Windows firewall and blocking ip addresses

[gemcneill]

I am trying to block a specific ip address

 

218.200.133.154

 

This ip is causing major traffic on sof2 servers. Some of you may know this already. Any way I am running 2008 and the built in firewall and I believe I have created a rule that will block that ip address, but it does not appear to be working. I am using wireshark and see that the source ip is the above ip. The rule I made is an inbound rule, but I also made an outbound rule. However the traffic appears to keep coming. Do I need to restart the server to apply this? Also if anyone can provide the specific instructions for how they would do this, it would be great. I followed the instructions here

 

http://support.gearhost.com/KB/a520/block-ip-address-with-windows-firewall-2008.aspx

 

I would not think I need to restart the server but I guess it is possible. Also I have rules for sof2 to be allowed in the firewall for inbound traffic, but as I understand it the most restrictive rule applies so it should block traffic from that ip both outbound and inbound.

 

 

George

[Darrylglenn]

Block rules always override Allow rules, except when you have the "Override block rules" checked on the SOF2 rule.

 

You dont have to restart your server to apply the block.

[dimitrifrom31]

use IPsec and create a block rule on that IP,no reboot needed

[peace]

Even if you block IP through IPSec traffic still will be loading your server's NIC.