Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › Security › Blocks

Blocks

SharedStatus: SUPPORTED for manual block/unblock APIs. Temp-to-perm exists; not an SLA.Audience: security engineer

Purpose

Manipulate the blocked-IP set that Virtualization Agents enforce independently from longer-lived rules objects. Designed to fail closed at the blocking pipeline when that pipeline is required for readiness.

Manual block / unblock 

zwallctl list
zwallctl unblock 203.0.113.10

API (AdminAuth + admin role):

  • GET /api/v1/security/blocked-ips
  • POST /api/v1/security/blocked-ips/block body ip required; optional ip_version, direction, reason
  • DELETE /api/v1/security/blocked-ips/:ip
  • Login-failure unblock: POST /api/v1/security/login-failures/:ip/unblock

400 if IP invalid or “Cannot block critical system IP address”. 503 if blocking repository not configured.

zwallctl deny creates a rule, not necessarily the same object as blocked-ips. Use list vs list-rules.

Temp-to-perm

/api/v1/security/temp-to-perm/* promotes repeat temporary blocks. YAML security.temp_to_perm: repeat_threshold (comment default 3), time_window (comment 720h), exclude_private, whitelist. Implemented, not a certified policy pack.

External lists / RBL / Cloudflare

  • Blocklists: Blocklists
  • RBL: RBL
  • Cloudflare push (Enterprise-only HTTP group; not bidirectional). Setup is provided separately to Enterprise customers.

Verification

API 200 / zwallctl list. Packet drops only on Virtualization Agents. Hosting Agents do not apply blocks as drops.

Failure modes

Pipeline 503 → Manager blocking authority not ready (/health/ready). 409 on Hosting restart/rules. Community 3-Agent cap is unrelated to block list size.

Security

Do not block the Manager or jump-host without an allow/whitelist path. Critical-IP protection is product-enforced on BlockIP. Unblock portal (Enterprise) is a review workflow, not automatic.

No published PPS. No compliance marks.

  • API blocks
  • Unblock portal exists on Enterprise only. Setup is provided separately to Enterprise customers.