# Same IP keeps getting banned, CTI says it's in community blocklist - firewall rule issue?

**URL:** <https://discourse.crowdsec.net/t/same-ip-keeps-getting-banned-cti-says-its-in-community-blocklist-firewall-rule-issue/2114>\
**Category:** crowdsec\
**Created:** [November 1, 2024, 4:21pm UTC](https://discourse.crowdsec.net/t/same-ip-keeps-getting-banned-cti-says-its-in-community-blocklist-firewall-rule-issue/2114 "2024-11-01T16:21:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![riley](https://avatars.discourse-cdn.com/v4/letter/r/2acd7d/32.png) [@riley](https://discourse.crowdsec.net/u/riley)\
**Post date:** [November 1, 2024, 4:21pm UTC](https://discourse.crowdsec.net/t/same-ip-keeps-getting-banned-cti-says-its-in-community-blocklist-firewall-rule-issue/2114/1 "2024-11-01T16:21:46Z")

</div>

I’ve been running crowdsec for a month or so now and the same IP keeps triggering alerts, gets banned for some time, then alerts again. When I look up that IP in CTI, it says it’s in the community blocklist. I’m using firewall bouncer on ubuntu.

Here’s the alerts I see - all from the same IP:

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/2X/a/abc49f5c2e73386153f511da399ac2f5d6c4ab2d.png)

from `cscli alerts list`:  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/optimized/2X/0/039e8e5585b4e9f035f834612344e3944cceece1_2_690x31.png)

When I check the iptables crowdsec list, it’s there:  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/2X/8/89c1e9072c140882427609a695e94d188166a266.png)

Here are my iptables rules:  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/2X/5/5024026de995df8ecc60b24676ef5faa6cdbb1a2.png)

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/2X/8/8709c10c33f519b63c897ecf1e003e42df1d81ac.png)

bouncer was installed with `apt install crowdsec-firewall-bouncer-iptables`

Also, if this helps, here’s the output from `show bouncers`:

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/2X/6/63983079e9c45ca9d4a3f4e5f04f675855fe69d6.png)

Any help appreciated

---

<div class="post-metadata">

**Author:** ![riley](https://avatars.discourse-cdn.com/v4/letter/r/2acd7d/32.png) [@riley](https://discourse.crowdsec.net/u/riley)\
**Post date:** [November 1, 2024, 5:59pm UTC](https://discourse.crowdsec.net/t/same-ip-keeps-getting-banned-cti-says-its-in-community-blocklist-firewall-rule-issue/2114/2 "2024-11-01T17:59:04Z")

</div>

Replying to my own post:

I am using Docker to host my services and Docker bypasses the iptables input chain… So I think that is why this IP wasn’t blocked in the first place (and many more apparently)

In `/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml` I had to uncomment the `DOCKER-USER` chain like so:

```auto
iptables_chains:
  - INPUT
# - FORWARD
# - DOCKER-USER

```

to:

```auto
iptables_chains:
  - INPUT
# - FORWARD
  - DOCKER-USER

```

Then  
`service crowdsec-firewall-bouncer restart`

Hopefully this fixes it.

---

<div class="post-metadata">

**Author:** ![seal](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@seal](https://discourse.crowdsec.net/u/seal)\
**Post date:** [November 26, 2024, 1:47pm UTC](https://discourse.crowdsec.net/t/same-ip-keeps-getting-banned-cti-says-its-in-community-blocklist-firewall-rule-issue/2114/3 "2024-11-26T13:47:23Z")

</div>

Dear @riley , Thanks so much for this post! Took me half a day to figure out how to filter Docker traffic with the iptables bouncer. My pushover was flooded with notifications.

Appreciate that you shared this with the community 🫶