# How should I understand this

**URL:** <https://discourse.crowdsec.net/t/how-should-i-understand-this/1977>\
**Category:** crowdsec\
**Created:** [August 26, 2024, 5:32am UTC](https://discourse.crowdsec.net/t/how-should-i-understand-this/1977 "2024-08-26T05:32:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Legolas](https://avatars.discourse-cdn.com/v4/letter/l/b9bd4f/32.png) [@Legolas](https://discourse.crowdsec.net/u/Legolas)\
**Post date:** [August 26, 2024, 5:32am UTC](https://discourse.crowdsec.net/t/how-should-i-understand-this/1977/1 "2024-08-26T05:32:01Z")

</div>

Here a computer from country X tries to access my server. After the first access, Crowdsec says it has made a decision. Why can the computer then continue to access my server?

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/248af321ee23f492579949ec3c539c5a9525fc11.png)

I have set such IPs to be banned for 24 hours. Why is this IP not banned after the first attempt?

---

<div class="post-metadata">

**Author:** ![Foxinou35](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/foxinou35/32/147_2.png) [@Foxinou35](https://discourse.crowdsec.net/u/Foxinou35)\
**Post date:** [August 26, 2024, 3:21pm UTC](https://discourse.crowdsec.net/t/how-should-i-understand-this/1977/2 "2024-08-26T15:21:37Z")

</div>

Hi  
Did you check this ? [FAQ / Troubleshooting | CrowdSec](https://docs.crowdsec.net/u/troubleshooting/intro#ive-installed-the-security-engine-it-detects-attacks-but-doesnt-block-anything-)

---

<div class="post-metadata">

**Author:** ![Legolas](https://avatars.discourse-cdn.com/v4/letter/l/b9bd4f/32.png) [@Legolas](https://discourse.crowdsec.net/u/Legolas)\
**Post date:** [August 27, 2024, 5:31am UTC](https://discourse.crowdsec.net/t/how-should-i-understand-this/1977/3 "2024-08-27T05:31:59Z")

</div>

Yes, perhaps a problem with my setup

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/e6f81108a8cf3c56af96ff1be130093184e8afde.png)

How can i remove this duplicate entrys? I took over this server and I honestly don’t know how to fix it. Removing and reinstalling didn’t help

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [August 27, 2024, 2:03pm UTC](https://discourse.crowdsec.net/t/how-should-i-understand-this/1977/4 "2024-08-27T14:03:42Z")

</div>

> [@Legolas](#):
>
> I have set such IPs to be banned for 24 hours. Why is this IP not banned after the first attempt?

This is a tricky question without understanding your infrastructure. It depends if you using completely blocking remediation such a `firewall-bouncer` or just a web server rememdiation (which can cause multiple triggers since it responds a 403 but still logs in access logs)

by your latter response I can see the firewall bouncer but are you using a upstream proxy service like cloudflare? if so this nullifies the remediation as from layer 3/4 all the firewall remediation can see is cloudflares IP.

If you wish to delete an old entry that has an old LAPI pull timestamp you copy the `name` property and pass it to `cscli bouncers delete <name>`

---

<div class="post-metadata">

**Author:** ![Legolas](https://avatars.discourse-cdn.com/v4/letter/l/b9bd4f/32.png) [@Legolas](https://discourse.crowdsec.net/u/Legolas)\
**Post date:** [August 28, 2024, 8:53am UTC](https://discourse.crowdsec.net/t/how-should-i-understand-this/1977/5 "2024-08-28T08:53:02Z")

</div>

I’m using a firewall bouncer. and i do not use a upstrean proxy service. And thank you, the deletion of the duplicate remediation component was successfullly