# Block a traffic source

> Drop all traffic from an address or a range to one of your floating IPs, for a set time or until you unblock it.

Source: https://www.coritan.com/docs/ddos-shield/block-sources/

In the dashboard:

- /dashboard/networking/ips/…/shield: https://www.coritan.com/dashboard/networking/ips
- /dashboard/ddos/profiles: https://www.coritan.com/dashboard/ddos/profiles

A *blocked source* is an address or a range whose traffic DDoS Shield drops before it reaches one of your floating IPs. Block a source when one sender or one network keeps sending traffic you do not want, such as a sender you see in an attack event or a client that keeps trying passwords. A block can remove itself after a time you choose.

## Before you begin

- The floating IP must be on your account and not cancelled.
- A block applies to one floating IP, and on a subnet to all of its hosts. To block a source on several addresses, block it on each one.
- Floating IPs are IPv4, so a source is an IPv4 address or a range from `/8` to `/32`.
- An address can hold 100 blocks. A range counts as one block, so block the range when a sender uses many addresses in it.
- Blocks work on every profile: the platform default, a profile of the address's own and a custom profile. They do not apply while that profile is in **Passthrough** mode ([Protection modes](/docs/floating-ips/shield-settings/#protection-modes)).

## Block a source

1. In the [dashboard](https://www.coritan.com/dashboard/networking), go to **Floating IPs**, open the address and select the **Shield** tab.
2. On the **Blocked sources** card, select **Block source…**.
3. In **Address or range**, enter the sender's address, such as `198.51.100.7`, or a range, such as `198.51.100.0/24`.
4. Optionally, enter a **Reason**, such as `Repeated SSH logins`. The list shows it under the source.
5. Under **Expires**, keep **Never**, or choose when we remove the block: **After 1 hour**, **After 1 day**, **After 7 days** or **After 30 days**.
6. Select **Block source**.

A message confirms `198.51.100.7/32 blocked.`, and the block appears at the top of the list. Traffic from the source stops reaching the address within a minute.

### Block a source on a custom profile's addresses

On the **Profiles** tab of DDoS Shield, the card of a [custom profile](/docs/ddos-shield/custom-profiles/) has a **Blocked sources** section with the blocks on every address bound to it. Select **Block source…** there, and choose the address under **On** when more than one is bound. The block applies to that one address only, and the table shows it in an **On** column.

## Read the list

Each block in the list shows:

- **Source**: the address or range, with its reason under it.
- **On**: the address the block is on. Only a custom profile's card with more than one bound address shows this column.
- **Added**: when the block was made, with `Added by our team` under it for a block that our team made.
- **Expires**: when we remove the block and how long is left, or `Never`.

When the address has no block, the card shows **No blocked sources yet**. Blocks that have expired leave the list.

When the address holds 100 blocks, the card shows `No room for another block` and **Block source…** is greyed out. Unblock a source first, or replace several blocks with one range.

## Unblock a source

1. On the **Blocked sources** card, select **Unblock…** on the block's row.
2. In the dialog, select **Unblock source**.

A message confirms `198.51.100.7/32 unblocked.` Traffic from the source reaches the address again within a minute.

A block that our team made shows **Ask support to remove** in place of **Unblock…**, and only our team can remove it. The link opens a new support conversation. Name the address and the source in it.

## How a block is applied {#how-a-block-is-applied}

- We apply a block as a **Drop** rule for all traffic from the source to the whole address. Traffic it drops shows on the **Events** tab as `firewall_deny` ([Attack types](/docs/ddos-shield/attack-events/#attack-types)).
- The block names both the source and the address, so it outranks most of your own rules. An **Allow** rule can still outrank it when it names more, such as the same source, this address as its **Destination prefix** and a port ([How rules are applied](/docs/floating-ips/shield-settings/#how-rules-are-applied)).
- A block stays with the address when you detach it, customise its profile, or bind it to a custom profile and unbind it again.

## Result

The block is on the **Blocked sources** list, and traffic from the source no longer reaches the address. We store a single address as its `/32`, and a range by its first address, so `198.51.100.7/24` becomes `198.51.100.0/24`. When a block expires, we remove it, and the source's traffic reaches the address again.

## Troubleshooting

`Enter an address or a range, such as 203.0.113.7 or 203.0.113.0/24.`
: The dialog cannot read what you entered as an address. Enter an address such as `198.51.100.7`, or a range with its length, such as `198.51.100.0/24`.

**Could not block the source** with `That range is too wide. Block a /8 or a narrower range.`
: A wider range would cut the address off from a large part of the internet. Block narrower ranges, or set **When no rule matches** to **Drop** and allow only the senders you want ([When no rule matches](/docs/floating-ips/shield-settings/#when-no-rule-matches)).

**Could not block the source** with `This address is IPv4, so block an IPv4 source.`
: You entered an IPv6 address or range. A floating IP receives IPv4 traffic only, so an IPv6 sender cannot reach it.

**Could not block the source** with `198.51.100.7/32 is already blocked on this address.`
: The list already holds that source, so its traffic is dropped already.

**Could not block the source** with `This address already has 100 blocked sources. Remove one before adding another.`
: Unblock a source you no longer need, or replace several blocks with one range.

**Could not block the source** with `Too many Shield changes in the last ten minutes. Wait a few minutes, then try again.`
: Your account made 60 changes to DDoS Shield profiles, rules and blocks in the last ten minutes. Wait, then try again.

Traffic from a blocked source still reaches the address
: The address's profile is in **Passthrough** mode, or an **Allow** rule outranks the block, as [How a block is applied](#how-a-block-is-applied) explains. The sender may also use other addresses: block their range.

**Could not load the blocked sources**
: Select **Try again**. If it keeps failing, [contact support](/docs/support/conversations/).

## Related

- [Change a floating IP's DDoS protection](/docs/floating-ips/shield-settings/)
- [Read attack events](/docs/ddos-shield/attack-events/)
- [Get help during an attack](/docs/ddos-shield/under-attack/)
- [Order and use a custom profile](/docs/ddos-shield/custom-profiles/)

## With the API

The requests take the floating IP's service ID in the path: the `ip_service_id` that `GET /api/v1/client/shield/status` returns ([With the API](/docs/ddos-shield/#with-the-api)).

`GET /api/v1/client/shield/subjects/{ip_service_id}/blocked-sources` lists the blocks on the address, newest first:

```bash
curl https://api.coritan.com/api/v1/client/shield/subjects/214/blocked-sources \
  -H "Authorization: Bearer $CORITAN_TOKEN"
```

```json
{
  "blocked_sources": [
    {
      "id": 881,
      "address": "198.51.100.0",
      "prefix_len": 24,
      "cidr": "198.51.100.0/24",
      "reason": "Repeated SSH logins",
      "source": "manual",
      "removable": true,
      "expires_at": "2026-09-27T09:12:40",
      "created_at": "2026-09-26T09:12:40"
    }
  ],
  "max_blocks": 100
}
```

| Field | Meaning |
| --- | --- |
| `id` | The block's ID, which removing it takes. |
| `address`, `prefix_len`, `cidr` | The first address of the blocked range, its length, and both together. |
| `reason` | The reason given for the block, or `null`. |
| `source` | `manual` for a block you made, `admin` for one our team made. |
| `removable` | `false` for a block our team made, which only they can remove. |
| `expires_at` | When we remove the block, in UTC, or `null` for a block that stays until it is removed. |
| `created_at` | When the block was made, in UTC. |

`max_blocks` is the most blocks the address can hold. Blocks that have expired are left out.

`POST /api/v1/client/shield/subjects/{ip_service_id}/blocked-sources` blocks a source, and answers `201` with the new block in the shape above:

```bash
curl -X POST https://api.coritan.com/api/v1/client/shield/subjects/214/blocked-sources \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"address": "198.51.100.0/24", "reason": "Repeated SSH logins", "expires_minutes": 1440}'
```

| Field | Meaning |
| --- | --- |
| `address` | Required. An IPv4 address, or a range from `/8` to `/32`. |
| `reason` | Optional, up to 255 characters. |
| `expires_minutes` | Optional. The minutes until we remove the block, from 1 to 43,200 (30 days). Leave it out to keep the block until you remove it. |

`DELETE /api/v1/client/shield/subjects/{ip_service_id}/blocked-sources/{block_id}` removes a block and answers `{"status": "deleted"}`:

```bash
curl -X DELETE https://api.coritan.com/api/v1/client/shield/subjects/214/blocked-sources/881 \
  -H "Authorization: Bearer $CORITAN_TOKEN"
```

Each `POST` and `DELETE` counts towards a budget of 60 DDoS Shield changes per account in ten minutes, which changes to profiles and rules share. The answers you can act on:

| Answer | Meaning |
| --- | --- |
| `404` with `IP service '214' not found` | The floating IP is not on your account, or is cancelled. |
| `404` with `Assigned IP service '214' not found` | We have not assigned the address yet. Block the source once the floating IP is ready. |
| `404` with `Blocked source '881' not found` | The block does not exist, or is on another address. |
| `403` with `Our team added this block, so only they can remove it. Contact support to ask.` | Our team made the block. [Contact support](/docs/support/conversations/) to ask for its removal. |
| `409` with `198.51.100.0/24 is already blocked on this address.` | The address has that block already. |
| `409` with `This address already has 100 blocked sources. Remove one before adding another.` | The address holds `max_blocks` blocks. |
| `422` with `Enter an IP address or a range in CIDR form, such as 203.0.113.7 or 203.0.113.0/24.` | `address` is not an address or a range. |
| `422` with `This address is IPv4, so block an IPv4 source.` | `address` is IPv6. |
| `422` with `That range is too wide. Block a /8 or a narrower range.` | The range is wider than `/8`. |
| `422` with a list in `detail` | A field is outside its limits, such as an `expires_minutes` over 43,200. |
| `429` with `rate_limited` | The account made 60 changes in ten minutes. Wait for the seconds in the `Retry-After` header. |

The [DDoS Shield API reference](/docs/api/reference/client/shield/#op-post-api-v1-client-shield-subjects-ip-service-id-blocked-sources) lists every field.

## API

- `GET /api/v1/client/shield/subjects/{ip_service_id}/blocked-sources`: The sources refused on this IP, newest first (https://www.coritan.com/docs/api/reference/client/shield/#op-get-api-v1-client-shield-subjects-ip-service-id-blocked-sources)
- `POST /api/v1/client/shield/subjects/{ip_service_id}/blocked-sources`: Refuse traffic from an address or a CIDR range to this IP only (https://www.coritan.com/docs/api/reference/client/shield/#op-post-api-v1-client-shield-subjects-ip-service-id-blocked-sources)
- `DELETE /api/v1/client/shield/subjects/{ip_service_id}/blocked-sources/{block_id}`: Remove a block from this IP (https://www.coritan.com/docs/api/reference/client/shield/#op-delete-api-v1-client-shield-subjects-ip-service-id-blocked-sources-block-id)