I am getting scanned by some external IP address and I want to block it from getting passed my firewall. I created a floating rule for both WAN and LAN interfaces and block their ip address to any destination any port.
It's still getting through ugh! Is there anyway to block it entirely?
Quick way:
1) You shoud go to Status > System Logs > Firewall
2) Then search/filter for the offending IP in the log entries list.
3) Once found, position the mouse over the [-] icon on the left of the IP in the "Source" IP column. It should say "Easy Rule: Add to block list".
4) Click on the [-] icon to create the blocking rule, and confirm the creation
Now you should have an IP alias named EasyRuleBlockHostsWAN and a blocking rule matching that alias in WAN rules.
This will block even ICMP pings from that IP.
Also, you don't need to block outgoing connections to that IP in order to prevent the incoming connections from the offending IP.
You can check if this works on the firewall logs. It may take some seconds to activate the change. Keep in mind that this doesn't disconnect already established TCP sessions. If you want to do that, you should reset in the Diagnostics > States menu.
Hope this helps.
