diff --git a/src/main/java/deathcap/wsmc/Main.java b/src/main/java/deathcap/wsmc/Main.java
index 702663f..d57a1b3 100644
--- a/src/main/java/deathcap/wsmc/Main.java
+++ b/src/main/java/deathcap/wsmc/Main.java
@@ -1,5 +1,6 @@
 package deathcap.wsmc;
 
+import deathcap.wsmc.mc.PacketFilter;
 import deathcap.wsmc.web.WebThread;
 
 public class Main {
@@ -11,7 +12,7 @@ public static void main(String[] args)
         int mcPort = args.length > 3 ? Integer.parseInt(args[3]) : 25565;
 
         System.out.println("WS("+wsAddress+":"+wsPort+") <--> MC("+mcAddress+":"+mcPort+")");
-        WebThread webThread = new WebThread(wsAddress, wsPort, mcAddress, mcPort, null);
+        WebThread webThread = new WebThread(wsAddress, wsPort, mcAddress, mcPort, null, new PacketFilter());
         webThread.start();
     }
 }
diff --git a/src/main/java/deathcap/wsmc/WsmcPlugin.java b/src/main/java/deathcap/wsmc/WsmcPlugin.java
index a5f90fb..5709f02 100644
--- a/src/main/java/deathcap/wsmc/WsmcPlugin.java
+++ b/src/main/java/deathcap/wsmc/WsmcPlugin.java
@@ -1,5 +1,6 @@
 package deathcap.wsmc;
 
+import deathcap.wsmc.mc.PacketFilter;
 import deathcap.wsmc.web.WebThread;
 import org.bukkit.configuration.file.FileConfiguration;
 import org.bukkit.entity.Player;
@@ -12,6 +13,7 @@ public class WsmcPlugin extends JavaPlugin implements Listener {
 
     private WebThread webThread;
     private UserIdentityLinker users;
+    private PacketFilter filter;
 
     @Override
     public void onEnable() {
@@ -42,12 +44,14 @@ public void onEnable() {
         getServer().getPluginManager().registerEvents(users, this);
         getCommand("web").setExecutor(users);
 
+        filter = new PacketFilter(); // TODO: read from config
+
         webThread = new WebThread(
                 this.getConfig().getString("websocket.bind-address"),
                 this.getConfig().getInt("websocket.bind-port"),
                 this.getConfig().getString("minecraft.connect-address"),
                 this.getConfig().getInt("minecraft.connect-port"),
-                users);
+                users, filter);
         webThread.start();
     }
 
diff --git a/src/main/java/deathcap/wsmc/mc/PacketFilter.java b/src/main/java/deathcap/wsmc/mc/PacketFilter.java
index b7382b5..a9ce70b 100644
--- a/src/main/java/deathcap/wsmc/mc/PacketFilter.java
+++ b/src/main/java/deathcap/wsmc/mc/PacketFilter.java
@@ -8,14 +8,14 @@ public class PacketFilter {
     private Set<Integer> whitelist = new HashSet<Integer>(); // default allow all
     private Set<Integer> blacklist = new HashSet<Integer>(); // default block none
 
-    public boolean checkFilter(int id) {
+    public boolean isAllowed(int id) {
         if (whitelist.size() != 0) {
             // must be in whitelist
             return whitelist.contains(id);
         }
 
         // must not be in blacklist
-        return blacklist.contains(id);
+        return !blacklist.contains(id);
     }
 
     public void addWhitelist(int id) {
diff --git a/src/main/java/deathcap/wsmc/web/ServerHandler.java b/src/main/java/deathcap/wsmc/web/ServerHandler.java
index 4cce422..71b7972 100644
--- a/src/main/java/deathcap/wsmc/web/ServerHandler.java
+++ b/src/main/java/deathcap/wsmc/web/ServerHandler.java
@@ -17,6 +17,7 @@
 package deathcap.wsmc.web;
 
 import deathcap.wsmc.UserIdentityLinker;
+import deathcap.wsmc.mc.PacketFilter;
 import io.netty.channel.ChannelInitializer;
 import io.netty.channel.ChannelPipeline;
 import io.netty.channel.socket.SocketChannel;
@@ -30,12 +31,14 @@ public class ServerHandler extends ChannelInitializer<SocketChannel> {
     private final String mcAddress;
     private final int mcPort;
     private final UserIdentityLinker users;
+    private final PacketFilter filter;
 
-    public ServerHandler(WebThread webThread, String mcAddress, int mcPort, UserIdentityLinker users) {
+    public ServerHandler(WebThread webThread, String mcAddress, int mcPort, UserIdentityLinker users, PacketFilter filter) {
         this.webThread = webThread;
         this.mcAddress = mcAddress;
         this.mcPort = mcPort;
         this.users = users;
+        this.filter = filter;
     }
 
     @Override
@@ -45,6 +48,6 @@ protected void initChannel(SocketChannel socketChannel) throws Exception {
         pipeline.addLast("aggregator", new HttpObjectAggregator(65536));
         pipeline.addLast("handler", new HTTPHandler(this.webThread.wsPort));
         pipeline.addLast("websocket", new WebSocketServerProtocolHandler("/server"));
-        pipeline.addLast("websocket-handler", new WebSocketHandler(webThread, this.mcAddress, this.mcPort, this.users));
+        pipeline.addLast("websocket-handler", new WebSocketHandler(webThread, this.mcAddress, this.mcPort, this.users, this.filter));
     }
 }
diff --git a/src/main/java/deathcap/wsmc/web/WebSocketHandler.java b/src/main/java/deathcap/wsmc/web/WebSocketHandler.java
index b142401..9651d01 100644
--- a/src/main/java/deathcap/wsmc/web/WebSocketHandler.java
+++ b/src/main/java/deathcap/wsmc/web/WebSocketHandler.java
@@ -21,6 +21,7 @@
 import deathcap.wsmc.WsmcPlugin;
 import deathcap.wsmc.mc.DefinedPacket;
 import deathcap.wsmc.mc.MinecraftThread;
+import deathcap.wsmc.mc.PacketFilter;
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.Unpooled;
 import io.netty.channel.ChannelFuture;
@@ -47,13 +48,15 @@ public class WebSocketHandler extends SimpleChannelInboundHandler<BinaryWebSocke
     private final String mcAddress;
     private final int mcPort;
     private final UserAuthenticator users;
+    private final PacketFilter filter;
 
-    public WebSocketHandler(WebThread webThread, String mcAddress, int mcPort, UserAuthenticator users) {
+    public WebSocketHandler(WebThread webThread, String mcAddress, int mcPort, UserAuthenticator users, PacketFilter filter) {
         super(false);
         this.webThread = webThread;
         this.mcAddress = mcAddress;
         this.mcPort = mcPort;
         this.users = users;
+        this.filter = filter;
     }
 
 
@@ -107,10 +110,17 @@ protected void messageReceived(final ChannelHandlerContext ctx, final BinaryWebS
         int length = DefinedPacket.readVarInt(buf);
         byte bytes[] = new byte[length];
         buf.readBytes(bytes);
-        // TODO: parse varint length field, call PacketFilter
+
+        // read packet id type for filtering
+        int id = DefinedPacket.readVarInt(Unpooled.copiedBuffer(bytes)); // TODO: avoid copying (but need to reply with id in buffer)
+
+        if (!this.filter.isAllowed(id)) {
+            System.out.println("FILTERED PACKET: "+id);
+            return;
+        }
 
         final ByteBuf reply = Unpooled.wrappedBuffer(bytes).retain();
-        System.out.println("stripped "+reply.readableBytes());
+        System.out.println("id "+id+" stripped "+reply.readableBytes());
 
         final MinecraftThread mc = minecraft;
         // forward MC to WS
diff --git a/src/main/java/deathcap/wsmc/web/WebThread.java b/src/main/java/deathcap/wsmc/web/WebThread.java
index 670b237..c7c8e09 100644
--- a/src/main/java/deathcap/wsmc/web/WebThread.java
+++ b/src/main/java/deathcap/wsmc/web/WebThread.java
@@ -18,6 +18,7 @@
 
 import deathcap.wsmc.UserIdentityLinker;
 import deathcap.wsmc.WsmcPlugin;
+import deathcap.wsmc.mc.PacketFilter;
 import io.netty.bootstrap.ServerBootstrap;
 import io.netty.channel.Channel;
 import io.netty.channel.EventLoopGroup;
@@ -34,13 +35,15 @@ public class WebThread extends Thread {
     public String mcAddress;
     public int mcPort;
     public UserIdentityLinker users;
+    public PacketFilter filter;
 
-    public WebThread(String wsAddress, int wsPort, String mcAddress, int mcPort, UserIdentityLinker users) {
+    public WebThread(String wsAddress, int wsPort, String mcAddress, int mcPort, UserIdentityLinker users, PacketFilter filter) {
         this.wsAddress = wsAddress;
         this.wsPort = wsPort;
         this.mcAddress = mcAddress;
         this.mcPort = mcPort;
         this.users = users;
+        this.filter = filter;
     }
 
     private final ChannelGroup channels = new DefaultChannelGroup("wsmc Connections",
@@ -54,7 +57,7 @@ public void run() {
             ServerBootstrap bootstrap = new ServerBootstrap();
             bootstrap.group(bossGroup, workerGroup).
                     channel(NioServerSocketChannel.class).
-                    childHandler(new ServerHandler(this, this.mcAddress, this.mcPort, this.users));
+                    childHandler(new ServerHandler(this, this.mcAddress, this.mcPort, this.users, this.filter));
 
             Channel channel = bootstrap.bind(this.wsAddress, this.wsPort)
                 .sync()