So I’ve been thinking of creating a post of how to block ips when they try to do something bad to your system, for example a exploit related to a wordpress plugin on your dmz-webserver. It’s quite easy and extremely effective. Just setup a profile that will automaticly block the ip when it tries to do bad things.
So first of all, create a TAG. Name it something related to blocked-ips
Create a Dynamic type Address Group for this TAG:
Then create a LogForwarding profile:
The result should be something like this:
You now have a setup that matches the severity Cirtical of the logtype Threat, that adds the sourceip of the traffic-log to the BLOCKED-HOSTS tag.
Now you can use your own incomming rule and add this log-forwarding profile to it. (BE SURE that you have a threat profile active on the rule)
To block these IP’s you need to create a Rule above the inbound rule to block these IPs:
And you are good to go. Get rid of those idiots (for a selected time atleast)
