# Block subnet if multiple IPs from the same subnet are banned

**URL:** <https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903>\
**Category:** crowdsec\
**Created:** [July 3, 2024, 10:13am UTC](https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903 "2024-07-03T10:13:09Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![kepon](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/kepon/32/919_2.png) [@kepon](https://discourse.crowdsec.net/u/kepon)\
**Post date:** [July 5, 2024, 12:58pm UTC](https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903/3 "2024-07-05T12:58:16Z")

</div>

I link to this discussion: [Ban-defcon-drop\_range - #2 by thibault](https://discourse.crowdsec.net/t/ban-defcon-drop-range/70/2)

For the scenario to work, you must modify your profile (`/etc/crowdsec/profiles.yaml`):

```diff
name: default_ip_remediation
...
+ ---
+ name: default_range_remediation
+ #debug: true
+ filters:
+ - Alert.Remediation == true && Alert.GetScope() == "Range"
+ decisions:
+ - type: ban
+ duration: 4h
+ on_success: break

```

And it works (tested with the loop proposed in the discussion.

THANKS !

---

_[View the full topic](https://discourse.crowdsec.net/t/block-subnet-if-multiple-ips-from-the-same-subnet-are-banned/1903)._