Review, add and lift IP bans

A ban drops every packet from one address at a node’s firewall. It covers all sites on that node, and also SSH, FTP and mail. Hyperion adds bans automatically when an address floods logins or trips WAF rules, and you can add or lift them by hand.

Bans live in nftables sets on the node that owns them. Hyperion records them in its database and re-applies them when the agent starts, so a reboot does not clear them.

Before you start

• To see every node’s bans you are an Owner or an Administrator. Other roles with the Security permission manage the bans of their own sites only, on the site’s Settings & limits tab.
• You know the address to act on. Use 203.0.113.9 style IPv4 or 2001:db8::1 style IPv6, one address per ban. Networks are not accepted.

Steps

Review bans on every node

1. Open Protection in the sidebar, then scroll to Banned now. You can also open Firewall and click All bans →.
2. Read the columns: Address, For, Site, Node, Banned and Lifts.

For is the kind of ban:

Kind	Meaning
Manual	Added by a person. Permanent until lifted
WAF	The address tripped ban-counted WAF rules on a site
Login flood	Repeated wp-login.php or xmlrpc.php failures on a site
SSH, FTP, Mail	Repeated failed logins on that service, counted node-wide
Automatic	An automatic ban whose reason does not fit the kinds above

Site shows the site the ban was raised for, or “whole node”. Hover the For tag to read the full reason.

By default a first automatic ban lasts 1 hour and a repeat offender gets 1 day. See Tune automatic bans to change that. The list is often empty. Ban history · 7 days shows what happened: its Ended column reads “ran out” or “lifted <time ago>”.

Automatic bans never target an address of this server, an address of a cluster node, or a private, loopback or link-local address.

Ban an address by hand

Before you ban an address

The address loses access to every site, to SSH, FTP and mail on that node, and the ban stays until someone lifts it. Banning your own address locks you out of the server’s services the same way.

There is no backup to check. Confirm the address by comparing it with the Latest refusals or access log first. To undo it, lift the ban as described below, or run sudo hctl ban remove <ip> on the node.

1. Open Hostings, click a site, then open the Settings & limits tab and scroll to Bans and the Banned IPs card.
2. Enter the address in IP address. Optionally add a note in Reason (up to 200 characters). The reason defaults to “manual ban”.
3. Click Ban IP.

The ban applies to the whole node that serves the site and is recorded against the site. A new row shows source manual and expiry permanent.

Lift a ban

1. On Protection, Banned now, click Unban on the row and confirm “Lift the ban on <address>?”. If the address keeps attacking, the next scan bans it again.
2. Or open the site’s Banned IPs card and click Lift ban. An Administrator lifts any ban from there. Other roles lift only bans raised for that site.

Ban or lift from the command line

hctl talks to the local agent, so it works when the panel is down. Run it on the node:

sudo hctl ban list
sudo hctl ban add 203.0.113.9 --reason "scraping" --ttl 7d
sudo hctl ban add 198.51.100.4 --hosting example.com
sudo hctl ban remove 203.0.113.9

ban add is node-wide unless you pass --hosting, and permanent unless you pass --ttl. ban list shows each ban’s source and an expiry that reads permanent until lifted. A ban also covers SSH, so if you banned your own address, use the provider’s console or connect from another address, then run sudo hctl ban remove <your-address>.

Panel sign-in

Repeated failed sign-ins from one address are throttled first: the sign-in page reads “Too many failed attempts from this address. Try again in N minutes.” If the address keeps sending requests after that, it is banned at the firewall for 1 hour with the reason “auto: panel login brute force”. The settings on the scanner page do not govern this. Lift it with the commands above.

Check that it worked

• A new ban appears under Banned now with the right Node and Lifts value (permanent for a manual ban).
• After you lift a ban, the row leaves Banned now and appears in Ban history · 7 days with “lifted”.
• On the node, list the set:

sudo nft list set inet hyperion banned

Expected: the address appears as an element while banned (IPv6 addresses are in the set banned6).

If it fails

• “not a valid IP address”: enter a single address. A network such as 203.0.113.0/24 is refused.
• “refusing to ban loopback / unspecified address”: 127.0.0.1, ::1 and 0.0.0.0 cannot be banned.
• A banned address still reaches a site: a ban lives on one node. Compare Node with the node that serves the site.
• A ban you lifted comes back: the address keeps tripping the scanner. Read Latest refusals on the site’s WAF activity card and fix the cause. To stop automatic WAF bans for one site, click Stop for this site next to Automatic bans on that card. To pause the login-flood scan for one site, click Pause for this site in the Brute-force bans tile of the Security card on the Overview tab.