ReHLDS on Windows).

Common errors

• Everyone is banned for flooding seconds after joining: an _max_avg cvar is 0. Restore the default, then clear bans with listip and removeip.
• High-fps players or players on bad connections get "move commands flooding": the move limits are below 1800 / 5500. Restore them.
• Segfault with players on after enabling speedhack detection: set sv_rehlds_movecmdtime_max_warnings -1.
• A group from one place cannot join together: raise sv_rehlds_maxclients_from_single_ip back to 5 or more.
• Custom player models look default to others: add \model to sv_rehlds_userinfo_transmitted_fields or clear it.
• Your panel or bot shows the server offline: it was banned for bad rcon passwords. removeip it and update the password; see securing rcon.
• Nobody can connect at all: sv_filterban is not 1.

Verification checklist

• version prints a ReHLDS version: line, so you know which release's behaviour applies.
• Each cvar from the batch shows the intended value when typed alone in the console.
• A full evening of play produces no flood Reason: lines for regular players.
• listip shows no bans you did not expect.
• Your rcon tools still connect, and the server stays up through several map changes.