Traffic and blocklist

Traffic statisticsCopy Anchor Link

The Traffic page shows, for the last hour, 24 hours, 7 days or 30 days:

• the countries and IPs that send the most requests, with the share of each;
• how many responses were 4xx and 5xx;
• the paths and User-Agents each IP uses most, and the servers it visited;
• requests per hour over the last 7 days.

The data comes from the web servers' access logs, read by the agents. See where request sources come from.

IPs are marked as suspected scanners when they request paths such as .env, wp-login.php or phpunit, use a known scanning tool as User-Agent, or get mostly 4xx responses (guessing paths). Tick Suspected scanners only to see just those.

Blocklist and allowlistCopy Anchor Link

Every row can be blocked (1 hour, 24 hours, 7 days, 30 days or permanently) or allowed with one click. In Traffic → Blocklist / allowlist → Add rule you can also add rules by hand: an IP, an IP range (1.2.3.0/24) or a country code (CN), for every server or for one, with a note. The rules are listed under Rules.

The rules are enforced only by the servers where you turn blocking on:

How it is enforcedCopy Anchor Link

• The agent's root helper uses nftables, in its own table inet threermonitor, or ipset + iptables, in its own chain 3RM-INPUT, when nft is not available.
• Existing firewall rules are not changed: ufw and firewalld keep working.
• The allowlist takes precedence over the blocklist, including country rules.

So you don't lock yourself outCopy Anchor Link

• Established connections are always allowed: your open SSH session stays open.
• IPs that signed in to the panel in the last 7 days are allowed automatically (Settings → Traffic and blocklist / allowlist).
• Private addresses, your current IP and Cloudflare's ranges can't be blocked.
• Never blocked, not even by an administrator: allowlisted addresses, the Protected addresses in Settings → Traffic and blocklist / allowlist (VPN exits, office IPs, monitoring services…), IPs that administrators signed in from, your servers and the master. Blocking an allowlisted IP by hand is refused. On each server, the helper also never blocks the master, and the addresses in protected_ips in its agent.conf.
• Country rules and large ranges never block SSH. On each server, the SSH port (22, and any other port sshd listens on) is only blocked for single IPs and small ranges: /24 or smaller for IPv4, /48 or smaller for IPv6. A country rule or a larger range blocks the other ports, but you can always still connect with SSH.
• A rule so large that it would block almost everyone (an IPv4 range larger than /6, or IPv6 larger than /10) is refused by the server itself, even if the master sends it.
• To block only websites and leave SSH alone completely, set Settings → Traffic and blocklist / allowlist → Blocklist only blocks these ports to 80,443. Empty = all ports.

AI and the blocklistCopy Anchor Link

• With AI analysis, the traffic analyst suggests IPs and ranges to block in its reports. Nothing is blocked until you click Block.
• The AI on-call may block a single public IP by itself, with evidence in the access logs and the reviewer's approval: 1 hour by default, 7 days at most, 10 an hour and 50 a day. Ranges always need your passkey approval.
• Each block made by the AI records its evidence and who approved it.

If you are locked outCopy Anchor Link

If you do get locked out, run this on that server, from its console if necessary:

sudo 3rmonitor firewall off

The rules are removed immediately and the agent stops enforcing the panel's lists on that server. sudo 3rmonitor firewall on lets the panel manage the rules again; sudo 3rmonitor firewall status shows the current rules.