DE

↑ ↓ select, Enter open, Esc close

Ban an IP address manually in CrowdSec

caution rootFirewalldebian, ubuntu

Caution: This command changes the system. Understand what it does before you run it.

Adjust the values, the command updates live
root@server
cscli decisions add --ip 203.0.113.25 --duration 24h --reason 'manual ban'

Creates a decision of type ban for the IP that expires automatically after the given duration. Valid durations are, for example, 30m, 4h or 168h. Using --range 203.0.113.0/24 instead of --ip bans an entire network.

Note: The ban only takes effect if a bouncer is installed and connected (cscli bouncers list).

Also searched as

  • crowdsec ban ip manually
  • cscli decisions add
  • block ip range crowdsec

Related one-liners

All in Firewall

Show active CrowdSec decisions and bans

#cscli decisions list
harmlessFirewall

Show CrowdSec alerts

#cscli alerts list
harmlessFirewall

Show CrowdSec metrics for logs, parsers and bouncers

#cscli metrics
harmlessFirewall

Unban an IP address in CrowdSec

#cscli decisions delete --ip 198.51.100.10
cautionFirewall

Add an IP address to an nftables blocklist

#nft add element inet filter blocklist '{ 203.0.113.25 }'
cautionFirewall

Block an IP address or subnet with ufw

#ufw insert 1 deny from 203.0.113.0/24
cautionFirewall

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.