July 27, 2026 · 2 minutes read

How to add an RTBH blackhole or a BGP FlowSpec rule by hand in the WanGuard Console during a live DDoS attack.

WanGuard blocks DDoS attacks automatically. There are, however, situations where a manual rule is needed. Below is a step-by-step guide to adding an RTBH blackhole and a BGP FlowSpec rule in the WanGuard Console.

RTBH blocks all traffic destined for a given IP address — the host becomes unreachable. BGP FlowSpec blocks only the traffic matching the rule (protocol, ports, packet size), so the host stays online.

RTBH — step by step

WanGuard Console — five numbered steps to add an RTBH blackhole by hand
Adding an RTBH blackhole by hand in the WanGuard Console.
  1. Open Routing in the left Tools menu.
  2. Click Create Blackhole.
  3. Destination Prefix: the attacked IP as a /32 (e.g. 11.11.11.11/32). Choose your RTBH BGP connector (e.g. GoBGP-RTBH).
  4. Announce Until: Custom interval (e.g. 1 hour) — the rule withdraws itself, or Manual withdrawal — it stays until you remove it.
  5. Click Add. WanGuard announces the blackhole to the BGP peer.

BGP FlowSpec — step by step

WanGuard Console — six numbered steps to add a BGP FlowSpec rule by hand
Adding a BGP FlowSpec rule by hand in the WanGuard Console.
  1. Open Routing in the left Tools menu.
  2. Click Add Flowspec Rule.
  3. Destination Prefix: the attacked IP (/32). Add a Source Prefix if needed.
  4. Set the match and the action: IP Protocol, Source/Destination Port(s), optionally ICMP type or packet length, and Action = Discard (or Rate limit). Choose your FlowSpec connector (e.g. GoBGP-FlowSpec).
  5. Announce Until: Manual withdrawal or Custom interval.
  6. Click Add. The rule is announced over BGP FlowSpec.

Example: drop an ICMP flood for 10 minutes

IP Protocol = ICMP, Destination Prefix = 11.11.11.11/32, Action = Discard, Announce Until = Custom interval, 10 minute(s).

Filled WanGuard FlowSpec rule: ICMP to 11.11.11.11/32, Action Discard, custom interval 10 minutes
A filled-in FlowSpec rule.

RTBH or FlowSpec — which one?

RTBHBGP FlowSpec
ScopeWhole IP (/32)Only matching traffic
Host stays online?NoYes
Time to applyInstantInstant
NeedsA BGP peer that honours a blackholeFlowSpec-capable routers or upstream
Best whenSaving the link and networkYou can describe the attack

Requirements

  1. A BGP connector must be configured in WanGuard (you select it in the form), and the peer or upstream must accept the announcements.
  2. BGP FlowSpec requires routers or an upstream that accept FlowSpec (RFC 8955).
  3. To remove a rule: Routing → select the entry → withdraw. Time-based rules withdraw themselves when the interval expires.

ITORO configures WanGuard, the BGP connectors and routers for RTBH and BGP FlowSpec. Questions? — get in touch.