The ban that locks you out instead of them
A blackhole backend bans an address by null-routing it, which drops outbound packets to that address. It does not stop an inbound connection, and if the banned address is your own workstation the server can no longer answer you.
This ban blocks nothing incoming. It can still lock you out.
Banning an address sounds unambiguous: the attacker is blocked. But how the ban is enforced decides which direction it affects, and one common method does the opposite of what most people assume.
Here is an address already banned. Now look at the routing table: there is a blackhole route for it. A null route discards packets the server tries to send to that address. It does not reject the incoming connection at all, so an attacker can still knock and the replies simply never leave. Lift the ban and the route disappears with it.
That matters most for the address you connect from. Ban your own workstation with this backend and the server stops answering you, over a rule that blocks nothing inbound. Keep your own address on the ignore list, and know which direction your ban works in.
Know which direction your ban actually blocks.
#linux#security#networking#sysadmin#selfhosting
❯ Know which direction your ban actually blocks.