Protection
The Protection tab protects the gateway’s public endpoint. It blocks IP addresses that repeatedly fail to log in or that flood the gateway with requests, and it lets you decide explicitly which addresses can — or can never — connect to Thinfinity VirtualUI.
The Protection tab belongs to the gateway. It appears in the Server Manager only when the gateway service is installed and enabled for this installation — a server-only setup without the gateway does not show it.
In the upper part of the tab you will find the following options.
| Option | Description |
|---|---|
| Enable brute force detection | Turns the protection engine on. When disabled, the options below have no effect. |
| Max. login attempts | Number of failed login attempts allowed from one IP address before it is blocked. The default is 3. |
| Re-enable after | Time, in minutes, that an automatically blocked IP address stays in the deny list. When it elapses, the address can connect again. The default is 10 minutes. |
| Allow Forwarding Headers | Lets the gateway read the client’s IP address from forwarding headers when it runs behind another proxy or load balancer. Enabled by default. See Forwarding Headers. |
How Blocking Works
The gateway counts failed login attempts per IP address. When an address reaches Max. login attempts, it goes into the deny list and every further request from it is rejected until Re-enable after elapses. Addresses on the allow list are never blocked.
The gateway also enforces built-in request-rate limits per URL: an address that requests the same URL too many times in a short period — for example, hammering the login page — is added to the deny list automatically, with the same expiration.
Allow List and Deny List
The lower part of the tab manages the two IP lists.
| List | Description |
|---|---|
| Allow list | Addresses that can always connect. They are exempt from brute force blocking and request-rate limits. |
| Deny list | Addresses that are blocked from connecting to Thinfinity VirtualUI. Requests from these addresses are rejected. |
Each list shows the address and mask, the source of the entry, and its expiration. Select Add to enter an address manually, or Remove to delete the selected entry.
Entries you add manually don’t expire. Entries added automatically by brute force detection expire after the Re-enable after time — remove one manually to unblock the address right away.
Forwarding Headers
When the gateway runs behind another reverse proxy or load balancer, every connection reaches it from the proxy’s IP address. With Allow Forwarding Headers enabled, the gateway reads the original client address from the X-Forwarded-For, X-Real-IP, or Forwarded header, so brute force detection and the IP lists apply to the real client instead of the proxy.
Keep Allow Forwarding Headers enabled only when the gateway sits behind a proxy you trust. These headers are supplied by the caller — when clients can reach the gateway directly, a malicious client can forge them to impersonate another address and evade IP blocking.
Always remember to select Apply in order to save the changes.