When the dashboard is unreachable

The agent never needs the dashboard to protect the server: detection, bans and blocks all run on the server. Two situations are different, though.

The dashboard cannot be reached#

Network errors, timeouts, DNS failures and server errors (5xx) are never treated as a refusal. Protection stays on for as long as it takes:

• bans, the whitelist, country blocks and closed ports stay in force;
• new attacks are still detected and banned;
• bans expire on time on the server;
• the state is kept in /var/lib/infrafence/protection-state.json, so a restart during the outage restores it before the firewall is set up;
• events wait in a queue (up to 5,000) and are sent when the dashboard answers again.

The dashboard refuses the agent#

The dashboard refuses an agent explicitly when its token is revoked or unknown (401), when the organization is suspended (403 suspended), or when the server is beyond the plan's limit (403 plan_limit), for example after a cancellation or an unpaid invoice.

1. First 24 hours. Local protection stays in force. The agent waits before asking again, from 1 minute doubling up to 30 minutes; a suspended organization is asked every 30 minutes. The agent log says what happened, for example the dashboard refused the agent token (401). Local protection stays in force.
2. After 24 hours of refusal without a single successful answer, the agent switches its protection off cleanly: its chains, jumps and ipsets go (bans, whitelist, country blocks, threat lists, closed ports, outbound blocks), its ModSecurity rules, virtual patches and user-agent blocking are taken out of the web server, the real-time malware watcher stops and detection continues in monitor mode only. Other tools' rules are never touched. SSH is checked afterwards.
3. Login notice. Where the distribution uses /etc/motd.d, the agent writes /etc/motd.d/infrafence: InfraFence no longer protects this server: the account is suspended or the subscription ended. Reactivate it at https://infrafence.com/billing.
4. Back on. The agent keeps running and asks the dashboard every 30 minutes. At the first successful synchronization protection is switched back on and the notice is removed.

The refusal clock survives restarts. Owners get an email 12 hours before the switch-off, at the switch-off, and when access is restored. This behaviour needs agent 1.0.32 or later.