02Protection

Blocked in the kernel. Confirmed by reading it back.

The agent applies blocks in its own iptables chains, using ipset. Your rules stay where they are, and established connections are not cut.

01Verified protection

An applied block is not a verified block.

Request, reported application and firewall read are different states. atalince shows each one separately and only calls verified what it read back from the kernel.

Detected
The detector reads the log and identifies the attack. · 14:19:03 UTC
Block requested
The dashboard asks that server's agent to block. · 14:19:05 UTC
Applied, reported by agent
The agent applies it to the firewall and sends a receipt. · 14:19:06 UTC
Firewall read verified
A kernel read confirms the rule is there. · 15:00:00 UTC

No evidence; this is not success.

When the receipt or the read is missing, the state stays unknown. The dashboard never rounds up.

Request, reported application and firewall read are different states. atalince shows each one separately and only calls verified what it read back from the kernel.

api-sp-01 · atalince-agentDetected

14:19:03 sshd[2211]: Failed password for root from 198.51.100.61 port 52144 ssh214:19:03 sshd[2211]: Failed password for root from 198.51.100.61 port 52146 ssh2         … 64 attempts in 90 s14:19:03 ssh detector → SSH brute force · 198.51.100.61
14:19:05 dashboard → block requested · 4 h · api-sp-01
14:19:06 ipset add atalince-bans 198.51.100.61 -exist14:19:06 agent → receipt sent to dashboard
15:00:00 kernel read         ✓ INPUT → ATALINCE-BANS         ✓ -A ATALINCE-BANS -m set --match-set atalince-bans src -j DROP         ✓ 198.51.100.61 present in atalince-bans         Firewall read verified

02Mode

Every server starts by just watching.

Once installed, the server runs in Monitor only: it detects attacks but doesn't block yet. Before turning on protection mode, add your own IP to the allowed IPs.

Monitor onlyProtection mode

14:31:08203.0.113.42SSH brute force · 48× · api-sp-01Detected onlyApplied

Detected
Block requested
Applied, reported
Read verified

Detects and records. No firewall rule is created.

Detects, requests the block, receives the receipt and checks the kernel.

03Controls

You decide what gets through.

01Allowed IPs: Addresses and networks that are never blocked. The recommended first step after installing.
02Rules: Block or allow a CIDR or a port, per server.
03Manual block: Block an IP right away, for a set duration. It goes through the same verification trail.
04Fleet blocks: One IP blocked on up to 100 servers at once. Pro plan.

04Geoblocking

Up to 50 countries, IPv4 and IPv6.

The country database is distributed by the dashboard itself: you install nothing extra on the server. Each country becomes an ipset inside atalince's chain. Pro plan.

0 / 50 · Example countries.

05Coexistence

Built to move into a server that already exists.

Existing rules: Left unchanged. Everything atalince does lives in ATALINCE-INPUT and ATALINCE-BANS.
Open connections: Established connections are not cut when protection is turned on.
ufw, firewalld, CSF: They coexist. If a reload removes the jump to the block chain, the agent notices and restores it.
Docker: Published ports are covered too, through the DOCKER-USER chain or Docker's nftables backend.
Uninstall: Removes only atalince's own state.

Founders program

Use atalince from the start.

Pro features for up to 3 servers, free of charge, for 12 months. Every application is reviewed by the team.

Become a Founder