How to block an IP address

Block an abusive IP address on your TurboStack host from the command line, check an existing block, and remove it.

TurboStack's firewall already blocks abusive clients automatically - for example after repeated failed logins across SSH, FTP, mail and HTTP. Failed attempts are counted collectively across all of these protocols against a single threshold, rather than per protocol, and the firewall reacts within seconds of the suspicious activity. You only need to block an address by hand when you want to stop a specific attacker or scraper that the automatic protection has not caught yet.

Note

A firewall block stops an IP at the network level, for the whole host. To block by request path or for a single application, do it at the web server instead - see Block IP addresses in Nginx.

Before you start

SSH access to the host - see SSH access.
The address or range to block. Your access logs show who is hitting the site: tscli logs web searches them - see Finding and reading logs.

Block an IP with the CLI

Connect over SSH and use tscli firewall block:

# Block an IP for a week, with a reason
tscli firewall block 203.0.113.10 --time 604800 --comment "spam"

# Block a whole range permanently
tscli firewall block 203.0.113.0/24 --time -1

--time is in seconds (-1 means permanent) and --comment records why. See the TurboStack CLI for the full list of options.

Check whether an IP is blocked

tscli firewall check 203.0.113.10

This also tells you whether the automatic protection has already blocked the address - useful when a customer reports being locked out.

Remove a block

tscli firewall unblock 203.0.113.10

To clear every automatic block at once there is tscli firewall flush, but read the warning on the TurboStack CLI page first: it also removes blocks that are protecting you from active abuse.

Apply and verify

A block is active as soon as the command returns. tscli firewall check 203.0.113.10 reports it, and tscli firewall display-blocks lists every manual block on the host.

If it did not work

An address that is on the allow-list is never blocked: tscli firewall display-whitelists shows whether it is, and Whitelist an IP address shows how to remove it. If traffic keeps arriving from many addresses in the same range, block the range rather than single addresses. See High CPU usage and server load, or contact support.