Blocking Visitors (IP and ASN Block Lists)

Updated Oct 15, 2026

Sometimes the question isn't "who should I let in?" but "who should I keep out?" A block list is the opposite of an allowed-networks list: anyone on the list is turned away, and everyone else is treated normally.

What can go on a block list

• A single address, like 203.0.113.9
• A range of addresses, like 198.51.100.0/24
• A whole network operator, by its AS number, like AS13238

That last one is the part most people haven't seen before. Every large company, hosting provider or internet service provider is assigned an AS number (it stands for "Autonomous System number"), and that number stands for all the addresses the operator owns. If a provider keeps sending you unwanted traffic, you don't need to hunt down hundreds of address ranges. Type the AS number once and RustProxy blocks every range that network announces.

You can mix all three kinds in one list.

How the AS numbers stay accurate

RustProxy looks up the ranges for each AS number from a public registry (RIPEstat) and saves them. It re-checks once a day, so when the operator adds new ranges they get picked up automatically.

If a lookup fails (the registry is down, say), RustProxy keeps blocking with the last good copy and tries again in 15 minutes. A failed lookup never quietly unblocks anyone. The list's screen shows, for each AS number, how many ranges were found, when they were last refreshed, and the last error if there was one.

Setting one up

1. Open the Access lists tab and create a new list. Choose IP / ASN block list.
2. Add entries: addresses, ranges, or AS numbers (AS13238 or just 13238).
3. Decide where it applies, below.

One site, or everywhere

• For one site: go to the host (Hosts tab, Edit) and, in Access control, select the block list. That site turns the listed visitors away; every other site is unaffected.
• For everything: open the list and turn on Global. Now it applies to every site, and also to the firewall itself (next section).

Per-site is the right default. Reach for global when one source is bothering everything you run.

Block always wins

A visitor on a block list is turned away even if they would otherwise get in: even if their address is on an allowed list, they know the password, or they have a valid client certificate. Blocking is checked first.

A blocked visitor on a website sees the plain Access denied page. Each refused request is also recorded as an ip_blocked event if you send logs to a security system.

Blocking reaches past websites

A global block list is enforced by the firewall too, not just by the website layer. That means it also stops:

• Connections to the other ports you opened (game servers, remote-access tools, anything under Opening Other Ports)
• SSH and the admin panel's port
• Traffic going to hosted VMs on public addresses (IPv4 only)
• Connections that were already open. They're cut when the block takes effect.

A block list chosen on a single port rule works the same way, but only for that one rule.

Two cautions

• Never put your own address on a global list. Global blocks apply before SSH and the admin panel, so blocking the address you manage the server from locks you out. Only the server's own internal loopback is exempt. Use a per-site list if you're not sure.
• Very large AS numbers produce a long firewall rule list. That's fine, but if you're adding dozens of huge networks, expect it.

Related

• Protecting a Site: allowing certain visitors in, rather than keeping certain visitors out
• Troubleshooting: if a visitor is blocked who shouldn't be