Warzone Lobby Sentinel

Autonomous Xbox Warzone lobby integrity agent — cheat/VPS peer detection, packet-shield coordination, and tight integration with array-firewall.

Runs as a Rust service (Python fallback) on the same host as array-firewall or on a dedicated LXC. Polls gaming telemetry, scores lobby risk, and drives firewall actions (peer blocklist, subnet blocks, upload/download assist, network guard buffers) with no manual input during play.

What it does

Area	Behavior
Lobby risk	Packet/session scoring, cheater-lobby fingerprints, AI learning baselines
Peer tracking	Inbound identical-peer mesh detection (VPS probe patterns)
Live probe counter	Dashboard banner: blocked probe attackers this session + spike alerts
Session audit	Batch audit all sessions; Cheaters / Verdict / Playback columns
Evidence export	One-click bundle per session (postmortem + playback + probe logs → zip)
Firewall sync	Calls array-firewall API — block peers, block /24 subnets, sync packet shield
Network guard	In-match buffer modes (desync/kick), flood guard, MoCA tuning hooks
Notifications	ntfy push + optional Xbox Live inbox (cooldown-gated)
Dashboard	Built-in UI at :8098/v1/dashboard (embeddable in array-firewall Gaming Ops)

Cheater counts vs lobby verdict

The Session logs tab shows Cheaters = confirmed network probe sources (infrastructure excluded on the firewall side). This is not the in-game player cheater count.

When AI lobby verdict data is missing for a session, array-firewall backfills PROBE HEAVY, PROBE MODERATE, or PROBE LIGHT from probe forensics instead of showing a misleading CLEAN.

Live probe counter (Overview tab)

While in a session, the dashboard shows a Live probe counter banner fed by GET /api/v1/gaming/probe-ops/live on array-firewall:

• Total probe attackers blocked this session
• Unique probe IPs seen
• Spike alert when block rate jumps in the last 60s

Session logs & evidence

Action	Description
Audit all	Batch re-audit every saved session via array-firewall
View	Load archived session into live peer table
Playback	Timeline of probe detections and shield steps
Evidence	POST evidence bundle → zip with postmortem, playback, probe logs
Download	Export session peers in json/csv/tsv/txt/ndjson/md

Reports persist on the firewall at /var/lib/array-firewall/session-reports/ and are proxied through Sentinel routes.

Deployment reference

Set site-specific values in /etc/default/warzone-lobby-sentinel or a local secrets file — do not commit them.

Variable	Purpose
PROXMOX_NODE	Proxmox host SSH target (for deploy-to-lxc.sh)
WZ_SENTINEL_CTID	LXC ID when deploying to a container
WZ_ARRAY_FW_API_URL	array-firewall API base (co-hosted: http://127.0.0.1:8090)
WZ_ARRAY_FW_API_TOKEN_FILE	Bearer token file for the API
WZ_XBOX_IP	Console IP on the gaming LAN
WZ_INGEST_PORT	Sentinel HTTP port (default 8098)

Item	Example
array-firewall API	http://${ARRAY_FW_IP}:8090
Sentinel dashboard	http://${ARRAY_FW_IP}:8098/v1/dashboard
Health	http://${ARRAY_FW_IP}:8098/health

Quick start

Co-hosted on array-firewall (recommended)

# On the firewall appliance after array-firewall is installed
cd /opt/warzone-lobby-sentinel
cp warzone-lobby-sentinel.env.example /etc/default/warzone-lobby-sentinel
# Edit: WZ_ARRAY_FW_API_URL, WZ_XBOX_IP, token paths
./install-in-ct.sh

Remote Proxmox LXC

export PROXMOX_NODE=pve-primary.example
export WZ_SENTINEL_CTID=101
export WZ_ARRAY_FW_API_URL=http://192.0.2.10:8090   # RFC 5737 example only

./deploy-to-lxc.sh

Or use ./deploy-proxmox.sh to provision a new container and deploy in one step.

Build Rust binary locally

cd rust && cargo build --release
install -m755 target/release/warzone-sentinel ../bin/warzone-sentinel

Configuration

Copy warzone-lobby-sentinel.env.example → /etc/default/warzone-lobby-sentinel.

Key settings:

• WZ_ARRAY_FW_API_URL / WZ_ARRAY_FW_API_TOKEN_FILE — firewall API access
• WZ_XBOX_IP — console to protect and tune QoS for
• WZ_POLL_INTERVAL_SEC — active poll interval (idle interval separate)
• WZ_NTFY_* — phone alerts while in match
• WZ_XBOX_NOTIFY_* — optional Xbox Live self-messages

systemd unit: warzone-lobby-sentinel.service → tools/run_automated.sh → bin/warzone-sentinel.

API (HTTP)

Method	Path	Description
GET	/health	Liveness
GET	/v1/status	Full sentinel + peer + network guard snapshot
GET	/v1/dashboard/data	JSON snapshot (includes probe_live from firewall)
GET	/v1/sessions/audit-index	Session audit index (cheater counts, verdicts)
POST	/v1/sessions/audit-all	Batch audit all sessions
GET	/v1/sessions/{hex}/postmortem	Post-mortem report JSON
GET	/v1/sessions/{hex}/playback	Playback JSON or ?format=text
POST	/v1/sessions/{hex}/evidence	Export evidence bundle (zip)
GET	/v1/sessions/{hex}/download	Download session export (format query param)
POST	/v1/peers/shield	Apply peer-strict shield via firewall
POST	/v1/peers/clear	Clear peer tracker table

Firewall integration is implemented in rust/src/firewalla.rs (peers, subnets, shield, QoS boosts, network guard, session audit, probe_ops live stats, evidence export).

Configuration notes

Sentinel does not implement probe countermeasures directly — it drives array-firewall via the API. Key firewall policy keys (in /var/lib/array-firewall/policies.json):

"gaming": {
  "mitigation": {
    "probe_confusion": { "enabled": true, "udp_mode": "mutate-echo", ... },
    "probe_ops": {
      "sync_on_block": true,
      "pre_burst_identical_min": 4,
      "probe_heavy_min": 5,
      "live_spike_window_sec": 60
    }
  }
}

See array-firewall README — Gaming & probe defense for the full feature list and API paths.

Repository layout

rust/                 # Rust core (primary runtime)
sentinel/             # Python fallback + helpers
tools/                # run_automated.sh, setup scripts
data/                 # Static role hints (server-roles.json)
samples/              # Overwolf bridge sample
install-in-ct.sh      # In-container install
deploy-to-lxc.sh      # Push bundle to existing LXC
deploy-proxmox.sh     # Provision + deploy on Proxmox

Related projects

• array-firewall — gateway, packet shield, peer/subnet blocklists, Gaming Ops dashboard

License

See repository defaults; treat gaming telemetry and API tokens as sensitive operational data.