[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 647
  • Last Modified:

Block IP Range

Hi, I have windows 2003 Server, Standard Edition. Is there anyway I can block a particular IP range from accessing anything. There is a particular person who keeps coming to all the stuff my server hosts, and causes trouble, I would like to ban him from everything, every port, and every program.
0
techiehost
Asked:
techiehost
2 Solutions
 
msiceCommented:
You can deny the IP address on your router or ISA server if you have one, but if it is a dynamic IP it will not help you.
0
 
bbaoIT ConsultantCommented:
you can do it, without buying any extra software, just use ROUTE command.

assume your subnet is 192.168.100.0/255.255.255.0, the IPs to be banned is 172.16.16.1-16/255.255.255.0, a reserved IP on your LAN is 192.168.100.250/255.255.255.0 (an valid address but not in use), then run the followings in a command prompt window:

route -p add 197.16.16.0 mask 255.255.255.240 192.168.100.250 metric 1

this command will forward any traffic for 172.16.16.1-16 to a place not existent, which eventually block the IPs at all.

hope it helps,
bbao
0
 
LimeSMJCommented:
bbao... good solution but is there a typo in your route command??  shouldn't it be:

route -p add 172.16.16.0 mask 255.255.255.240 192.168.100.250 metric 1
0
 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

 
bbaoIT ConsultantCommented:
oh, yes, it should be "172.16.16.0". sorry for the typo. :)
0
 
Rich RumbleSecurity SamuraiCommented:
Since win2k windows has what they call IPSEC- it's a program the is supposed to help you negoitiate secure communications, but can also deny traffic. And recently been improved, as it suffered from a vital flaw- which was allowing certain source ports through no matter what. Again, that's been remedied http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/deployguide/en-us/dnsbj_ips_dbmy.asp
(2003 by default is set to 3... so only isakmp traffic is exempt from ipsec filters- which will get this person no where http://support.microsoft.com/default.aspx?scid=811832)

on the run line type "secpol.msc" and at the bottom you'll see the IPSEC in a list. here is an article to help you configure it:
http://www.microsoft.com/windows2000/techinfo/planning/security/ipsecsteps.asp#cisfa
http://www.microsoft.com/windowsxp/home/using/productdoc/en/default.asp?url=/windowsxp/home/using/productdoc/en/ipsec_filter-spec_create.asp

2003 ICF should have a way of doing this- they just added the function to XP (with sp2) but I haven't looked at 2003 lately.
-rich
0
 
Rich RumbleSecurity SamuraiCommented:
I think my answer covers the issue better than the other solutions of adding an asymetric route.
In addition, the author said he'd like to keep him from using programs, with active directory you can limit exe's that users can use. However windows XP or 2003 are the required OS's, meaning 2000
cannot restrict programs from running. Again the users have to be using xp or 2003 for this to work. An alternitive is using ZoneAlarm, it can "ban" programs from running.
-rich
0

Featured Post

New Tabletop Appliances Blow Competitors Away!

WatchGuard’s new T15, T35 and T55 tabletop UTMs provide the highest-performing security inspection in their class, allowing users at small offices, home offices and distributed enterprises to experience blazing-fast Internet speeds without sacrificing enterprise-grade security.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now