guardrails
what fud moat won't let u do, and why
| guardrail | why | fud moat |
|---|---|---|
| single ips only | a subnet block takes out scoring, white team and ur own teammates along with red team, and most comps ban it. | quick block refuses anything wider than a /32. |
| trusted ranges | management, scoring and monitoring networks have to keep working no matter what. | trusted ranges are allowed in on every box, and quick block refuses to block them. add them on the boxes page. |
| ur own boxes | blocking a teammate box breaks everything that talks to it. | quick block refuses any address in the topology. |
| out-of-scope ips | lots of comps only let u act on ur own ranges. | ips outside the scope ranges are held back until u tick that white team said ok. |
| scored services | the scoring engine's ips usually aren't known, and a check that can't connect is lost uptime. | scored ports are open to anyone. routers get a checklist, not a script, so nat and port forwards stay untouched. |
| lockouts | a bad rule over ssh or rdp can cut u off from the box. | every hardening script rolls itself back after a few minutes unless u paste keep it from a new session. |
read ur comp's rules first heads up
the firewall page drops all inbound traffic that isn't scored, an extra or trusted. some comps treat a default-deny policy like that as blocking subnets, or require specific traffic (logging, monitoring agents) to stay open. check the rules or ask white team before running the hardening scripts, and add anything that must stay reachable as a trusted range. if default-deny isn't allowed, stick to quick block.