Automatic blocking bans for a while any source whose packets to the appliance are rejected too often: a port scan, a brute-force attempt on a closed service, a misconfigured client hammering a port.
Counting is done by the kernel itself, so a scan is detected even when it sends thousands of packets per second.
ARTICA:BAN:) and appears in the firewall events as Banned automatically.Rejections are those of your Drop rules, of the connection limits and of the Finally deny all policies.
Automatic blocking is disabled by default. Go to Your Firewall › Parameters, section Automatic blocking, and click it:
| Field | Default | Range | Meaning |
|---|---|---|---|
| Automatic blocking | off | Enables the feature. | |
| Rejections | 20 | 3 – 1000 | Number of rejected packets that triggers the ban. |
| Within (seconds) | 300 | 60 – 3600 | The window in which they are counted. |
| Ban duration (seconds) | 3600 | 60 – 604800 | How long the source stays banned (up to 7 days). |
The change is applied immediately and recorded in the configuration history, with the usual confirmation.
Before enabling it, check that the networks you administer the appliance from are declared as trusted networks: a few mistyped connections to a closed port must not ban your own workstation.
Go to Your Firewall › Events, tab Banned. Each line shows the address, its country and host name when they are known, and the remaining ban time.
Click Unban to remove an address from the list immediately.
The packet tester reports a banned source as banned automatically.
| Method and path | Purpose |
|---|---|
GET /firewall/config/autoban | The settings: {"enabled": 1, "hits": 20, "window": 300, "time": 3600}. |
PUT /firewall/config/autoban | Change them (same fields). |
GET /firewall/autoban | The banned addresses, with the remaining time, country and host name. |
DELETE /firewall/autoban/{ip} | Unban an address (no error if it was not banned). |
ipset list artica_autoban # banned IPv4 addresses and their remaining time
ipset list artica_autoban6 # banned IPv6 addresses
grep 'ARTICA:BAN:' /var/log/firewall.log