Answers: <p>Yes, we can block traffic from single IP or IP range. Please follow below steps to do this</p>
  <blockquote>
  <p>Open <strong>VPC</strong> dashboard</p>
  </blockquote>
  <p><a href="https://i.sstatic.net/4FQ46.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/4FQ46.png" alt="enter image description here" /></a></p>
  <blockquote>
  <p>Open the <strong>Network ACLs</strong> view</p>
  </blockquote>
  <p><a href="https://i.sstatic.net/AIfeO.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/AIfeO.png" alt="enter image description here" /></a></p>
  <blockquote>
  <p>Open the ACL editor</p>
  </blockquote>
  <ol>
  <li><p>Select the subnet to which your EC2 instances or load balancers are connected.</p>
  </li>
  <li><p>Click <strong>Inbound Rules</strong></p>
  </li>
  <li><p>Click <strong>Edit</strong></p>
  </li>
  </ol>
  <p><a href="https://i.sstatic.net/n81I6.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/n81I6.png" alt="enter image description here" /></a></p>
  <blockquote>
  <p>Add a rule to block the traffic/IP</p>
  </blockquote>
  <p>You will now see the ACL editor. On the last row, you can add a new rule.</p>
  <p><a href="https://i.sstatic.net/kF4qy.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/kF4qy.png" alt="enter image description here" /></a></p>
  <p>Here is how you should fill out the fields:</p>
  <h1>Rule</h1>
  <p>Use any number less than 100, which is the number of the default accept-all rule. This is important because rules are evaluated in order, and your rule needs to come before the default.</p>
  <h1>Type</h1>
  <p>Select “All traffic” or Particular Protocol which you want to Block</p>
  <h1>Source</h1>
  <p>The CIDR you want to block. To match a single IP address, enter it here and append /32. For example, I blocked <code>22.87.45.187/32</code></p>
  <h1>Allow/Deny</h1>
  <p>Select “DENY”</p>
  <p>Now <strong>click Save</strong> and you should see the updated rules table.</p>
  <p>Fore more details visit <a href="https://www.serverkaka.com/2018/05/block-traffic-from-single-ip-in-aws.html" rel="nofollow noreferrer">https://www.serverkaka.com/2018/05/block-traffic-from-single-ip-in-aws.html</a></p>
  <hr />
  <h3>UPDATE: How to do it in CLI</h3>
  <blockquote>
  <p>NOTE: This example command includes <code>--dry-run</code> option, so it is safe to run. It will not create <em>NACL</em> rule. Run it without this option, if you want to apply it.</p>
  </blockquote>
  <pre><code>aws ec2 create-network-acl-entry --dry-run --network-acl-id acl-146adb6f --ingress --rule-number 20 --protocol tcp --port-range From=80,To=80 --cidr-block 22.87.45.187/32 --rule-action deny
  </code></pre>
  <p>More examples:
  <a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/create-network-acl-entry.html#examples" rel="nofollow noreferrer">https://docs.aws.amazon.com/cli/latest/reference/ec2/create-network-acl-entry.html#examples</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2019-01-26T01:45:44.367Z
Answers: This can also be done via command line. Additionally you can use Fail2Ban to detect the problematic source and then use your own custom script to assert the NACL rule to block that IP. As well you can incorporate additional scripts to release after X (e.g. 30 minutes) the rule. Sorry, I cannot post an example as I was not allowed to copy the work I did to create just this.
Answers: Steven K7FAQ
Answers: CC BY-SA 4.0
Answers: 2019-01-25T10:21:35.907Z
Answers: 2019-08-14T09:35:40.757Z
Answers: 2020-06-18T08:28:10.803Z
Answers: Subhash
Body: <p>Our server being hammered by traffic from some particular IP. It was causing a 20x increase in traffic to some URLs. So I wanted to block all traffic from that single IP. </p>
  
Tags: <amazon-web-services><aws-vpc>
Title: How to Block Traffic From a Single IP in AWS
UserDisplayName: Jay
ThreadText: # How to Block Traffic From a Single IP in AWS
  
  (Asked by: username_0 on 2019-01-25)
  
  Our server being hammered by traffic from some particular IP. It was causing a 20x increase in traffic to some URLs. So I wanted to block all traffic from that single IP.
  
  **Tags:** amazon-web-services, aws-vpc
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-01-25. Score: 3 | Accepted answer
  
  Yes, we can block traffic from single IP or IP range. Please follow below steps to do this
  
  > Open **VPC** dashboard
  
  [![enter image description here](https://i.sstatic.net/4FQ46.png)](https://i.sstatic.net/4FQ46.png)
  
  > Open the **Network ACLs** view
  
  [![enter image description here](https://i.sstatic.net/AIfeO.png)](https://i.sstatic.net/AIfeO.png)
  
  > Open the ACL editor
  
  1. Select the subnet to which your EC2 instances or load balancers are connected.
  2. Click **Inbound Rules**
  3. Click **Edit**
  
  [![enter image description here](https://i.sstatic.net/n81I6.png)](https://i.sstatic.net/n81I6.png)
  
  > Add a rule to block the traffic/IP
  
  You will now see the ACL editor. On the last row, you can add a new rule.
  
  [![enter image description here](https://i.sstatic.net/kF4qy.png)](https://i.sstatic.net/kF4qy.png)
  
  Here is how you should fill out the fields:
  
  # Rule
  
  Use any number less than 100, which is the number of the default accept-all rule. This is important because rules are evaluated in order, and your rule needs to come before the default.
  
  # Type
  
  Select “All traffic” or Particular Protocol which you want to Block
  
  # Source
  
  The CIDR you want to block. To match a single IP address, enter it here and append /32. For example, I blocked `22.87.45.187/32`
  
  # Allow/Deny
  
  Select “DENY”
  
  Now **click Save** and you should see the updated rules table.
  
  Fore more details visit <https://www.serverkaka.com/2018/05/block-traffic-from-single-ip-in-aws.html>
  
  ---
  
  ### UPDATE: How to do it in CLI
  
  > NOTE: This example command includes `--dry-run` option, so it is safe to run. It will not create *NACL* rule. Run it without this option, if you want to apply it.
  
  ```
  aws ec2 create-network-acl-entry --dry-run --network-acl-id acl-146adb6f --ingress --rule-number 20 --protocol tcp --port-range From=80,To=80 --cidr-block 22.87.45.187/32 --rule-action deny
  
  ```
  
  More examples:
  <https://docs.aws.amazon.com/cli/latest/reference/ec2/create-network-acl-entry.html#examples>
  
  > **Comments:**
  > **username_2**: This can also be done via command line. Additionally you can use Fail2Ban to detect the problematic source and then use your own custom script to assert the NACL rule to block that IP. As well you can incorporate additional scripts to release after X (e.g. 30 minutes) the rule. Sorry, I cannot post an example as I was not allowed to copy the work I did to create just this.  
  
  ---
  
  