Blocklist

Overview

The Blocklist page lists every IP address that DeDDoS currently treats as blocked. Entries are created in two ways: automatically, when the Action Manager runs a blocking action against an attacker, and manually, when an administrator adds an address on this page. The active entries are published as a plain-text feed that enforcement devices (for example, a firewall configured to read an external block list) can consume.

Use this page to:

• Review which IP addresses are currently blocked and which component blocked them.
• Manually block an address that you know is malicious.
• Correct the name, address, or application of an entry.
• Remove a block that is no longer needed.
• Clear the whole blocklist (and the Action Manager’s blocked-hosts cache) after an incident.

How to Open This Page

1. Click Administration in the top navigation bar.
2. Click the Blocklist tab (ban icon) in the strip of administration sections.

The page address is /administration/blocklist. Older bookmarks that use /administration/blacklist are redirected here automatically.

You need the Modify Settings or the View Settings permission to open this page. With View Settings only, the list is read-only: the Add and Clear blocklist buttons and the per-row edit and delete buttons are hidden. If you do not see the Blocklist tab, ask your administrator to add one of these permissions to your group.

Main Areas

The page has a toolbar at the top and the blocklist table below it.

Click to enlarge

• 1 Administration section tabs – switch between administration sections. The active tab (Blocklist) is highlighted.
• 2 Add button – opens the form for a new blocklist entry.
• 3 Clear blocklist button – deletes every entry after a confirmation. See Clearing the Entire Blocklist.
• 4 Pagination controls – shown only when there is more than one page of results.
• 5 Total item count – for example, “Total: 12 items”. While a search is active it shows the number of matching entries.
• 6 Search field and search button – filter by name, application, or IP address.
• 7 Blocklist table – Name, Application, IP, and Actions columns. Each name starts with a row help tip (question-mark icon).

Toolbar

• Add – Opens the Add Blocklist entry form. Hidden for read-only users.
• Clear blocklist (red, trash-can icon) – Removes every entry. A confirmation dialog appears first. Hidden for read-only users.
• Pagination – Page buttons appear when the list has more than 10 entries. See Pagination.
• Total: N items – The number of entries in the list, or the number of matches while a search is active.
• Search field – Placeholder “Search by name, application, or IP…”. Type a term and press Enter or click the magnifying-glass button. As soon as the field contains text, a clear button (X) appears next to it. See Searching the Blocklist.

Blocklist Table

The most recently added entries are listed first. The table has no column sorting or column filters; use the search field to find entries.

Row Help Tip

Each row starts with a question-mark icon. Hover over it, or move keyboard focus to it, to show a short summary of the row.

Click to enlarge

The tip names the entry, the blocked address, and its application. For example: Blocklist entry “Botnet C2 observed in SYN flood 2026-10-11” – traffic involving 203.0.113.7 (application: WEB) is blocked. Use the pencil to edit or the trash to remove it.

Protected Entry – “Administrators”

If an entry is named exactly Administrators, its edit and delete buttons are hidden, so it cannot be changed or removed on this page.

Empty List

When the blocklist has no entries, or when a search matches nothing, the table shows only its column headings and the counter reads “Total: 0 items”. No message is displayed.

Adding a Blocklist Entry

1. Click Add in the toolbar. The Add Blocklist entry dialog opens.

   Click to enlarge

2. Fill in the fields:

   Field	Rules
   Name	Required. 4 to 255 characters. A descriptive label, for example “Botnet C2 observed in SYN flood 2026-10-11”.
   Value	Required. A single IPv4 or IPv6 address, for example 203.0.113.7 or 2001:db8::53. CIDR ranges such as 203.0.113.0/24 and IP ranges are not accepted. The address must not be on the Allowlist and must not already be on the blocklist.
   Application	Drop-down with WEB and DSS. Defaults to WEB. The help text under it reads “Application this entry applies to (defaults to WEB).”

3. Click Save.

   • On success, a “Blocklist entry added” notification appears, the dialog closes, and the table reloads.
   • If validation fails, the dialog stays open and an error appears under the affected field. See Validation Errors.

Click Close or the X in the top-right corner to cancel without saving.

Entries added on this page expire 30 days after they are created. See Expiration.

Validation Errors

The fields are checked when you click Save, not while you type.

Click to enlarge

For example, adding 198.51.100.14 a second time shows 198.51.100.14 is already on the blocklist under the Value field, and the dialog stays open:

Click to enlarge

If the entry cannot be saved for a reason that is not tied to a field (for example, a database error), the message appears in a red box at the top of the dialog, above the fields. The dialog stays open so you can try again or click Close.

Editing a Blocklist Entry

1. Find the entry in the table and click its Edit button (pencil icon). The Edit Blocklist entry dialog opens with the current Name, Value, and Application filled in.

   Click to enlarge

2. Change any of the fields.

3. Click Save. On success, a “Blocklist entry updated” notification appears and the table reloads.

The same validation rules apply as when adding. Changing the Value to an address that another blocklist entry already has is rejected with “<value> is already on the blocklist”. Editing does not change the entry’s expiry date.

Note: The Application drop-down only offers WEB and DSS. When you save an entry whose application is something else, the application is stored as WEB unless you pick DSS.

Deleting a Single Entry

1. Click the Delete button (trash-can icon) on the entry’s row.

2. A confirmation dialog names the entry and its address, for example Delete blocklist entry “SYN flood source 2026-10-11” (198.51.100.14)?, followed by “This action cannot be undone.”

   Click to enlarge

3. Click Yes, continue to delete, or Cancel to keep the entry. Cancel has keyboard focus when the dialog opens.

After deletion, a “Blocklist entry deleted” notification appears and the table reloads.

Deleting an entry removes the address from the published blocklist feed. It does not clear the Action Manager’s blocked-hosts cache. See How Changes Take Effect.

Clearing the Entire Blocklist

Warning: Clear blocklist permanently deletes every entry, including entries created automatically by the Action Manager. This cannot be undone.

1. Click Clear blocklist in the toolbar.

2. A confirmation dialog shows the current number of entries, for example Delete all 12 blocklist entries? and “This will permanently remove all 12 entries from the blocklist. This action cannot be undone.”

   Click to enlarge

3. Click Yes, continue to clear the list, or Cancel to keep it.

When you confirm:

1. DeDDoS sends a clear blocked-hosts cache command to the Action Manager over RabbitMQ. The Action Manager records this as an action log entry (“Cleanup Blocked Hosts cache in Action Manager trigger via Web truncate button”).
2. All rows are deleted from the blocklist.
3. A notification confirms that the blocklist has been cleared, and the table reloads empty.

Because the Action Manager’s cache is cleared too, attackers who come back are blocked again by the next automated response. Until then, they are no longer on the blocklist.

Searching the Blocklist

Click to enlarge

1. Type a term into the search field (placeholder “Search by name, application, or IP…”). The search finds partial matches in the Name, Application, and IP columns. For example, 198.51.100 finds every address in that range and every entry whose name contains that text.
2. Press Enter or click the magnifying-glass button. Typing alone does not filter the list.
3. The table shows the matching entries, Total shows the number of matches, and the list returns to page 1.

To show the full list again, click the X button next to the search field.

Search is not case-sensitive. Only letters, digits, spaces, dots (.), colons (:), slashes (/), and hyphens (-) are used. Other characters are ignored.

Pagination

The table shows 10 entries per page. The page size is fixed, and there is no page-size selector on this page.

When there are more than 10 entries, pagination controls appear in the toolbar:

• Click a page number to go to that page. The current page is highlighted.
• Use the left and right arrows to go to the previous or next page. The left arrow is hidden on the first page, and the right arrow is hidden on the last page.
• Up to five page numbers are shown. When there are more pages, the first and last page are always shown, and an ellipsis (…) marks the skipped pages.

How Changes Take Effect

• Published feed. DeDDoS publishes the active blocklist as plain text at https://<deddos-server>/activeBlocklist (the older path /activeBlacklist also works), one IP address per line. Enforcement devices that read this feed pick up additions, edits, and deletions the next time they fetch it. No separate push is needed. Only entries that have not expired are published.
• Automatic entries. When the Action Manager runs a web-server blocking action, it adds the attacker’s address as DeDDOSBlock_<IP>, or updates the entry if the address is already listed. It skips addresses on the Allowlist.
• Action Manager cache. The Action Manager remembers which hosts it has already blocked, so it does not block them twice. Adding, editing, or deleting a single entry on this page does not change that memory. If you delete an automatic entry, the Action Manager does not add it again for a repeat attack until its cache is cleared. Clear blocklist is the only control on this page that clears the cache.
• Allowlist check. An address cannot be added to the blocklist while the exact same address is on the Allowlist.

Expiration

• Entries added on this page expire 30 days after they are created. Editing an entry does not extend its expiry.
• Entries created automatically by the Action Manager do not expire. They stay until you delete them or clear the blocklist.
• Expired entries are left out of the published feed and are deleted from the database the next time the feed is requested. The expiry date is not shown in the table.

Notes

• Single addresses only. The form accepts one IPv4 or IPv6 address per entry. CIDR ranges and IP ranges cannot be blocked from this page.
• One entry per address. An address can be on the blocklist only once. A duplicate is rejected with “<value> is already on the blocklist”.
• Read-only access. Users with only View Settings can browse and search the list but cannot change it.
• “Administrators” entry. An entry named “Administrators” cannot be edited or deleted on this page.

Related Pages

• Allowlist – Trusted addresses that are never blocked automatically and cannot be added to the blocklist.
• Internal Networks – Address ranges that belong to your organization.
• Action Manager – Settings for the automated response system that creates blocklist entries.
• Actions – History of the blocking actions executed by the Action Manager.
• Notifications – Attack notifications that can trigger automatic blocks.
• Attacks – Detailed attack records, including attacker IP addresses.