Ban again unbanned ip-addresses

crowdsec
1

For test reasons, I sent two requests which were captured by a scenario with type trigger. So after the first request I got a decision that the IP should be banned. The second request returned a 403, as expected, because the IP is banned.

To try another request with the same IP, I removed the decision for this IP. But now I could send a lot of such requests which caused a decision before.

Is there any explanation for this? Is the IP landed somehow on a whitelist because I removed it from the decisions?

2

Hello,

This is probably because of the blackhole parameter which prevents taking decisions on IPs that were banned a few moments ago (the value is different for each scenario, you can have a look at the scenarios themselves to see what the duration is).

3

@blotus Thanks, I can confirm that I had a blackhole of 5m configured. After 5 minutes I could block my self again :wink: