It's definitely not the VPN protection, as connections are never dropped before the player joins the game. Only after, from the client's perspective, the loading screen is over and 40 seconds pass. This is to let players know why they are being dropped. The external tool doing the checks is not even aware of your existence before you're in.
Could you answer these questions for me?
1. Are you able to connect to TIN Open or any of the EW servers while you can't connect to }{? They are hosted by me with the exact same configurations (docker swarm, so small inconsistencies should not exist) and TIN Open is even in the same data centre.
2. What do you get when you enter 'tracert 209.250.234.184' in Command Prompt or PowerShell? Wait until the execution finishes and copy and paste the full log here. After tracing the first few routes it will start timing out. This is normal. I'm interested in the route before this starts happening.
3. This one is a bit harder but very informing: Download an rcon GUI tool, and try and send a random command to the server you can't connect, using a random rcon password. You will get 'Bad rconpassword' as a response if you can connect to the server. If you can't connect, this will timeout.
Some rcon GUI tools you can try:
1.
JAControl Desktop - JKHub (has less features than others, but doesn't require you to run an installer and I can give better support as it is mine)
2.
RCON Unlimited - JKHub
3.
Rcon SE
Also if you happen to be familiar with JS/TS I can recommend using this:
quake3-rcon
Edit: Solved. They were in the ban list. We do drop connections early on but this shouldn't have been in the "awaiting game state" phase, which made a network issue seem to be a more likely case.