Manage IPDB and DDoS protection

Use cPFence v4+ IPDB Firewall & IP Tools → Settings to set IPDB Protection, DDoS Protection and Under-Attack Mode for one server, then Save. Support users need protection-setting permission.

Protection switches for one server; identifying values hidden. Select the image for full size; use browser Back to return.

For multiple servers, choose the matching Advanced Tools action, check the sidebar targets and read each result.

Review DDoS and brute-force records

1. On System Dashboard, choose the affected server scope and select DDoS & Brute-force Attacks Blocked.
2. Check Source is DDoS & brute-force, filter the IP/country/server, then Apply filters.
3. Read recorded counts and LAST SEEN alongside service health. Check current policy on the IPDB page before changing access.

Recorded DDoS and brute-force activity in Local scope. Identifying values are concealed; historical totals do not prove present blocking. Select the image for full size; use browser Back to return.

Follow the shared dashboard drawer guidance for scope, freshness, external IP links and more retained rows.

Using the CLI

Run the intended action as root on the licensed target:

Action	Command
Enable IPDB	cpfence --enable-ipdb
Disable IPDB	cpfence --disable-ipdb
Restart IPDB	cpfence --restart-ipdb
Enable DDoS protection	cpfence --enable-DDos
Disable DDoS protection	cpfence --disable-DDos
Enable under-attack mode	cpfence --under-attack-on
Disable under-attack mode	cpfence --under-attack-off

Connection limit in System Settings defaults to 100 concurrent connections per source. DNS traffic (port 53) and mail traffic (ports 25, 110, 143, 465, 587, 993, 995 and 4190) do not count toward this limit, so busy public DNS resolvers and offices with many mail users behind one IP are not blocked. Failed mail logins are still blocked by authentication protection. Save through the settings controls. After a direct CONNECTIONS_LIMIT edit in /etc/cpfcli/config.conf, apply it with cpfence --restart-ipdb while IPDB is enabled.

Use emergency mode temporarily

Under-attack mode is more aggressive. Turn it off after the attack, verify legitimate access and retain a root session or provider console. Disabling IPDB removes its protection but does not erase unrelated UFW rules.

Monitor incidents in IPDB summary or run cpfence --monitor-ipdb-blocks. See traffic diagnosis before treating many requests as an attack.