# How to block an IP address

TurboStack's [firewall](what-is.md) already blocks abusive clients automatically - for example after
repeated failed logins across SSH, FTP, mail and HTTP. Failed attempts are counted **collectively
across all of these protocols** against a single threshold, rather than per protocol, and the firewall
reacts within seconds of the suspicious activity. You only need to block an address by hand when you
want to stop a specific attacker or scraper that the automatic protection has not caught yet.

> [!NOTE]
> A firewall block stops an IP at the **network level, for the whole host**. To block by request path
> or for a single application, do it at the web server instead - see
> [Block IP addresses in Nginx](../nginx/block-ip-addresses.md).

## Block an IP with the CLI

Connect over [SSH](../../platform/hosts/ssh.md) and use `tscli firewall block`:

```bash
# Block an IP for a week, with a reason
tscli firewall block 203.0.113.10 --time 604800 --comment "spam"

# Block a whole range permanently
tscli firewall block 203.0.113.0/24 --time -1
```

`--time` is in seconds (`-1` means permanent) and `--comment` records why. See the
[TurboStack CLI](../../api/cli.md) for the full list of options.

## Check whether an IP is blocked

```bash
tscli firewall check 203.0.113.10
```

This also tells you whether the automatic protection has already blocked the address - useful when a
customer reports being locked out.

## Remove a block

```bash
tscli firewall unblock 203.0.113.10
```

To clear every automatic block at once there is `tscli firewall flush`, but read the warning on the
[TurboStack CLI](../../api/cli.md) page first: it also removes blocks that are protecting you from
active abuse.

## Related

- [Configure the firewall](configure.md)
- [Whitelist an IP address](whitelist-an-ip.md)
- [Block IP addresses in Nginx](../nginx/block-ip-addresses.md)
- [TurboStack CLI](../../api/cli.md)
- [Fixing 403 errors](../../troubleshooting/http-4xx-errors.md)