On this page0
Guide
Block countries and IP addresses
Keep unwanted traffic out of your instance by country and by IP address, and ban addresses that keep trying to guess passwords.
Before you start
- This guide assumes you know what an IP address is and can find the public addresses of your offices and VPN; if not, do this together with the person who looks after your company’s network.
- Your role must let you manage security settings. In the built-in set, administrators have that permission. The “security_analyst” role has it too; no group carries it, so an administrator gives it to a person by hand, as Roles, groups and permissions shows.
- Know the public IP addresses of your offices and VPN. You will add them to the Exclude list first, so they can never be blocked.
- Every change on this page saves the moment you make it. Zonitix may ask you to confirm it is you before the first change goes through.
Set up safely
Step 1: Open Threat Defense
Go to Security & ComplianceThreat Defense. The banner at the top shows the mode: “Off”, “Dry-run” or “Enforce”. It starts off.
Step 2: Add your trusted addresses
Click the “Configure” tab. Under “Exclude list”, type an address or a CIDR range (a block of addresses written like 203.0.113.0/24) in “+ Trusted IP or CIDR” and press Enter. Excluded addresses are always allowed and win over every block, including country rules and auto-block.
Step 3: Switch to Dry-run
In the banner, choose “Dry-run”. Zonitix now flags what your rules would block but blocks nothing, so you can check them safely.
Add your rules
Step 4: Block or allow countries
Under “Country policy”, pick “Blocklist” to block the countries you add, or “Allowlist” to allow only the countries you add. Choose countries in “+ Add country”; click the x on a country to remove it.
Add your own countries before you switch to “Allowlist”. Zonitix refuses an empty allowlist, because it would block everyone, including you.
Step 5: Block single addresses
Under “IP blocklist”, type an address or range in “+ IP or CIDR” and press Enter. Click the x on an entry to unblock it.
Step 6: Optional: block unknown locations
“Block unknown-geo IPs” drops traffic whose country cannot be worked out. It is aggressive and off by default; leave it off unless you have a reason.
Step 7: Check, then enforce
Open the “Monitor” tab. “Live detections” refreshes every 10 seconds and marks what would have been blocked as “dry-run”. If one of your own addresses shows up, click “Allow”, then “Unblock & Allow”. When you are happy, choose “Enforce” in the banner.
Ban password guessers automatically
Step 8: Turn on the auto-block engine
On the “Configure” tab, the “Auto-block engine” card has its own switch, separate from the banner. Switch on “Auto-block brute-force IPs”. It starts in dry-run. By default an address is banned after 6 failed logins in 10 minutes, for 6 hours; you can change all three numbers.
Under “Detection patterns” you can turn individual detectors on or off and tune them: “Credential stuffing”, “Auth-endpoint flood”, “Sensitive-path scan”, “Unknown-geo probe” and “Distributed attack”. The reference page lists what each one trips on and its default. When you trust the results, set “Mode” to “Enforce”. Bans appear in the IP blocklist marked “AUTO” with the time left, and lift on their own.
What you should see
The banner reads “Enforcing.” and the KPI row counts your blocked countries, Exclude entries and blocklist entries.
On the “Monitor” tab, blocked requests and failed logins appear under “Live detections” and “Recent activity”, and “Attack origins” shows where they come from.
If something goes wrong
- A country rule blocked you or a colleague.
- Country rules never block the sign-in page or the Threat Defense rules themselves, so you can sign in and open Threat Defense from where you are. Add the address to the Exclude list, remove the country, or set the banner to Off, which stops country and blocklist rules at once. If Zonitix will not save the change, ask an admin in an allowed country to make it, or contact Zonitix support.
- You blocked your own address, or auto-block banned your office.
- While you are still signed in, you can open Threat Defense and remove the entry or Exclude your address. An IP block also covers the sign-in page, so if you are signed out, ask another admin on a different network to remove it. Auto-block bans lift on their own after the ban time. If no admin can get in, contact Zonitix support.
- "Country blocking is inert."
- The country lookup is not available on your instance, so country and unknown-location rules are not being enforced. IP blocklist, Exclude and auto-block still work. Contact Zonitix support.
- Auto-block is on but nothing gets banned.
- Check the engine’s Mode is Enforce, not Dry-run, and that the detector you expect is switched on. Addresses on the Exclude list are never banned.
Still stuck? See When something goes wrong, or Contact Zonitix support.