Use Manual Rule Actions

Manual rules let an operator choose the source, action, and expiration. Proxyble routes each rule to the appropriate enforcement layer: HAProxy for HTTP-aware actions and nftables for network-level controls.

Review before changing traffic

List the active rules and inspect whether a source is already affected:

sudo proxyble --rules-list
sudo proxyble --rules-check --ip 203.0.113.25

Use short expirations such as 10m for an initial rollout. A permanent CLI rule requires --expiration none and should be reserved for deliberate, reviewed exceptions.

Network and connection actions

• DROP silently discards traffic from clearly hostile sources.
• REJECT blocks traffic and returns a fast failure.
• LIMIT_CONN_RATE caps new connection creation; it works in TCP, HTTP, and HTTPS modes.
• LIMIT_CONCURRENT caps simultaneous connections from a source.

For CIDR targets, the connection-rate and concurrency limits are measured per individual client IP, not shared across the entire range.

sudo proxyble --yes --rules-add \
  --rule LIMIT_CONN_RATE \
  --target 203.0.113.0/24 \
  --rate 25/second \
  --expiration 10m

HTTP-aware actions

These actions require HTTP mode or HTTPS mode with TLS termination:

• LIMIT_RATE_SLOW returns 429 Too Many Requests.
• BUSY_DEFLECTION returns a temporary busy response without forwarding to the backend.
• LIMIT_ENDPOINT_RATE limits a single source on selected path prefixes.
• LIMIT_BANDWIDTH reduces response throughput.
• TIMEOUT shortens the backend timeout for a source.

For example, rate-limit a single source on expensive or sensitive endpoints:

sudo proxyble --yes --rules-add \
  --rule LIMIT_ENDPOINT_RATE \
  --target 203.0.113.25 \
  --rate 10/second \
  --endpoints /login,/api/export \
  --expiration 15m

Remove or reset

Remove a matching rule from the check result, or reset one rule type when needed:

sudo proxyble --yes --rules-check \
  --ip 203.0.113.25 \
  --remove \
  --rule DROP \
  --target 203.0.113.25

sudo proxyble --yes --rules-reset --type LIMIT_CONN_RATE

Use Allow-Lists when access should be default-deny instead of subject to temporary enforcement rules.