I have somebody that has been scanning my RAQ for about 2 hours and it is getting quite annoying. My PSAD warning email messages all come in with the same source IP address, so I attempted to ban the IP in IPCHAINS using the following command (this is his actual IP address):
/sbin/ipchains -A input -s 24.64.63.195/255.255.255.255 -d 0.0.0.0/0.0.0.0 -j DENY
However, I am still getting a boatload of PSAD emails from the same source IP address. I want to completely block him from my server. What am I doing wrong?
