Block ip addresses on Window Server 2003

Question

I'm running "IP Security Policy Managment" to block ip addresses.

Is it possible to create a new filter by using the console or by using win32 api? I would like to automate the process from my application.

Answer 1

The netsh tool in the ipsec context will do what you're looking for. Have at look at Microsoft's reference for detailed information.

In the the ipsec dynamic context of netsh you can apply rules on-the-fly (which won't be made persistent), or you can use the ipsec static context to make changes to the persistent configuration (which aren't applied immediately). You can create rules and filter lists and manipulate the ipsec policy exactly like you would from the GUI. It's really very handy.

I suspect that you'll be able to figure it out since you're already familiar with all the terminology in the GUI, which is virtually the same in the command-line interface. Here's a short example creating a policy (not active), a filteraction (block), a filterlist, adding a filter to that filterlist (any source, destination me, ICMP), and adding a rule to the policy.

netsh ipsec static add policy name=MyPolicy

netsh ipsec static add filteraction name=MyFilteraction action=block

netsh ipsec static add filterlist name=MyFilterlist

netsh ipsec static add filter filterlist=MyFilterlist srcaddr=any dstaddr=me protocol=ICMP

netsh ipsec static add rule name=Rule1 policy=MyPolicy filterlist=MyFilterlist filteraction=MyFilteraction

Answer 2

wipfw is a BSD-licensed Windows port of ipfw from FreeBSD. If I would be you, I would study its code and eventually reuse it in my application.

Answer 3

This should be possible with netsh firewall or with netsh ipsec; unfortunately, I have never really used these commands, so I cannot help you any further. As always, you can get the help screens using netsh <command> /?.