Query: Blocking IP via CLI

[mlibre2]

Nodir, I wanted to ask if the firewall has a command-line function that would allow me to block a specific IP address, for example: FortFirewall.exe -addrule -ip 192.168.0.50 -proto:tcp -action:block -direction:in -time:300

Or if I can add these conditions in the rules panel.

I'm conducting tests in a lab to mitigate Slowloris attacks on a local web server. Something like this would be very useful.

[tnodir]

Implemented by 9dc3559.

---

Added in the next version: the rule control command.

FortFirewall.exe -c rule set-text <rule-name> <file-path>
FortFirewall.exe -c rule get-text <rule-name> <file-path>
FortFirewall.exe -c rule on|off|report <rule-name>

Create a global blocking rule in Rules once (e.g. "Block Slowloris"), then your script keeps its text in a file and applies it:

dir(in):proto(tcp):local_port(80):{
  192.168.0.50
  192.168.0.51
}

FortFirewall.exe -c rule set-text "Block Slowloris" blocked.txt

The text is checked like in the rule dialog; on an error the rule isn't changed. For a temporary block just remove the IP from the file later and run set-text again (or -c rule off "Block Slowloris"). An empty file is rejected, so keep at least a # comment line in it.

With the current version you can do the same with a Zone: File source with one IP per line, select the Zone in the rule, and run FortFirewall.exe -c zone update after editing the file.

[tnodir]

Done in v3.20.1.