Skip to content
Home » Help Center » Prixl Warden guides » Block attackers: manual blocks, auto-block and trusted IPs

Block attackers: manual blocks, auto-block and trusted IPs

What you will do

Stop addresses that are attacking your server. First add the addresses you trust so Warden never blocks them automatically; then block and unblock addresses by hand, switch on automatic blocking if you want it, and (on paid plans) block straight from an alert email. Every block is a Windows Firewall rule on the server.

Time: about 10 minutes. You need: the dashboard open (see Open the dashboard); your office’s public internet address, and those of anyone else who connects from a fixed address, such as your IT vendor.

Blocking the wrong address can lock out your own staff, or you. Add trusted addresses first, and make sure you have a way into the server that does not depend on Remote Desktop (your cloud provider’s console, the server’s remote management card, or someone at the keyboard).

Step 1: add your trusted IPs

  1. Click the Trusted IPs tab.
  2. Under “Add Trusted IP”, type one address (for example 203.0.113.5) or a range in CIDR form (for example 203.0.113.0/24) and click Add.
  3. Repeat for each address you trust. To take one off the list, click Remove next to it and confirm.

Trusted addresses are never blocked automatically, however many failed sign-ins they cause. You can still block one by hand from the IP Blocking tab. If a trusted address does make repeated failed sign-ins, Warden emails you “Brute-force from TRUSTED IP” with the address, so repeated failures from your own side still reach you. The list is kept if you reinstall Warden on the same server.

Step 2: block an address by hand

  1. Click the IP Blocking tab.
  2. To block an address Warden has already seen attacking, find it in “Detected Attackers (from brute-force data)” and click Block on its row. The table shows each address’s failures and when it was last seen.
  3. To block any other address, type it in the box under “Manual Block” (for example 198.51.100.23) and click Block.
  1. The address appears under “Currently Blocked” with a firewall rule named Prixl-Block- followed by the address.

The trial allows 3 manual blocks a day; paid plans allow more. When you reach the limit, the dashboard says “Daily IP block limit reached” and the count starts again the next day.

Step 3: unblock an address

  1. On the IP Blocking tab, find the address under “Currently Blocked”.
  2. Click Unblock and confirm. Warden removes the firewall rule.

Step 4: switch on auto-block (optional)

Auto-block is opt-in: Warden blocks attacking addresses on its own only after you switch it on. Private addresses on your own network (LAN) are never blocked automatically.

  1. On the IP Blocking tab, find the switches at the top.
  2. Turn on Auto-block brute-force detected IPs to block addresses that Warden’s brute-force detection flags, from fast floods to slow, low-and-slow campaigns.
  3. If you also want a simple rule of your own, turn on Auto-block IPs after … failures in … min and enter the number of failed sign-ins (1 to 100) and the time window in minutes (1 to 1440). Your plan may set a lowest allowed number.
  4. Click Save.

When Warden blocks an address automatically, the alert email says the IP “has been AUTOMATICALLY BLOCKED in Windows Firewall” and points you to the IP Blocking tab to review or unblock it.

Step 5: block from an alert email (paid plans)

On paid plans, an alert about sign-in attacks from an internet address includes a box “Block IP …?” with a red Block button.

  1. Read the alert. If you do not recognise the address, click the red Block button in the email.
  1. A page titled “IP Block Requested” opens. Warden applies the firewall rule on the server at its next check, usually in under 30 seconds.

Each link works once and expires after a short time; the email says so. If it has expired, block the address from the dashboard instead. Some alerts have no block link: when the address is on your own network, when it belongs to a Secure Access device, when it is on your Trusted IPs list, or when Warden has already blocked it automatically. The trial does not include the email block link.

Check it worked

  • The address is listed under “Currently Blocked” on the IP Blocking tab.
  • Every alert recipient gets an email “[Prixl Warden] IP Address Blocked” naming the device (“IP Address Unblocked” when you unblock).
  • If you want to see it in Windows, the rule named Prixl-Block- followed by the address is in Windows Defender Firewall with Advanced Security (press Windows+R and type wf.msc).

If something goes wrong

  • You blocked your own address and cannot connect: get in through the cloud console, the remote management card or the keyboard, then Unblock the address and add it to Trusted IPs.
  • The email link page says “Invalid or expired link” or “Link already used”: open the dashboard and block the address from the IP Blocking tab.
  • “Manual IP blocking is not available on your plan.” or the daily limit is reached: wait until the next day or see the pricing page.
  • Other problems: see Troubleshooting Warden. Uninstalling Warden removes every Prixl block rule.

Next

Previous: Run the security audit and apply fixes. Next: Restrict risky ports (Open Ports tab). Back to Prixl Warden guides.