Can I block known malicious IPs (IP Reputation / blacklist category)?

Short answer

Yes. TR7's IP reputation database divides addresses into threat categories; the database is updated on the IP Intelligence & Reputation screen. When L7 DDoS & Threat Protection is turned on for a vService, IP Reputation Protection comes as Active by default and quarantines or blocks according to the categories. For a narrower block with a Load Balancer rule, the Blacklist IP Category condition is used with the Block action. The same list is applied in WAF with Blacklist Protection, and at the network layer with the L4 DDoS Protection → Blacklist rule per route table; this rule only monitors by default (Monitor), and it is set to Block to block.

Problem: Known Attacker Addresses Reach the Application

If addresses with a history of attacks, fraud, spam or scanning continue to access the application, automatic blocking of these addresses according to an up-to-date reputation list is wanted. The list is single across the device: the TR7 reputation database, the defined external sources and the manually added Blacklist Content are merged, and Whitelist Content is subtracted (how it works). The protections apply this list at different layers.

Solution: Four Methods

The methods apply the same list at different layers; they can also be used together. For all of them, the database is kept up to date (Method 1, step 1).

Your situation	Suitable method
Category-based, automatic protection on the vService	Method 1: IP Reputation Protection
No Bot/DDoS license, or a Load Balancer rule for a specific category	Method 2: Blacklist IP Category condition + action
HTTP vService with the WAF module turned on	Method 3: WAF → Blacklist protection
At the network layer, for all the traffic in the route table (independent of the vService type)	Method 4: L4 DDoS Protection → Blacklist

Method 1: IP Reputation Protection Recommended

• How it worksIP Reputation Protection meets the request coming from an address on the blacklist with rule rows; the rows are evaluated from top to bottom, and the first matching row makes the decision. The default first row quarantines the critical categories (DDoS Attack, Open Proxy, Hacking, SQL Injection, Brute-Force, Web App Attack, Exploited Host, Bad Web Bot, User blacklist); the second row blocks the remaining categories except VPN IP (on L7 TCP, it drops them silently).
• Where it is opened Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management → IP Reputation Protection
• Requirement Bot/DDoS license; L7 DDoS & Threat Protection turned on for the vService; up-to-date reputation data
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Keep the reputation database up to date

On the Settings → General Settings → IP Intelligence & Reputation screen, Edit is clicked; Online update period (default Off) is set to Daily, Weekly or Monthly and Save is clicked. To update immediately, Update Online is used. In a cluster setup, the scheduled update runs only on device 1, and the updated database is transferred to the peer device automatically.

2

Adım 2 Turn on Bot/DDoS protection (if needed)

In the edit form of the vService, the L7 DDoS & Threat Protection box under Details is checked and Save is clicked (two ways). At this moment, IP Reputation Protection starts in Active mode and the default rows are applied (starting modes).

3

Adım 3 Open the edit window (to change the rules)

On the Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management tab, the Edit link of the IP Reputation Protection card is clicked.

4

Adım 4 Add or change the rule row

In the IP Reputation Actions list, a row is added with + Add or an existing row is edited; Categories and Action (e.g. Block, Show captcha, Quarantine) are selected. If the VPN IP category, which is not in the default rows, is needed, it is added with a separate row.

5

Adım 5 Save

Edit is clicked; the setting is applied without a separate deployment step.

Verification

1Event recordTR7 side

The IP Reputation tab of the Bot/DDoS Event Logs screen is checked.

ExpectedThe address, its category and the applied action

2Status of the addressTR7 side

The address is queried with IP lookup; the result is the same as the decision applied to the traffic.

ExpectedOn the blacklist · threat categories

Method 2: Blacklist IP Category Condition + Action

• How it works If the client IP is in the selected reputation category, the Load Balancer action is applied; the request does not go to the Backend Service.
• Where it is openedLoad Balancer → Conditions · Load Balancer → Actions · vService → Details → Actions
• Requirement Up-to-date reputation data
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the condition form

On the Load Balancer → Conditions screen, Add is clicked (how to add).

2

Adım 2 Select the category

Condition Name is entered; Criteria = Blacklist IP Category is selected, and a single category is selected in the Blacklist IP Category field (categories).

If no category distinction is needed

To cover every address on the blacklist, there is no need to create a condition: the ready-made If the source IP is blacklisted condition in the Conditions list of the action is selected, and the process continues with step 4.

3

Adım 3 Save the condition

Add is clicked. For more than one category, steps 1–3 are repeated (Add & Repeat keeps the form open).

4

Adım 4 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

5

Adım 5 Select the action and the condition

Action Name is entered. For an HTTP vService, Action Type = Block; Execution Level = On request, Deny Type = Standard, Status Code default 403. For an L7 TCP vService, Action type = TCP Connection Management, Action = Reject or Silent drop. In the Conditions field, the category conditions are selected and combined with or.

6

Adım 6 Save the action

Add is clicked; the action is added to the list.

7

Adım 7 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

8

Adım 8 Add the action to the vService

The action is selected in the Actions field under Details.

9

Adım 9 Save

Save is clicked. In a cluster setup, the change is also sent to the peer device automatically with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1BlockingClient side

A request is sent from an address in the selected category (the category is seen with IP lookup).

Command: curl -sI https://www.example.com/

ExpectedHTTP/1.1 403 Forbidden

If Hit counter is on in the action, the counter increases on the Action Hits tab of the vService Dashboard.

Method 3: WAF → Blacklist Protection

• How it works On an HTTP vService with WAF turned on, requests coming from addresses whose source IP is on the blacklist are blocked. A blacklist match exceeds the blocking threshold on its own, independently of the protection level. Blacklist protection is checked by default; the categories can be narrowed with Blacklist IP Category.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Whitelist & Blacklist
• Requirement WAF license; WAF turned on for the vService; WAF in Blocking mode for blocking
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the edit screen

On the WAF Management tab, the pencil icon at the top right of the Whitelist & Blacklist card in the Inspection & Blocking section is clicked (Edit screen).

2

Adım 2 Set the blacklist protection

Blacklist Protection is left checked (default). The Blacklist IP Category switch uses all the categories in the All position; in the Filter position, the categories are narrowed with multiple selection (at least one category).

3

Adım 3 Save

Edit is clicked; there is no separate deployment step. Blocking is done only in Blocking mode; in Monitor and Learning mode, the request is let through and an attack record is logged (WAF Mode).

Verification

1Event recordTR7 side

On the WAF Event Logs screen, the record of the address on the blacklist is checked.

ExpectedBlacklisted IP violation · Attack blocked

Method 4: L4 DDoS Protection → Blacklist

• How it works The Blacklist rule of L4 DDoS Protection drops the packets of the sources on the blacklist at the first packet, before a request is formed. The rule is per route table and covers all the traffic coming to that route table (HTTP, L7 TCP and Network vServices, traffic passing through the device). It does not make a category distinction; it applies the whole list. There is no threshold: the decision depends on whether the source is on the list or not.
• Where it is opened Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management → Blacklist
• Requirement Network edit permission; up-to-date reputation data
• vService type Independent (all the traffic in the route table)

Step-by-Step Configuration

1

Adım 1 Open the L4 DDoS Management screen

In the Left Monitor Panel, the Route Tables & L4 DDoS tab is selected, the route table of the vService is clicked and the L4 DDoS Management tab is opened.

2

Adım 2 Read the current mode of the rule

The first box in the L4 DDoS Protection Mode card is the Blacklist box. In the default mode, the sentence reads A source on the IP-reputation blacklist is only monitored (amber dot): the sources are counted, but the traffic passes.

3

Adım 3 Open the rule window

The pencil icon on the right of the sentence is clicked; the Rule Settings · IP Blacklist window opens.

4

Adım 4 Set the mode to Block

Status = Block is selected. The options are Disabled, Monitor (default) and Block; there is no Quarantine in this rule. If the learning engine should not change the mode, Learning Lock is turned on.

5

Adım 5 Save

Save is clicked; the rule takes effect immediately. The sentence in the box becomes A source on the IP-reputation blacklist is blocked (green dot). The other route tables keep their own modes; if needed, this is repeated for each of them.

The effect of Block mode

In Block mode, the established connections of a source that enters the blacklist are also cut. An address that must stay on the list but should be let through is added to the Whitelist & Known Peers list as an IP or network entry (a country entry is not valid in this rule) or is taken into the IP Intelligence & Reputation Whitelist Content list; the latter frees the address in both the L4 and the L7 protections (relation to the exemption list).

Verification

1Matching packetsTR7 side

On the Dashboard screen of the route table, the Blacklist panel in the Suspicious Packets tab is checked; in Block mode, the dropped packets also enter the Dropped Traffic tab.

ExpectedRed-filled series

The panel also counts the packets of exempt sources; a value appearing in the panel does not always mean that packets were dropped. In Monitor mode, the series appears amber-filled and no data is created in Dropped Traffic.

Common Mistakes

• Not keeping the reputation data up to date. Online Update Period is Off by default; if no period is selected, new threat addresses are not recognized.
• Not expecting its effect when turning on the protection. IP Reputation Protection starts in Active mode; some requests can be blocked the moment it is turned on, and Event Logs are monitored.
• Assuming that L4 DDoS Blacklist blocks by default. The rule is born in Monitor mode in every route table; to block, Status = Block is set.
• Trying to select a category in L4 DDoS Blacklist. The category distinction exists only in the L7 protections (IP Reputation Protection, Blacklist IP Category condition, WAF); the L4 rule applies the whole list.
• Turning off the protection when a legitimate address is blocked. The address is added to the Whitelist Content list; the whitelist takes priority in every layer. For diagnosis: I am blocking legitimate users by mistake; how do I find out?
• Assuming that the VPN IP category is blocked by default. VPN IP is not in the default rows of IP Reputation Protection; if needed, it is added with a separate row.

How it is done in the documentation

• IP Reputation Protection · The Default Rules
• Blacklist IP Category · Supported IP Intelligence Categories
• L4 DDoS Protection · Blacklist
• IP Intelligence & Reputation · Where and How Is It Used?

Related questions

• Can I block specific IPs/CIDRs or allow only them?
• How do I recognize and handle Tor exit nodes, VPN/proxy addresses and data center (cloud/hosting) IPs separately?
• I am blocking legitimate users by mistake; how do I find out?