Block IPs in Windows 2003

[peace]

Hello.

 

In case there's a lot of UDP attacks on our client's servers lately, so we have to block IPs in Windows 2003. Do you guys have any experience in that question? I'm not asking you step by step guide (but i don't mind ). As I know there are two ways to block IPs on WS 2003: IPSec and Policies. Any useful information would be great.

 

Thank you.

[dimitrifrom31]

You can use a batch file to create the IPSec policy filter and rule :

 

REM Add policy

netsh ipsec static add policy name="Antihack" description="Protection antihacking" activatedefaultrule=yes assign=no


REM Add filter actions

netsh ipsec static add filteraction name="block" description="block traffic" action=block


REM Add filter

netsh ipsec static add filter filterlist="block Ips" srcaddr=Me dstaddr=any description="sniff tools" protocol=TCP mirrored=no srcport=0 dstport=8401


REM Add rule

netsh ipsec static add rule name="block Ips" policy="Antihack" filterlist="block sniffers" filteraction="block" activate=yes kerberos=no

 

 

Then assuming you have followed the above model you can then block the IPs in command line :

 

netsh ipsec static add filter filterlist="block IPs" srcaddr=123.123.123.123 dstaddr=Me description="Offender" protocol=any mirrored=yes srcport=0 dstport=0

 

Or if you got multiple Ip's to block use a batch file :

 

netsh ipsec static add filter filterlist="block IPs" srcaddr=123.123.123.123 dstaddr=Me description="Offender" protocol=any mirrored=yes srcport=0 dstport=0
netsh ipsec static add filter filterlist="block IPs" srcaddr=123.123.123.123 dstaddr=Me description="Offender" protocol=any mirrored=yes srcport=0 dstport=0
netsh ipsec static add filter filterlist="block IPs" srcaddr=123.123.123.123 dstaddr=Me description="Offender" protocol=any mirrored=yes srcport=0 dstport=0
netsh ipsec static add filter filterlist="block IPs" srcaddr=123.123.123.123 dstaddr=Me description="Offender" protocol=any mirrored=yes srcport=0 dstport=0

[peace]

Thanks man, much appreciated!

[Santino Cid]

You could also use Routing and Remote Access to filter inbound/outbound connections.

[peace]

All works fine, thanks.

 

I try to detect DDOS or UDP Flood attackers IPs. I installed Microsoft Network Monitor 3.4 but it seems too complicated. Is there any easiest way to detect attackers IPs?

 

I can see UDP Flood but cant find out what IP to block.

 

Thanks.