On this page
A port rule decides which of your services are reachable. A source rule decides what happens to one sender, whichever port it aims at. You can deny a source outright or trust it, and both lists live in the same place.
Trusted and blocked sources render as one table. Each entry shows the address,
an ALLOW or DENY badge, the date it was added, and when it expires. The
counters at the top of the Firewall tab, Trusted sources and
Blocked sources, are the running totals for the two lists.
Blocking an address
Open the Source IPs tab
Go to your server, open Firewall, then Source IPs.
Choose Block IP
The dialog is titled Block an IP and states what it does: "Packets from this address will be dropped at the edge before they reach your server. Bypasses port rules."
Enter the address
IPv4 address takes one address, for example
203.0.113.42. A source rule is stored as a single address, so ranges in CIDR form are not accepted here.Pick an expiry
Expires offers
Never,1 hour,24 hours, and7 days.Confirm
Press Block IP. The entry appears in the table with a
DENYbadge and the block is in force from then on.
The expiry option
A timed block removes itself when the time is up, so it suits the common case:
one source is misbehaving now and you do not want to carry that decision for the
life of the server. Never keeps the block until you remove it by hand.
Expiry exists on blocked entries only. A trusted entry has no expiry and stays until you delete it.
An entry whose expiry has already passed reads Expired in the Expires
column. You can clear it from the table like any other entry.
Allowing an address
Use Whitelist on the same tab. The dialog is titled Whitelist an IP and states its effect: "Traffic from this address bypasses all rate limits and behavioral filters. Use for known-good clients (monitoring, ops, partners)."
IPv4 address accepts the same form as a block: one address per entry.
Note (optional) takes up to 120 characters and is stored with the entry. It is the only reminder you get about why an address is trusted, so write something you will still understand in six months: "office VPN exit", "uptime monitor", "payment webhook source".
How source rules and port rules interact
The Firewall tab states the model at the top of the page:
Inbound rules are an allow-list; source rules override per address; always-on mitigation filters the rest.
In practice:
- A source rule takes precedence over your port rules. A blocked source is dropped whether or not a port rule would have let it through, so you do not have to close a port to shut one sender out of it.
- A trusted source skips the filtering your rules apply. Rate limits such as
pps_limitandestab_flow_pps, and the behavioural filters, do not apply to it. - Everything else is handled normally, by your port rules and by always-on mitigation.
Neither list changes which ports are open. Blocking a source does not close a port for anyone else, and trusting one does not open a port that has no rule.
Keep an address on one list only
Nothing stops you from putting the same address on both lists, for example
203.0.113.42 trusted and blocked at once. Do not rely on one winning over the
other. If you need to change a decision about an address, remove the existing
entry first, then add the new one.
What the panel accepts
- Single IPv4 addresses, one per entry.
- CIDR ranges are not accepted on either list. Add the addresses you mean, or ask support if you need a whole range handled.
- IPv6 is not accepted on either list.
- Anything else is refused with "Not a valid IPv4 address."
- Blocking works per address. There is no range, country or network (ASN) blocking on these lists.
- There is no cap on how many source entries you can have. That is different from inbound rules, which are limited to 15 per server.
Removing an entry
Each row has an X at the end. It reads "Unblock" on a blocked entry and
"Remove from whitelist" on a trusted one. There is no confirmation step: one
click removes the entry, and re-adding it is the way back if you clear the wrong
one.