Lists
The Lists tab controls the firewall IP lists and the dynamic blacklist engine.
Dynamic Engine
| Option | Description |
|---|---|
| Dynamic Blacklist | Enables automatic temporary blocking of IPs that trigger multiple attacks. |
| Blocking Time | Seconds an IP remains in the dynamic blacklist after reaching the threshold. Default: 600. |
| Max Attempts | Number of attack attempts that trigger automatic IP blocking. Default: 5. |
Evaluation Order
Drag-and-drop the three list items to set the priority order:
| List | Action | Badge colour |
|---|---|---|
| Whitelist | Always permit — IPs here bypass all filters and generate no log entries. Use carefully. | Green |
| Dynamic Blacklist | Auto-blocked IPs added by the engine when the threshold is reached. | Secondary |
| Blacklist | Permanently blocked IPs — receive a 403 error on any access attempt. | Red |
Default order is Whitelist > Dynamic Blacklist > Blacklist. The first matching list wins.
Since version 5.2.0, whitelisted IPs are never added to the dynamic blacklist, regardless of the configured evaluation order.
Both blacklist and whitelist accept standard IPv4 and IPv6 notation. IPv4 ranges can be specified with a wildcard (192.168.1.*) or CIDR notation (192.168.100.0/24). IPv6 ranges require CIDR notation (2001:13d0::/29).
If a conflict exists between lists — for example, an IP that appears in both the whitelist and a blacklist range — the evaluation order decides the outcome. Whitelist first means the IP passes; blacklist first means it is blocked.
IP lists can be exported and imported. External IP files must use comma-separated format: IP,IP,IP. No text labels are allowed.
When manually adding an IP to the Blacklist, the Include in Email Notifications checkbox controls whether that specific IP triggers an email alert (subject to the Email Notifications tab being enabled) each time it is blocked. This can increase email volume quickly if enabled for a busy IP.
Active rescue grace periods
IPs recently unblocked through a rescue link appear in this section with their remaining grace time. During the grace period the IP cannot re-enter the dynamic blacklist, although the firewall filters keep inspecting its requests. Press Revoke to end a grace period immediately and return the IP to the normal dynamic blacklist regime.
