Create IP, domain and country access rules
How to create your own access rules, observe them in dry-run, and activate them after 24 hours.
Last verified: 2026-07-20
In the "Security" → "Access Control" section you can create your own rules that block or explicitly allow IPs, domains, email domains or countries. Every new rule mandatorily starts in dry-run mode: it observes and logs, but does not yet block anything. Only after a minimum observation period of 24 hours can you manually activate a rule — there is no automatic transition.
Step by step
- Open the "Access Control" sectionNavigate to "Security" → "Access Control" and open the "My rules" tab.
- Choose a rule typeChoose one of six types: block IP, allow IP (takes precedence over blocks), block domain, block email domain, block country, or allow country (takes precedence over blocks).
- Set the scope and valueChoose the scope (depending on rule type) and enter the specific value (e.g. IP address/CIDR, domain, or country code). For domain rules you can additionally choose between exact match and suffix match.
- Enter a reason and saveThe "Reason" field is mandatory — without a value and reason, the save button stays disabled.
- Observe the dry runThe new rule shows the status "Dry run (observing only)" in orange. In the decision log you see which requests the rule would have matched ("would_block") — nothing is actually blocked.
- Activate after 24 hoursOnce the minimum observation period of 24 hours is reached, the "Activate now" button becomes usable. Only then does the status change to "Active (blocking)" and the rule takes real effect.
Expected result
Your rule is created, traceably documented in the decision log, and — if needed — can be deliberately activated after the minimum observation period.
Common error cases
The "Activate now" button is disabled and shows "Activation possible in ~Xh".
Cause: The rule has not yet reached the 24-hour minimum observation period — this is a deliberate safety lock, enforced both in the UI and server-side as a database constraint.
Resolution: Wait out the remaining time. This period cannot be bypassed or shortened.
A rule created in dry-run still does not block requests, even though it is marked "would_block" in the log.
Cause: This is expected behavior — in dry-run only logging happens, real blocking only starts after explicit activation.
Resolution: No action needed if you did not intend to activate the rule yet.
I want to create a rate-limit rule via this form but cannot find an option for it.
Cause: Rate limits are not available as a rule type here — they are managed exclusively by Zentor (Master Admin).
Resolution: Contact Zentor for rate limit adjustments.