Most System Administrators use a hardware
firewall to block IP addresses from accessing their network. Co-located servers
do not always have the advantage of utilizing a hardware firewall. Software
firewalls can often be expensive.
As you may already know, Windows 2003 lets
administrators control IP access from the configuration panels in SMTP and IIS,
among others. But what if you want to block an IP address from all services
with only one motion? This is where the IP Security Policy Management snap-in
comes in handy.
Configure the IP Security
Policy to block your first IP address
1.
Click “Start” and “Run” – type “MMC” and press OK.
2.
In the MMC, click “File” and “Add/Remove Snap In.”
3.
In the “Standalone” tab, click “Add.”
4.
Select “IP Security Policy Management” and click “Add.”
5.
Select “Local Computer” and click “Finish.”
6.
Close the “Add standalone Snap-in” window and click “OK” on the
“Add/Remove Snap-in” window.
7.
Now that you are back in the MMC console, right-click on “IP
Security Policies on Local Computer” in the left-hand pane and select “Create
IP Security Policy.”
8.
Click “Next.”
9.
Enter a name (ex. IP Block List) and description into the boxes
and click “Next.”
10.
Leave “Activate the default response rule” checked. Click
“Next.”
11.
Leave “Active Directory default (Kerberos)” checked. Click
“Next.”
12.
Leave “Edit properties” checked. Click “Finish.”
13.
The Properties box should be open.
14.
To add your first IP address, click “Add.” Make sure “Use Add
Wizard” is checked beside the button.
15.
Click “Next” when the “Create IP Security Rule” wizard opens.
16.
Leave “This rule does not specify a tunnel” checked. Click
“Next.”
17.
Select “All network connections” under Network Type (unless you
want to specify by adapter). Click “Next.”
18.
You are now at the “IP Filter List.” The “All ICMP Traffic” and
“All IP Traffic” options will not meet our needs; we will need to add another.
Click “Add.”
19.
Name the IP Filter List (ex. Blocked IP List) and enter a
description. Click “Add” to enter the first IP address to block.
20.
The “IP Filter Wizard” will pop up. Click “Next.”
21.
This will be the first IP address or IP range we enter to block.
Enter a description (I usually enter the IP itself) and make sure “Mirrored” is
selected below. This will ensure packets to/from are blocked, allowing you to
create one rule instead of two. Click “Next.”
22.
Keep “Source Address” as “My IP Address” and click “Next.”
23.
Under “Destination Address” select “A specific IP Address” or “A
specific IP Subnet.” If you select “Any IP address” it will block all IPs!
24.
Enter in the IP address in the fields below and click “Next.”
25.
Under “select protocol type” choose “Any” (means “All”) unless
you specifically want to block from RDP (Remote Desktop), TCP or UDP, etc.
Click “Next.”
26.
Click “Finish.”
27.
Now that you are back to the “IP Filter List” click “OK.”
28.
You will be back in the “IP Filter List” list in the Security
Rule Wizard – make sure you select your new “Blocked IP List” and not “All IP
Traffic” or “All ICMP Traffic.” Click “Next.”
29.
You will be taken to “Filter Action.” The lists: Permit, Request
Security (Optional), and Require Security will not meet our needs. Click “Add.”
30.
In the “IP Security Filter Action” wizard, click “Next.”
31.
Select a name (ex. Block all Packets) and click “Next.”
32.
Select “Block” for the filter action behavior. Click “Next.”
33.
Click “Finish.”
34.
You are back to the “Filter Action” list. Select your new
list (Block All Packets) and click “Next.”
35.
Click “Finish.”
36.
You are back to your IP Security Policy list (Blocked IP List)
Properties. Click “OK.”
37.
Back in the “IP Security Policies on Local Computer” snap-in,
you’ll need to assign the new policy. In the right-hand pane, right-click on
your new list (IP Block List) and select “assign.”
To make it easier the next time you wish to
block an IP address, save the MMC Snap-in configuration as a shortcut. Go to
“File” and “Save As” and save it on your Desktop or Start Menu.
To Block Additional IP
Addresses
1.
Enter the IP Block List snap-in you saved.
2.
In the right-hand pane double-click your IP Block List.
3.
Under “IP Filter List” select the newly created “Blocked IP
List” and click “Edit.” Make sure “Use Add Wizard” is checked.
4.
Under “IP Filter Lists” select your “Blocked IP List” (not All
ICMP or IP Traffic) and click “Edit.”
5.
You are now in the “Add IP wizard” area. You will see the first
IP address you blocked in a listing under “IP Filters.” Click “Add.”
6.
Follow all previous steps to add the IP address you wish to
block. Once finished, exit all dialog boxes.
You may need to restart the server for the
settings to take effect.
