Blocking a VPN Exit Blocks an Address, Not a Person

Someone adds a VPN provider's exit address to a deny list, and the abuse stops for a day. Then a customer who happens to use the same provider files a ticket, and the rule turns out to be broader than anyone described. The block was always an address decision; the problem is that it was sold as an identity decision. Separate the two before you write the next rule.

The rule you can enforce is about a source address

A firewall rule matches a field in a packet, and the field you are matching is the source address. That rule can refuse traffic from that address reliably, which is a real and useful effect. It cannot tell you who sent the packet, what account they used or whether they are the same person who caused yesterday's problem. Writing the rule is easy; describing what it proves is where teams go wrong.

If the goal is to stop a specific behavior, an address rule is a blunt instrument that happens to be available. If the goal is to identify a user, the address is the wrong evidence and the application's authentication is the right one. Decide which goal you have before the rule goes into production.

What a registration lookup actually tells you

A registry lookup returns the allocation and the contacts registered for a network. It does not list the services running on each address, and it does not tell you which tenant sent a request. Even a small registered block can contain unrelated workloads from different customers.

dig +short exit.example.net
whois 203.0.113.0 | head -40

Resolving an exit hostname gives you the addresses returned at that moment, which is a snapshot rather than an inventory. Expanding one answer to the whole hosting prefix is a separate decision with a wider blast radius, not a more complete version of the same evidence. If you use a maintained classification feed, its label is a guess with known errors in both directions. It is not authentication, and it is not a list of people.

Stop if the proposed rule is justified by a lookup alone. A snapshot is not a scope decision.

Shared exits and collateral damage

A shared exit carries many users, and shared address space means one public address can represent a whole group of subscribers. Blocking it affects all of them, including the ones with no connection to the abuse. Widening to the surrounding prefix multiplies that effect and increases the chance that an unrelated service is caught. The collateral damage is not a side effect to note later; it is part of the rule's definition.

Packet evidence has limits of its own. A source address in an isolated SYN can be forged, so the packet does not establish who initiated anything. A half-open connection state shows that a handshake started, not that the peer is guilty of a reflection attack. A finished connection says something different from an application log, and an authenticated session names an account that neither of them does.

Choose the narrowest scope the policy allows, and write down who is expected to be caught by mistake.

Evidence to record, and a way back for users

Every address rule should carry the observation that justified it, the date, the scope and a review point. That record is what lets the next person shrink the rule instead of guessing why it exists. Without it, a temporary block becomes permanent infrastructure.

nft list ruleset | grep -n 203.0.113
ss -tn state syn-recv '( dport = :443 )'

Decide how a legitimate user recovers access before you deploy the block, because a support queue is not a recovery plan. An appeal path, a documented exception or a different access method all work; telling people to stop using their VPN does not. Pair the network rule with controls that fit the behavior: rate limits, tighter account permissions or enforcement inside the service itself. A VPN exit block can reduce unwanted traffic without pretending to be a user directory.

The symptom to keep in view is the gap between what the rule does and what people believe it does. A block refuses an address. An account identifies a user. Keep those sentences separate in the ticket, and the next rule will be easier to defend.