# Cscli decisions add does not stop the connection---- Solved

**URL:** <https://forum.hhf.technology/t/cscli-decisions-add-does-not-stop-the-connection-solved/4277>\
**Category:** Help\
**Tags:** crowdsec, pangolin\
**Created:** [February 13, 2026, 3:46pm UTC](https://forum.hhf.technology/t/cscli-decisions-add-does-not-stop-the-connection-solved/4277 "2026-02-13T15:46:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![AndreAs](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/a/ee7513/32.png) [@AndreAs](https://forum.hhf.technology/u/AndreAs)\
**Post date:** [February 13, 2026, 3:46pm UTC](https://forum.hhf.technology/t/cscli-decisions-add-does-not-stop-the-connection-solved/4277/1 "2026-02-13T15:46:20Z")

</div>

While testing the banning with CrowdSec, I did:  
`docker exec crowdsec cscli decisions add --ip 1.2.3.4 --duration 1h --type ban`

Can see this rule added in the decision list:  
`docker exec crowdsec cscli decisions list`

Source: cscli, Reason: manual ‘captcha’ from ‘localhost’

But if I’m connecting from this IP (it’s a VPN server I chose to test with it, can confirm the same IP is to be seen for the device I’m connecting from) can reach the Pangolin log in page.  
And the applications on subdomains provided by Pangolin continue to work.

Why is that? I was thinking this should enforce the 404, yet can’t make it work.

I have some IP in allowlist `docker exec crowdsec cscli allowlist inspect my_allowlist`, but not this one.

CrowdSec is installed by the Pangolin installer and there is no host system boucer (firewall) installed yet.

---

<div class="post-metadata">

**Author:** ![system](https://forum.hhf.technology/user_avatar/forum.hhf.technology/system/32/16_2.png) [@system](https://forum.hhf.technology/u/system)\
**Post date:** [November 1, 2026, 4:57am UTC](https://forum.hhf.technology/t/cscli-decisions-add-does-not-stop-the-connection-solved/4277/2 "2026-11-01T04:57:42Z")

</div>

This topic has had no activity for 30 days. **It will close in 7 days** unless someone replies.

- Still broken? Reply with your current versions and logs, and it stays open.
- Fixed it? Post what worked and mark it as the solution, so the next person finds it.