block / unban
Manual firewall. modifies firewall — adds/removes legacy iptables rules. Syncs with guard state and audit log.
Requires root
Both need sudo. Use --list first to audit before changing state.Synopsis
caddy-analyze block <ip...> [flags]
caddy-analyze unban <ip...> [flags]
caddy-analyze unban --all
caddy-analyze unban --list # audit — read-onlyFlags
| Flag | Short | Default | Description |
|---|---|---|---|
--audit-log | /var/log/caddy-analyzer-audit.jsonl | Audit log path (empty disables) | |
--audit-syslog | Forward audit events to syslog UDP | ||
--webhook-url / --audit-webhook | Forward audit events to a generic or provider webhook | ||
--state-file | /var/lib/caddy-analyzer/blocked.json | Guard state sync (empty disables) | |
--all | -A | false | unban: all currently blocked IPs |
--list | -l | false | unban: list without removing (read-only) |
Minimal example
read-only first, then modifies firewall:
# audit — who is blocked?
sudo caddy-analyze unban --list
# block one IP (idempotent — no duplicate rule if already blocked)
sudo caddy-analyze block 203.0.113.5
# unban it
sudo caddy-analyze unban 203.0.113.5
# check audit
cat /var/log/caddy-analyzer-audit.jsonl | tailAdvanced example
modifies firewall — bulk + full reset. Read-only check first on remote hosts.
# audit before bulk
sudo caddy-analyze unban --list
# block multiple (non-zero exit if any IP fails)
sudo caddy-analyze block 203.0.113.5 198.51.100.23 203.0.113.18
# reset all (danger — verify you are not about to unblock an active attacker)
sudo caddy-analyze unban --list
sudo caddy-analyze unban --all