How to block/unblock traffic from IP addresses?

Owned by Steffen Drya
Last updated: Feb 03, 2021 by Martin Reiss (Unlicensed)
4 min read

You can use CLI-suite to use Network Access Control Lists (Network ACL) to block and unblock IP-addresses or IP-ranges.

Using Network Access Control Lists works not for environments which have a Content Delivery Network e.g. or Cloudflare in place.

Preconditions

General usage instructions

You can use CLI-suite to use Network Access Control Lists (Network ACL) to block and unblock IP-addresses or IP-ranges.

Network ACL are one of multiple security measures applied to your infrastructure. They control traffic flow on network layer and allow the application of restrictions to this traffic. Overall there are multiple Network ACLs for each environment. However the one of most concern is the one controlling the traffic flow from the Internet to the infrastructure. This also, is the only one you are allowed to make changes to e.g. by blocking or unblocking IPs or IP-Ranges.

The general usage instructions for the CLI-suite r3 can be found at .

IP vs CIDR

A Network ACL is based on IPs or IP ranges presented in the Classless Inter-Domain Routing (CIDR) notation (having /xx behind the actual IP to describe network mask).

List currently applied ACL

  1. r3 net list shows the whole Network ACL for the public network segment of your infrastructure

  2. The overview includes

    1. the name/identifier of the ACL

    2. a number assigned to the respective entry in the ACL (order is important to evalute deny before allow actions)

    3. the column Ingress describes the direction of the traffic flow. Ingress=True describes a rule is applied to incomming traffic, whilst the opposite indicates rules for traffic leaving your infrastructure

    4. CIDRBlock is the actual IP or IP range of consideration

    5. The protocol number (following IANA Internet Protocol Numbers Standards) names the network protocol of considerations (e.g. 6 for TCP Traffic) 

    6. PortRange specifies the port or port range the rule applies to

    7. The RuleAction specifies how to handle the traffic e.g. deny it or allow it

This examples shows:

  • the default rule set for the Network ACL root360 GmbH is rolling out

  • 4 block rules (RuleAction = deny, RuleNumbers 996-999) for 2 separate IPs covering incomming traffic for all ports. Thus these rules block HTTP and HTTPS requests for the given IPs including all other connections.

List currently applied ACL example 

~$ r3 net list Company: root360, Project: backend, Environment: test +--------------+------------+---------+------------------+----------+--------------+------------+ | NetworkAclId | RuleNumber | Ingress | CidrBlock        | Protocol | PortRange    | RuleAction | +--------------+------------+---------+------------------+----------+--------------+------------+ | acl-2778c94e | 100        | False   | 0.0.0.0/0        | 6        | 0 - 65535    | allow      | | acl-2778c94e | 996        | True    | 35.156.218.92/32 | 6        | 443 - 443    | deny       | | acl-2778c94e | 997        | True    | 35.156.218.92/32 | 6        | 80 - 80      | deny       | | acl-2778c94e | 998        | True    | 35.156.218.91/32 | 6        | 443 - 443    | deny       | | acl-2778c94e | 999        | True    | 35.156.218.91/32 | 6        | 80 - 80      | deny       | | acl-2778c94e | 1000       | True    | 0.0.0.0/0        | 6        | 80 - 80      | allow      | | acl-2778c94e | 1100       | True    | 0.0.0.0/0        | 6        | 443 - 443    | allow      | | acl-2778c94e | 1300       | True    | 10.0.56.0/27     | 6        | 1024 - 65535 | allow      | | acl-2778c94e | 1400       | True    | 10.0.57.0/24     | 6        | 1024 - 65535 | allow      | | acl-2778c94e | 1500       | True    | 10.0.58.0/24     | 6        | 1024 - 65535 | allow      | | acl-2778c94e | 32767      | False   | 0.0.0.0/0        | -1       | ALL          | deny       | | acl-2778c94e | 32767      | True    | 0.0.0.0/0        | -1       | ALL          | deny       | | acl-2778c94e | 32768      | False   | ::/0             | -1       | ALL          | deny       | | acl-2778c94e | 32768      | True    | ::/0             | -1       | ALL          | deny       | +--------------+------------+---------+------------------+----------+--------------+------------+

Blocking an IP-address

  1. Use the command lines r3 net block to block an IP or IP ranges HTTP(S) traffic.

  2. You can only block exactly one IP or IP range at a time.

  3. You can block by giving just the IP or the IP plus respective CIDR.

  4. The return shows you the result of the operation.

Blocking example

~$ r3 net block 35.156.218.93   # Response Company: root360, Project: backend, Environment: test +------------------+---------+----------------+ | IP/CIDR          | Port    | Block Response | +------------------+---------+----------------+ | 35.156.218.93/32 | 80      | success (200)  | | 35.156.218.93/32 | 443     | success (200)  | +------------------+---------+----------------+

Unblocking an IP-address

  1. Use the command lines r3 net unblock to unblock HTTP(S) traffic for an IP or IP range (e.g. because it was blocked before).

  2. You can only unblock exactly one IP or IP range at a time

  3. You can unblock by giving just the IP or the IP plus respective CIDR

  4. The return shows you the IP or IP range you entered, the Network-ACLs modified and the result of the operation

Unblocking example

~$ r3 net unblock 35.156.218.93/32 # Response Company: root360, Environment: test, Project: backend +------------------+--------------+------------------+ | IP/CIDR | ACL | UnBlock Response | +------------------+--------------+------------------+ | 35.156.218.93/32 | acl-2778c94e | success (200) | +------------------+--------------+------------------+

Limitations

You will be prevented to block/unblock

  • internal IPs

  • special IPs like 0.0.0.0

  • egress rules applying to outgoing traffic

Related tutorials

Related components

 

root360 Knowledge Base - This portal is hosted by Atlassian (atlassian.com | Privacy Policy)