Solved

Blocking IPs in Windows 2003 using scripting

Posted on 2006-07-11
7
250 Views
Last Modified: 2013-12-04
My ftp server has been under a dictionary attack for the past few days. I need to know if windows is able to simply stop responding to packets recieved from a certain IP address. I have a firewall and I could always just add the IPs to that but I'd prefer to be able to do it in windows because then I can write a script to automatically "ban" IPs from my server. Anyone have any suggestions?
0
Comment
Question by:CyrexCore2k
7 Comments
 
LVL 1

Expert Comment

by:benab
Comment Utility
Hi CyrexCore2k,
I don't know of a way to do it with the Windows 2003 FTP server.  You might consider finding another FTP server.

Here are two well known FTP servers.  I strongly suggest you use a secure FTP server if possible.

Cute FTP
http://www.cuteftp.com/gsftps/features.asp

Titan FTP
http://www.webdrive.com/products/titanftp/features.html


Good luck,
Ben
0
 
LVL 32

Expert Comment

by:r-k
Comment Utility
In IIS Manager, right-click on your FTP site, select "Properties" then "Directory Security", and you can use the "Add" button to add offending IP's to the list there which are denied access.
0
 
LVL 37

Accepted Solution

by:
Bing CISM / CISSP earned 250 total points
Comment Utility
> I can write a script to automatically "ban" IPs from my server.

just add ROUTE commands in your scripts. for more information, please see another post of mine which describes how to do it in detail.

http://www.experts-exchange.com/Networking/WinNT_Networking/Q_21913915.html

hope it helps,
bbao
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 
LVL 14

Author Comment

by:CyrexCore2k
Comment Utility
Oh wow that's exactly what I needed. Just do you have any idea how to get scripts to run commands?
0
 
LVL 14

Author Comment

by:CyrexCore2k
Comment Utility
And also I don't want to permanently deny these IPs access since I figure these probably aren't static IPs... what's the command to remove the route when I'm done with it?
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
Comment Utility
i'd suggest you learning the full syntax of ROUTE command by simply giving a "ROUTE /?" (no quotation marks) at command prompt. anyway i give two simple demo bath files here just for your reference:

BLOCK.BAT
--------------------
goto %1
@ECHO Usage: BLOCK net_id
goto quit

:1
@ECHO to block 10.10.1.0 ~ 10.10.1.255 (192.168.0.253 is a non-existing IP)
ROUTE ADD 10.10.1.0 MASK 255.255.255.0 192.168.0.253
goto quit

:2
@ECHO to block 10.10.2.0 ~ 10.10.2.15 (192.168.0.253 is a non-existing IP)
ROUTE ADD 10.10.2.0 MASK 255.255.255.240 192.168.0.253
goto quit

:quit
--------------------

UNBLOCK.BAT
--------------------
goto %1
@ECHO Usage: UNBLOCK net_id
goto quit

:1
@ECHO to unblock 10.10.1.0 ~ 10.10.1.255
ROUTE DELETE 10.10.1.0 MASK 255.255.255.0
goto quit

:2
@ECHO to unblock 10.10.2.0 ~ 10.10.2.15
ROUTE DELETE 10.10.2.0 MASK 255.255.255.240
goto quit

:quit
--------------------
0
 
LVL 14

Author Comment

by:CyrexCore2k
Comment Utility
I'm sorry I meant vbs windows scripts. =x I was wondering how you execute commands from those.
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

This is a guide to the following problem (not exclusive but here) on Windows: Users need our support and we supporters often use global administrative accounts to do this. Using these accounts safely is a real challenge. Any admin who takes se…
Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now