Advanced blocking rules

• Overview
• Open blocking rules
• Create a rule
• Edit, disable and arrange rules
• Import and export

Advanced blocking rules let you set separate login limits for a protocol, block IPs that try listed usernames, or block an IPv4 subnet after activity from several source addresses.

Protocol settings replace General for the selected protocol. Username and subnet rules work in addition to normal failed-login limits. Whitelisted addresses stay accessible, including inside a blocked subnet.

Click Tools, Options to open Options.

On the General tab, click Advanced blocking rules. The rules dialog opens:

Click Add and choose the rule type. You can also right-click the table and use the Add submenu.

Shortcuts: Alt+P - Protocol settings; Alt+U - Username rule; Alt+S - Subnet rule.

These fields are shared by all three rule types:

• Rule name: Choose a unique name of up to 100 characters so you can recognize the rule in the list.
• Enable rule: Keep this checked to apply the rule. Clear it to retain the settings without applying them.
• Automatically unblock after (hours): Sets the blocking period, in whole hours, from 1 to 8,760. It starts when the rule triggers. A longer existing block is preserved.

Protocol settings

Choose Add, Protocol settings. This example blocks an IP after 5 failed RDP logins, resets its RDP counter after 30 minutes and blocks it for 24 hours.

• Protected protocol: Select one protected protocol. Only one settings rule is allowed for each protocol, including disabled rules.
• Maximum failed login attempts per IP address: Each source IP has its own counter for this protocol. Attempts on other protocols do not contribute to it; attempts for this protocol do not contribute to the shared General counter.
• Reset failed login counters after: The interval starts with the first failed attempt. Choose minutes or hours. The allowed range is 1 minute to 999 hours.

Username rule

Choose Add, Username rule. This example blocks an IP on a detected failed login using root, admin or test, without waiting for the normal attempt limit.

• Username is one of: Enter one exact username per line, as reported by the detection engine. Wildcards are not supported. Up to 1,000 names are allowed, with up to 256 characters each.
• Ignore letter case: When checked, root and ROOT match the same entry. Clear it to distinguish letter case.
• Protected protocol: Select one protocol or all protected protocols. The rule can only match detections that include a username; successful logins do not trigger it.

Subnet rule

Choose Add, Subnet rule. This example blocks a /24 subnet when 10 different source IPs in that subnet are detected within the last 10 minutes.

• Count activity from: Choose IPs with failed login attempts, or IPs blocked after local detections. The second option does not count IP Cloud entries, manual blacklist entries or existing range blocks.
• Block the subnet when the number of different IPs reaches: Each source IP counts once in the observation period. Repeated activity from one address cannot reach a threshold of 10 by itself. The threshold must be at least 2 and cannot exceed the subnet's address count.
• Observation period: A rolling period measured from each address's most recent activity. Choose minutes or hours, from 1 minute to 999 hours.
• IPv4 subnet to block: Choose /16, /20, /24 or /28. The source IP determines the subnet. For example, 203.0.113.7 belongs to 203.0.113.0/24, which contains 256 addresses. Subnet rules apply to IPv4 only.
• Protected protocol: Select one protected protocol or all protected protocols. Only detections in that scope contribute to the subnet threshold.

Click Save in the rule editor, then in the rules dialog, then in Options to apply the changes.

Select a rule and click Edit, double-click it, or press F2. The checkbox in the first column enables or disables a rule. Select rules and click Delete to remove them.

Use More, Move up or More, Move down to arrange selected rows. This changes their display order, not rule precedence: every enabled matching rule is evaluated.

Use Ctrl or Shift to select multiple rows, Ctrl+A to select all, or drag a selection rectangle, including from empty table space. Clicking empty space with either mouse button clears the selection.

Use More, Export to save the selected rules as JSON. Use Ctrl+A first to export every rule. More, Import adds rules from a JSON file to the current list.

Import preserves rule IDs. Duplicate IDs, names or protocol settings are rejected without adding part of the file. Remove conflicting rules first when restoring the same set. The maximum is 100 rules.

The blocking rules CLI commands use the same JSON format. CLI export always writes all rules; CLI import supports both append and replace.

• RdpGuard Command Line Interface
• Advanced Blocking Settings: All or Selected Ports
• Whitelist and Blacklist
• RdpGuard Online Help