Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesBlock an address at the layer that matches your goal: use NGINX, Apache HTTP Server, or IIS for web-server and URL-level rules; use a host or network firewall when connections should be stopped before the web server sees them. First confirm the client IP visible at that enforcement point, then choose a denylist or allowlist, account for IPv4 and IPv6, apply rules in the correct order, validate the configuration, and test from both permitted and blocked networks.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the right enforcement layer
IP blocking is not one universal setting. A rule in a web server controls requests that reach that server and can often be limited to a virtual host, site, directory, location, or proxied service. A firewall rule applies more broadly to the host or network interface and can reject a connection before HTTP processing, logging, or application code runs.
As an Amazon Associate I earn from qualifying purchases.
| Layer | Best for | Typical scope | Main operational concern |
|---|---|---|---|
| NGINX HTTP | Blocking or allowing web requests | Server, virtual host, location, or URL path | Rules are evaluated in order; the first matching rule wins |
| NGINX stream | TCP services proxied by NGINX | Stream server block and proxied TCP resource | A broad rule placed first can make later exceptions unreachable |
| Apache HTTP Server 2.4 | Access control in current Apache configurations | Directory, location, virtual host, or server | Use Require; older compatibility directives are deprecated |
| IIS | Windows web-site restrictions | Site or server, with ordered address rules | A default-deny setting can lock out administrators and local tools |
| Host or network firewall | Stopping unwanted connections before web processing | Whole host, interface, port, or perimeter | Rules affect every service sharing the protected interface or port |
Use a web-server rule when only one application or path needs protection. Use a firewall when the address should not connect to any service on the host, or when reducing exposure before the HTTP stack is involved. A firewall does not replace application authentication: an allowed IP can still be compromised, shared by many users through NAT, or reassigned later.
Confirm which client IP you can trust
The address you see in an access log is not automatically the address of the person or device making the request. A reverse proxy, load balancer, CDN, NAT gateway, or another intermediary may terminate the connection and open a new one to your server. In that arrangement, the web server may see the intermediary’s address as the network peer.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Check the enforcement point
- Identify where the rule will run: edge firewall, operating-system firewall, reverse proxy, or origin web server.
- Inspect logs at that layer and compare the connection’s source address with any forwarded headers.
- Document which proxy or load balancer is trusted to add the original client address.
- Only use a forwarded address after the intermediary has been configured to overwrite or securely set it. A client must not be able to submit an arbitrary value that your server treats as authoritative.
IIS documents optional inspection of X-Forwarded-For for restrictions. That feature is useful only when the header comes from a trusted proxy path. If direct internet traffic can reach IIS and supply the same header, an attacker could evade a rule or cause an innocent address to be blocked. Restrict direct origin access at the firewall when the design requires all traffic to arrive through the proxy.
Decide between a denylist and an allowlist
Denylist: block selected addresses
A denylist keeps the normal default behavior and rejects specific addresses or ranges. It is practical when visitors are broadly distributed and you have a small set of abusive sources to stop. Denylists require maintenance: mobile networks, VPN exits, cloud addresses, and residential connections can change ownership or rotate frequently.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAllowlist: permit only known addresses
An allowlist creates a default-deny posture. It is appropriate for an administration portal, an internal application, a staging site, or a service that should be reachable only from corporate or VPN ranges. The cost is higher lockout risk. Preserve a tested console, out-of-band, or other management path before enabling it, and include every address family your administrators actually use.
Use narrow ranges
Prefer one address or the smallest verified CIDR range. Blocking a large provider range can affect unrelated customers; allowing a broad range can admit more users than intended. Record who owns each range, why it is present, and when it should be reviewed.
Block addresses in NGINX HTTP
The official NGINX access module is designed to limit access to client addresses. Its allow and deny directives accept individual addresses, CIDR networks, unix:, and all. Rules are checked sequentially until the first match.
Block one address while leaving other traffic allowed
location / {
deny 203.0.113.44;
allow all;
}Replace the example address with the address you verified in your logs. The explicit allow all; makes the intended default clear. Place the rule in the server block if every location in that virtual host should inherit it, or keep it in a location block when only one path needs protection.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Block a network range
location /admin/ {
deny 198.51.100.0/24;
allow all;
}CIDR notation applies to IPv4 and IPv6. For an IPv6 range, use the network prefix supplied by your provider or network administrator, for example:
deny 2001:db8:1234::/48;The 2001:db8::/32 space is reserved for documentation, so substitute a real production prefix in an actual configuration.
Create an allowlist with an exception
To permit a trusted subnet but exclude one address inside it, put the specific denial first:
location /private/ {
deny 192.168.1.42;
allow 192.168.1.0/24;
deny all;
}The order matters. The excluded address matches the first rule and is denied; other addresses in the subnet reach the allow rule; all remaining addresses reach deny all;. A common allowlist without an exception is simply:
Free tools Windows power users keep installed
One-click scans. No signup required.
location /private/ {
allow 192.168.1.0/24;
allow 2001:db8:abcd::/48;
deny all;
}If the site has an AAAA record or listens on IPv6, include an IPv6 policy deliberately. An IPv4-only allowlist does not automatically protect an IPv6 listener.
Apply an NGINX change safely
- Back up the active configuration and note an out-of-band recovery method.
- Run
nginx -tto check syntax and referenced files. - Fix every reported error before reloading.
- Reload with the normal service mechanism, such as
systemctl reload nginx, rather than stopping the service unnecessarily. - Test the protected URL from an allowed address and from a blocked address. Confirm the expected status and review the access and error logs.
Restrict TCP services in NGINX stream
NGINX also supports allow and deny in a stream server block for proxied TCP resources. This controls connection sources rather than HTTP paths.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
stream {
server {
listen 3306;
proxy_pass database_backend;
allow 192.168.1.0/24;
deny all;
}
}The stream documentation specifically warns that directives are processed from top to bottom. If deny all; appears before an allow rule, every connection matches the denial and the later allow is ineffective. Validate the configuration and test the TCP client from each required network after reloading.
Block addresses in Apache HTTP Server 2.4
For current Apache HTTP Server 2.4 configurations, use the authorization provider Require ip. It accepts a complete IPv4 or IPv6 address, a partial IPv4 address, a network and netmask pair, or CIDR such as 192.168.1.0/24.
Deny one address
Apache’s negative authorization provider must be used inside a RequireAll container with a positive requirement:
<RequireAll>
Require all granted
Require not ip 203.0.113.44
</RequireAll>This leaves the resource available to other clients while rejecting the specified address.
Allow only a network
<Directory "/var/www/private">
Require ip 192.168.1.0/24
Require ip 2001:db8:abcd::/48
</Directory>Use the matching context for your deployment: a <Directory> block governs filesystem content, while a location or virtual-host context can apply to URL handling. Confirm that the path and virtual host you edited are the ones serving the request.
Do not start new rules with legacy compatibility directives
Apache states that the Allow, Deny, and Order directives supplied by mod_access_compat are deprecated and will go away in a future version. Existing legacy configurations may still work when that module is enabled, but new guidance should use the 2.4 authorization syntax so behavior is explicit and supportable.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Validate and reload Apache
- Save a copy of the working configuration.
- Run the platform’s configuration test, commonly
apachectl configtestorhttpd -t. - Resolve syntax, module, and context errors before applying the change.
- Reload Apache through the operating system’s service manager.
- Request the URL from an allowed source and a denied source, checking both the HTTP response and the server’s access log.
Block addresses in IIS
IIS provides IP Address and Domain Restrictions through IIS Manager. The feature can add individual deny entries, network restrictions, and ordered rules.
Add a single deny entry in IIS Manager
- Open IIS Manager and select the server or site that should receive the policy.
- Open IP Address and Domain Restrictions.
- Choose Add Deny Entry.
- Enter the IPv4 or IPv6 address to reject and save the entry.
- Use the feature’s ordering controls if multiple rules overlap.
Apply the rule at the narrowest scope that matches the requirement. A server-level rule can affect every IIS site, while a site-level rule avoids changing unrelated applications.
Create a default-deny policy
IIS configuration supports the allowUnlisted attribute. Setting allowUnlisted to false prevents access from addresses that are not explicitly listed, creating a default-deny posture. Add every required administrator, monitoring system, application integration, and network range before enabling it.
Include the local loopback address when local browser administration or health checks must continue. A default-deny policy that omits loopback can make requests from the server itself fail even though remote access appears correctly configured.
Account for forwarded client addresses
If IIS sits behind a reverse proxy or load balancer, determine whether the restriction feature should evaluate the proxy’s network address or a trusted original-client address. Configure the proxy path and header trust first; otherwise a rule may block the intermediary and affect every visitor, or it may accept a spoofed header.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use a host or network firewall for perimeter blocking
A firewall is the appropriate layer when unwanted connections should be stopped before the web server processes them. U.S. government security guidance describes TCP/IP packet filtering with host tools such as iptables and recommends limiting the public interface to expected web ports.
What a firewall rule changes
- It can protect every web server and other service bound to the selected interface or port.
- It reduces work for the web server because rejected packets do not become HTTP requests.
- Its logs are separate from application and web-server logs, so incident review must include the correct logging system.
- A broad rule can unintentionally block SSH, monitoring, certificate renewal, databases, or other services if ports and interfaces are not specified carefully.
Illustrative iptables deny rules
iptables -A INPUT -p tcp -s 203.0.113.44 --dport 80 -j DROP
iptables -A INPUT -p tcp -s 203.0.113.44 --dport 443 -j DROPThese examples target only TCP web ports. Distribution-specific firewall managers, persistence mechanisms, IPv6 tooling, and existing chain policies vary, so inspect the current ruleset before inserting commands and use the operating system’s supported method to save changes. If IPv6 is enabled, create and test an equivalent IPv6 policy rather than assuming IPv4 rules cover it.
IPv4, IPv6, and dual-stack failure modes
Blocking an IPv4 address does not block the same user’s IPv6 path. A browser may prefer IPv6 when an AAAA record is available, while your logs show only one address family at a time. For an allowlist, an omitted IPv6 range can lock out legitimate users; for a denylist, it can leave an alternate path open.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Check DNS for both A and AAAA records.
- Check whether the listener accepts IPv4, IPv6, or both.
- Capture test requests over each address family.
- Use valid CIDR boundaries and verify that the range belongs to the intended network.
Safe rollout procedure
- Map the path. Draw the request route from client to proxy, firewall, load balancer, web server, and application. Select the component that can see the address you intend to filter.
- Record a baseline. Save current configuration and logs. Note management, monitoring, deployment, and certificate-renewal addresses that must remain reachable.
- Choose the policy. Use a denylist for a few unwanted sources; use an allowlist for private or administrative services.
- Start narrow. Add one address or a verified small range before introducing a broad network rule.
- Place exceptions first. In first-match systems, put specific denies before broader allows, and put allows before a final default deny.
- Cover both address families. Add IPv6 rules when the service is dual-stack.
- Validate syntax. Run the server or firewall’s supported test command before reloading or applying.
- Apply without unnecessary downtime. Prefer a reload or transactional firewall update when supported.
- Test both outcomes. Verify an allowed request succeeds and a blocked request is rejected from an actually blocked network. Test through every public hostname and protocol.
- Monitor and document. Watch web-server, proxy, and firewall logs for unexpected matches, then record the owner, reason, scope, and review date for each rule.
Troubleshoot lockouts and ineffective blocks
Everyone is blocked
- Check whether
deny allor an equivalent default rule appears before an allow rule. - Confirm that a proxy address, rather than the real client range, is being evaluated.
- Verify that the administrator’s IPv4 and IPv6 addresses are listed.
- Use console or out-of-band access to remove the rule if remote management is unavailable.
The blocked address still connects
- Look for a second public hostname, IPv6 listener, or alternate port.
- Inspect the enforcement layer’s logs to confirm that the request reached the rule.
- Check whether NAT or a reverse proxy changes the source address before the rule runs.
- Review overlapping rules and first-match order.
A legitimate group is denied
- Confirm the provider’s current CIDR range rather than assuming an old address remains assigned.
- Check whether users come through a shared NAT gateway whose address was blocked for someone else’s behavior.
- Look for an IPv6 path that is missing from the allowlist.
- Use a narrower exception instead of opening an unnecessarily large network.
The configuration will not reload
Restore the last known-good file, run the platform’s syntax checker, and read the first reported error rather than chasing downstream messages. Common causes include placing a directive in the wrong context, omitting a semicolon, using an address family unsupported by the selected module, or editing a file that the active virtual host does not load.
Understand what IP blocking can and cannot do
IP filtering is a coarse network control, not proof of identity. Many people can share one public address through carrier-grade NAT, office gateways, or public Wi-Fi. Conversely, one person can appear under many addresses by changing networks. Attackers can also use proxies or compromised systems. Use IP rules alongside authentication, authorization, rate controls, patching, and application logging when the protected resource is sensitive.
There is no authoritative numeric benchmark in the cited configuration references that quantifies attack reduction, latency savings, or success rates for IP blocking. Treat a rule as a policy decision whose effectiveness depends on address accuracy, placement, maintenance, and whether traffic can reach the service through another path.
Which method should you use?
| Requirement | Recommended starting point | Why |
|---|---|---|
| Reject one abusive address for one website | NGINX, Apache, or IIS site rule | Small scope and easy application-log verification |
| Protect an administration URL for a known office or VPN | Web-server allowlist, optionally reinforced by a firewall | URL-level control limits collateral impact while the firewall adds perimeter protection |
| Prevent any connection from an address to the host | Host or network firewall | Filtering occurs before web-server processing and covers multiple services |
| Restrict a TCP service proxied by NGINX | NGINX stream access rules or firewall policy | Both operate at connection scope rather than HTTP URL scope |
| Run a Windows site with a fixed private network | IIS IP Address and Domain Restrictions | Provides GUI and configuration-file controls, including default-deny behavior |
Choose the narrowest layer that fully meets the requirement, then add a broader control only when its additional protection justifies the operational risk. Keep a recovery path, test both permitted and rejected traffic, and review rules whenever proxy topology, DNS, address ownership, or administrator networks change.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
