# Block subnet if multiple IPs from the same subnet are banned
**URL:** https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903
**Category:** crowdsec
**Created:** [July 3, 2024, 10:13am UTC](https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903 "2024-07-03T10:13:09Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@kepon](https://discourse.crowdsec.net/u/kepon)
#### Post date: [July 3, 2024, 10:13am UTC](https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903/1 "2024-07-03T10:13:10Z")
Hello,
I would like to know if crowdsec is capable of taking ban measures retrospectively?
For example at the moment I have several IPs coming from the same subnet blocked for the same reason:
```auto
| 517 | Ip:X.113.194.43 | crowdsecurity/http-bad-user-agent | EN | 210743 xxxxxx SAS | ban:1 | 2024-07-03 07:57:03.993350467 +0000 UTC |
| 516 | Ip:X.113.194.34 | crowdsecurity/http-bad-user-agent | EN | 210743 xxxxxx SAS | ban:1 | 2024-07-03 07:56:54.868785498 +0000 UTC |
| 514 | Ip:X.113.194.39 | crowdsecurity/http-bad-user-agent | EN | 210743 xxxxxx SAS | ban:1 | 2024-07-03 07:20:21.308207165 +0000 UTC |
```
They are regularly unlocked (4 hours) then re-blocked immediately…
We could consider that after 3 IPs of the same subnet blocked for the same scenario I block the entire subnet, and this for a longer period than previously…
Is this feasible? If so, do you have any suggestions for me?
David
---
### Author:  [@kepon](https://discourse.crowdsec.net/u/kepon)
#### Post date: [July 4, 2024, 8:15pm UTC](https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903/2 "2024-07-04T20:15:02Z")
I answer myself, I was answered on Discord
This scenario seems to meet the need: [https://app.crowdsec.net/hub/author/crowdsecurity/configurations/ban-defcon-drop\_range](https://app.crowdsec.net/hub/author/crowdsecurity/configurations/ban-defcon-drop_range)
---
### Author:  [@kepon](https://discourse.crowdsec.net/u/kepon)
#### Post date: [July 5, 2024, 12:58pm UTC](https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903/3 "2024-07-05T12:58:16Z")
I link to this discussion: [Ban-defcon-drop\_range - #2 by thibault](https://discourse.crowdsec.net/t/ban-defcon-drop-range/70/2)
For the scenario to work, you must modify your profile (`/etc/crowdsec/profiles.yaml`):
```diff
name: default_ip_remediation
...
+ ---
+ name: default_range_remediation
+ #debug: true
+ filters:
+ - Alert.Remediation == true && Alert.GetScope() == "Range"
+ decisions:
+ - type: ban
+ duration: 4h
+ on_success: break
```
And it works (tested with the loop proposed in the discussion.
THANKS !
---
### Author:  [@addisonbell](https://discourse.crowdsec.net/u/addisonbell)
#### Post date: [July 12, 2024, 9:43am UTC](https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903/4 "2024-07-12T09:43:51Z")
Hello,
Thanks for the solution, this is very helpful for me.
---
### Author:  [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)
#### Post date: [July 12, 2024, 9:53am UTC](https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903/5 "2024-07-12T09:53:39Z")
Note we updated the readme of the scenario to reflect what steps are needed to get this working
[https://app.crowdsec.net/hub/author/crowdsecurity/configurations/ban-defcon-drop\_range](https://app.crowdsec.net/hub/author/crowdsecurity/configurations/ban-defcon-drop_range)
---
### Author:  [@kepon](https://discourse.crowdsec.net/u/kepon)
#### Post date: [July 15, 2024, 5:40pm UTC](https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903/6 "2024-07-15T17:40:05Z")
Good morning,
Is there a reason why the ‘ban-defcon-drop\_range’ scenario was triggered with the “for” loop shown here: [https://discourse.crowdsec.net/t/ban-defcon-drop-](https://discourse.crowdsec.net/t/ban-defcon-drop-) range/70/2 but not in real life 🙂
Right now for example I have a range that could be banned because I have lots of IPs from the same range:
```auto
╭────────┬──────────┬────────────────────┬───────────────────────────────────┬────────┬─────────┬───────────────────────────────────────────────┬────────┬────────────────────┬──────────╮
│ ID │ Source │ Scope:Value │ Reason │ Action │ Country │ AS │ Events │ expiration │ Alert ID │
├────────┼──────────┼────────────────────┼───────────────────────────────────┼────────┼─────────┼───────────────────────────────────────────────┼────────┼────────────────────┼──────────┤
│ 510258 │ crowdsec │ Ip:217.113.194.26 │ crowdsecurity/http-bad-user-agent │ ban │ FR │ 210743 Babbar SAS │ 2 │ 2h49m23.35232731s │ 292 │
│ 510257 │ crowdsec │ Ip:217.113.194.27 │ crowdsecurity/http-bad-user-agent │ ban │ FR │ 210743 Babbar SAS │ 2 │ 2h11m57.63386388s │ 291 │
│ 510256 │ crowdsec │ Ip:217.113.194.30 │ crowdsecurity/http-bad-user-agent │ ban │ FR │ 210743 Babbar SAS │ 2 │ 2h11m46.244394249s │ 290 │
│ 495255 │ crowdsec │ Ip:217.113.194.29 │ crowdsecurity/http-bad-user-agent │ ban │ FR │ 210743 Babbar SAS │ 3 │ 1h34m25.528271048s │ 288 │
│ 495254 │ crowdsec │ Ip:217.113.194.23 │ crowdsecurity/http-bad-user-agent │ ban │ FR │ 210743 Babbar SAS │ 2 │ 1h33m33.418597688s │ 287 │
│ 495253 │ crowdsec │ Ip:217.113.194.243 │ crowdsecurity/http-bad-user-agent │ ban │ FR │ 210743 Babbar SAS │ 2 │ 1h32m48.421020405s │ 286 │
```
When I try to insert a piece of log to play it doesn’t work either:
```auto
test1.fr:80 112.86.225.168 - - [15/Jul/2024:05:51:09 +0200] "GET / HTTP/1.1" 301 458 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
test1.fr:443 112.86.225.168 - - [15/Jul/2024:05:51:10 +0200] "GET / HTTP/1.1" 301 4125 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
test1.fr:443 112.86.225.168 - - [15/Jul/2024:05:51:21 +0200] "GET / HTTP/1.1" 200 69682 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
test2.fr:80 112.86.225.149 - - [15/Jul/2024:07:18:47 +0200] "GET / HTTP/1.1" 301 444 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
test2.fr:443 112.86.225.149 - - [15/Jul/2024:07:18:48 +0200] "GET / HTTP/1.1" 301 4215 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
test2.fr:443 112.86.225.149 - - [15/Jul/2024:07:18:50 +0200] "GET / HTTP/1.1" 200 198251 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
test1.fr:80 112.86.225.170 - - [15/Jul/2024:14:55:17 +0200] "GET / HTTP/1.1" 301 458 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
test1.fr:443 112.86.225.170 - - [15/Jul/2024:14:55:18 +0200] "GET / HTTP/1.1" 301 4125 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
test1.fr:443 112.86.225.170 - - [15/Jul/2024:14:55:20 +0200] "GET / HTTP/1.1" 200 69682 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
test2.fr:80 112.86.225.163 - - [15/Jul/2024:16:34:34 +0200] "GET / HTTP/1.1" 301 444 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
test2.fr:443 112.86.225.163 - - [15/Jul/2024:16:34:35 +0200] "GET / HTTP/1.1" 301 4215 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
test2.fr:443 112.86.225.163 - - [15/Jul/2024:16:34:36 +0200] "GET / HTTP/1.1" 200 198252 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
```
here “http-bad-user-agent” is triggered but never “'ban-defcon-drop\_range”
Is there a link with the fact that it is “no-syslog”?
```auto
==> /var/log/crowdsec.log <==
time="2024-07-15T19:35:11+02:00" level=info msg="(a4ae30fffff34047a2cfdffec80928e2D8EhX0lyMctpY8Dj/crowdsec) crowdsecurity/http-bad-user-agent by ip 112.86.225.168 (CN/4837) : 4h ban on Ip 112.86.225.168"
time="2024-07-15T19:35:11+02:00" level=info msg="(a4ae30fffff34047a2cfdffec80928e2D8EhX0lyMctpY8Dj/crowdsec) crowdsecurity/http-bad-user-agent by ip 112.86.225.149 (CN/4837) : 4h ban on Ip 112.86.225.149"
time="2024-07-15T19:35:11+02:00" level=info msg="(a4ae30fffff34047a2cfdffec80928e2D8EhX0lyMctpY8Dj/crowdsec) crowdsecurity/http-bad-user-agent by ip 112.86.225.170 (CN/4837) : 4h ban on Ip 112.86.225.170"
time="2024-07-15T19:35:11+02:00" level=info msg="(a4ae30fffff34047a2cfdffec80928e2D8EhX0lyMctpY8Dj/crowdsec) crowdsecurity/http-bad-user-agent by ip 112.86.225.163 (CN/4837) : 4h ban on Ip 112.86.225.163"
time="2024-07-15T19:35:11+02:00" level=info msg="(a4ae30fffff34047a2cfdffec80928e2D8EhX0lyMctpY8Dj/crowdsec) crowdsecurity/http-bad-user-agent by ip 112.86.225.164 (CN/4837) : 4h ban on Ip 112.86.225.164"
time="2024-07-15T19:35:11+02:00" level=info msg="(a4ae30fffff34047a2cfdffec80928e2D8EhX0lyMctpY8Dj/crowdsec) crowdsecurity/http-bad-user-agent by ip 112.86.225.165 (CN/4837) : 4h ban on Ip 112.86.225.165"
time="2024-07-15T19:35:12+02:00" level=info msg="Signal push: 6 signals to push"
```
Note : the scenario is indeed listed at enable when I make a “cscli scenario list”
Thank’s,
David