Is it possible to reject or silently drop a connection at the TCP level (TCP Connection Management)?

Short answer

Yes. On the L7 TCP vService, the TCP Connection Management action closes connections that match the condition immediately with Reject or drops them without responding with Silent drop; the Wait for content option, on the other hand, waits for the client's first data for the Delay Time so that the conditions can be evaluated. On the HTTP vService, the same job is done with the Silent drop and Tarpit options of the Block action. In both cases, the TCP connection is established first; the protection that takes effect before the connection is established is L4 DDoS Protection.

Problem: Unwanted Sources Connect to the TCP Service

For TCP services such as a database, e-mail or a custom protocol, connections coming from specific addresses or countries are required to be rejected, and sometimes dropped without a response.

Option	What the client sees
Reject	The connection is established and right after that closed by TR7 with a reset (e.g. Connection reset by peer)
Silent Drop	The connection is established, no response comes to the data sent; the client falls into its own timeout
Wait for Content	Does not close the connection; data is waited for during the Delay time so that the subsequent conditions can look at the client's first data

Solution: Five Methods

Your situation	Suitable method
Rejecting or dropping specific sources on the L7 TCP vService	Method 1: TCP Connection Management
Dropping without a response or slowing down on the HTTP vService	Method 2: Block (Silent drop / Tarpit)
Blocking sources that exceed a threshold automatically and for a set time	Method 3: Quarantine
Stopping attacks such as connection floods before the connection is established	Method 4: L4 DDoS Protection
From the command line	Method 5: WEB-CLI

Method 1: TCP Connection Management Recommended

• How it works A connection that matches the condition is closed with a reset in Reject, and left without a response in Silent drop; the connection is not forwarded to the Backend Service.
• Where it is openedLoad Balancer → Actions → TCP Connection Management
• Requirement A condition that defines the sources to be blocked (an action without a condition is applied to all connections)
• vService type L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the condition form

Load Balancer → Conditions → Add is clicked (how to add).

2

Adım 2 Define the sources to be blocked

Criteria = Source IP; Source IP Type = Manual (addresses are separated by a space or a line break, e.g. 198.51.100.0/24) or Country.

3

Adım 3 Save the condition

Add is clicked.

4

Adım 4 Open the action form

Load Balancer → Actions → Add is clicked (how to add).

5

Adım 5 Select the action

Action Name is entered, and Action Type = TCP connection management is selected; this action appears only in the Actions list of L7 TCP vServices. Execution Level = On request (default); Action = Reject (default) or Silent drop. If Wait for content is selected, the Delay Time field opens (default 5 s; unit s or m) and the action is added without a condition. The condition from step 2 is selected in the Conditions field.

6

Adım 6 Save the action

Add is clicked.

7

Adım 7 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the L7 TCP vService is selected and Edit is clicked.

8

Adım 8 Add the action to the Actions field

The action is selected in the Details → Actions field.

9

Adım 9 Save

Save is clicked. The change is applied without dropping open connections; in a cluster, it is also sent to the peer device with the default auto-sync (if Manual Sync Mode is on, with Synchronize).

Verification

1ConnectionClient side

From the blocked address, a connection is made with nc -v 192.0.2.80 3306 and one line of data is sent.

ExpectedReject: the connection closes immediately · Silent drop: no response comes

Method 2: HTTP vService: Block

• How it works Silent drop leaves the connection without responding to the client; Tarpit keeps the client waiting for the Connect timeout duration in the Timeouts profile of the vService and then responds with the Status code.
• Where it is openedLoad Balancer → Actions → Block → Deny Type
• Requirement A condition that defines the sources to be blocked
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Prepare the condition

If the condition does not exist, it is created with steps 1–3 of Method 1.

2

Adım 2 Open the Block form

Load Balancer → Actions → Add is clicked.

3

Adım 3 Select the Deny type

Action Name is entered, and Action Type = Block is selected. Execution Level = On request; Deny Type = Silent drop or Tarpit (Tarpit is listed only with On request; when Silent drop is selected, the Status code field is hidden). The condition is selected in the Conditions field.

4

Adım 4 Save the action

Add is clicked.

5

Adım 5 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

6

Adım 6 Add the action to the Actions field

The action is selected in the Details → Actions field.

7

Adım 7 Save

Save is clicked.

Verification

1ResponseClient side

From the blocked address, curl -sv https://www.example.com/

ExpectedSilent drop: no response comes · Tarpit: delayed 403

Method 3: Quarantine

• How it works Sources that exceed the specified threshold are blocked automatically for the quarantine duration; when the duration expires, the block is lifted.
• Where it is openedLoad Balancer → Actions → Quarantine
• Requirement A condition that defines the threshold (e.g. request or connection rate)
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the Quarantine form

Load Balancer → Actions → Add is clicked.

2

Adım 2 Define the threshold, the duration and the action

Action Name is entered, and Action Type = Quarantine is selected. The key to be tracked is selected with Tracking Key (e.g. the client IP) and Tracking Time, the threshold that starts the quarantine with Quarantine Condition, the duration with Quarantine Time, and the action to be applied to the quarantined source with Quarantine Action (how Quarantine works). Details of the fields: How does the Quarantine Action work; how long is a client that exceeds the threshold blocked?

3

Adım 3 Save the action

Add is clicked.

4

Adım 4 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP or L7 TCP vService is selected and Edit is clicked.

5

Adım 5 Add the action to the Actions field

The action is selected in the Details → Actions field.

6

Adım 6 Save

Save is clicked.

Verification

1Threshold testClient side

From the test address, enough connections to exceed the threshold are opened; then a new connection is attempted.

ExpectedDuring the quarantine, the connection ends with the selected action

Method 4: L4 DDoS Protection

• How it works Stops attacks such as handshake floods, connection exhaustion and scanning before the connection is established, at the route table level; sources in the IP reputation blacklist are blocked with the Blacklist rule.
• Where it is opened Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management
• Requirement The route table to which the IP of the vService is bound
• Scope All traffic coming through the route table

Step-by-Step Configuration

1

Adım 1 Open the route table

In the Left Monitor Panel, the Route Tables & L4 DDoS category is selected and the route table to which the IP of the vService is bound is clicked (accessing the screen).

2

Adım 2 Switch to the L4 DDoS Management tab

On the screen that opens, the L4 DDoS Management tab is clicked.

3

Adım 3 Open the exemption list

The pencil icon in the Whitelist & Known Peers box is clicked. The exemption list is set up before enforcement (typical deployment flow).

4

Adım 4 Add the organization's addresses

The organization's own addresses and network blocks are entered, and Add is clicked for each of them.

5

Adım 5 Save the list

OK is clicked.

6

Adım 6 Open the rule window

The pencil icon in the row of the rule to be put into enforcement is clicked (for the IP reputation blacklist, the rule row in the Blacklist box).

7

Adım 7 Put the mode into enforcement

In the Status field of the window, the rule is moved from monitoring to enforcement.

8

Adım 8 Save

Save is clicked.

Verification

1Live viewTR7 side

On the L4 DDoS Live View tab of the route table, the quarantined sources and the rule are seen.

ExpectedThe source is listed with the rule that sent it

Method 5: WEB-CLI

• How it works The condition in Method 1, the Silent drop action and the vService binding are created with WEB-CLI commands.
• Where it is opened TR7 WEB-CLI → lb condition · lb action · lb service
• Requirement WEB-CLI access; the ID of the condition. The Delay time value of Wait for Content cannot be given from the command line; this option is added from the interface
• vService type L7 TCP

Step-by-Step Configuration

1

Adım 1 Add the condition

lb condition add criteria src_ip srcIpType manual src "198.51.100.0/24" --name kara-liste

2

Adım 2 Get the condition ID

The action binds the condition by its ID, not by its name; lb condition add gives no output when it succeeds; the ID is seen in the id column of the lb condition list output.

3

Adım 3 Add the action

For --tcpAction, reject or silent-drop is written; if --ruleLoc is not written, the action runs at the request stage:

lb action add type tcp_conn_mgmt name kara-liste-dusur --tcpAction silent-drop --cond <condition-id>

4

Adım 4 Check the existing actions on the vService

lb service show <vService>

--rules.N replaces the action at that position; the new action is written to the first empty position.

5

Adım 5 Add the action to the vService

If the vService has two actions (0 and 1), the new action is written to position 2; if it has no actions, --rules.0 is used:

lb service update id <vService> --rules.2 kara-liste-dusur

Verification

1ConnectionClient side

From within 198.51.100.0/24, nc -v 192.0.2.80 3306

ExpectedThe connection is established, no response comes

Common Mistakes

• Assuming that the port will appear closed. Since TCP Connection Management and Block work after the connection is established, the port appears open in a port scan; for the port not to respond at all, L4 DDoS Protection or a firewall rule is needed.
• Assuming that Silent drop protects connection resources. The connection is still established and stays open until the client falls into a timeout; in heavy attacks, L4 DDoS Protection is used.
• Binding Wait for content to a condition. Wait for Content is added without a condition; the purpose is for the subsequent conditions to be able to look at the client's first data (Delay Time).
• Looking for the action on the HTTP vService. TCP Connection Management appears only in the Actions list of the L7 TCP vService; on HTTP, Block is used.

How it is done in the documentation

• TCP Connection Management · Action
• TCP Connection Management · Delay Time
• Block · Deny Type
• L4 DDoS Protection · The Difference from Bot/DDoS and WAF

Related questions

• How do I make the admin panel accessible only from specific IPs?
• How does the Quarantine Action work; how long is a client that exceeds the threshold blocked?
• If an action blocks or redirects traffic, do the subsequent actions run?