IP blocking

When an address is blocked

• The agent reports authentication attempts with their source; the platform counts sightings per address.
• An address seen attacking three times within thirty minutes becomes a block proposal.
• On a server set to Automatic the block runs at the agent's next check-in, so usually within a minute or two. In Awaiting Approval it waits for you.

How

Through the tool the server already runs: fail2ban, CrowdSec, CSF, firewalld or iptables. SecAI installs no firewall. The rule is visible in that tool and the block is listed in the dashboard with its evidence. On a server managed with ufw the block is an iptables rule beside ufw's own, so it shows in "iptables -S" rather than in "ufw status".

How long a block lasts

• An automatic block expires on its own after 6 hours the first time an address is blocked on a server.
• Each further automatic block of the same address on the same server within 30 days lasts twice as long as the one before: 12 hours, then 24, 48 and 96, never more than 7 days.
• A block a person places lasts 7 days.
• Where fail2ban, CrowdSec, firewalld or CSF carries the block, that tool may end it sooner on its own timer, so the longer blocks hold in full only where the agent writes the rule itself (iptables, which is also how it blocks on a server managed with ufw).
• A server takes at most 60 automatic blocks in any hour.

Safety

• Your own address and any address you mark as trusted are never blocked.
• CDN edges in front of a proxied site are protected, so a site cannot be blocked by its own traffic.
• Every automatic block expires on its own, after 7 days at the most.
• The "Let me in" link in an alert lifts a block that caught you; unblocking never needs approval and works while automation is paused.

What it does not do

A distributed attack spread across many addresses does not trip a per-address threshold; the flood detector and an upstream provider address that shape. Blocks are not shared between customers.