#IIS Hacks

Server & System Administration Archive · 2007–2013

An independent, non-commercial archive. Not affiliated with, endorsed by or connected to any vendor named in these notes.

Straight-on view of a dark patch panel wall with one band of ports lit in cool cyan, open space at right

Block IP Addresses using IP Security Policy in Windows Server 2003

Originally published / Filed under Security, Viruses, Trojans, Windows / Server

Archived note. Originally published 10 November 2009 on iishacks.com. It describes Windows Server 2003 and the IP Security Policy Management snap-in as they behaved at that time and is preserved here as a record. Windows Server 2003 is long past end of support, and Windows Firewall with Advanced Security, introduced with Windows Server 2008, replaced this technique. Verify against current vendor documentation before applying any of it.

The recovered note

Most system administrators use a hardware firewall to block IP addresses from reaching their network. Co-located servers do not always have that advantage, and software firewalls were often expensive.

Windows Server 2003 lets administrators control IP access from the panels of individual services, SMTP and IIS among them. Blocking an address from every service in one motion needs something else, and that is where the IP Security Policy Management snap-in comes in.

Configure the IP Security Policy to block the first IP address

  1. Click Start, then Run, type MMC and press OK.
  2. Click File, then Add/Remove Snap-in, and Add on the Standalone tab.
  3. Select IP Security Policy Management, click Add, select Local Computer and click Finish.
  4. Close the Add Standalone Snap-in window and click OK in the Add/Remove Snap-in window.
  5. Back in the console, right-click IP Security Policies on Local Computer in the left-hand pane, select Create IP Security Policy and click Next.
  6. Enter a name — for example, IP Block List — and a description, then click Next.
  7. Leave Activate the default response rule ticked, then Active Directory default (Kerberos) selected, clicking Next at each.
  8. Leave Edit properties ticked and click Finish. The Properties box opens.
  9. To add the first IP address click Add, with Use Add Wizard ticked, then click Next in the Create IP Security Rule wizard.
  10. Leave This rule does not specify a tunnel selected and click Next.
  11. Select All network connections under Network Type, unless scoping the rule to one adapter, and click Next.
  12. At IP Filter List, neither All ICMP Traffic nor All IP Traffic will do; click Add.
  13. Name the filter list — for example, Blocked IP List — add a description, and click Add to enter the first address to block. The IP Filter Wizard opens; click Next.
  14. Enter a description — the address itself is a practical choice — and make sure Mirrored is selected, which blocks packets in both directions so one rule does the work of two. Click Next.
  15. Leave Source Address as My IP Address and click Next.
  16. Under Destination Address select A specific IP Address or A specific IP Subnet — selecting Any IP address here will block every address — then enter it and click Next.
  17. Under Select protocol type choose Any, unless the block should apply only to a protocol such as RDP, TCP or UDP. Click Next, then Finish.
  18. Back at the IP Filter List click OK, then in the Security Rule Wizard select the new Blocked IP List rather than All IP Traffic or All ICMP Traffic, and click Next.
  19. At Filter Action, none of Permit, Request Security (Optional) or Require Security fits. Click Add, then Next.
  20. Name the action — for example, Block all Packets — click Next, select Block as the behaviour, then Next and Finish.
  21. Back at the Filter Action list, select the new action, click Next, then Finish, then OK at the policy properties.
  22. The policy must be assigned before it does anything: in the right-hand pane of the IP Security Policies on Local Computer snap-in, right-click it and select Assign.
  23. To make the next block easier, save the snap-in configuration with File, then Save As, to the desktop or Start menu.

To block additional IP addresses

  1. Open the saved snap-in and double-click the IP Block List policy in the right-hand pane.
  2. Under IP Filter List select the Blocked IP List created earlier and click Edit, with Use Add Wizard ticked.
  3. Under IP Filter Lists select the Blocked IP List — not All ICMP Traffic or All IP Traffic — and click Edit.
  4. The previously blocked address appears under IP Filters. Click Add, follow the same steps to add the new address, then close all the dialog boxes.

The server may need a restart before the settings take effect.

Why this was fragile at scale

It worked, and on a single co-located box with a handful of persistent nuisances it was the best answer available at the time. It stopped being the right answer quickly, for structural reasons.

The filter list is flat. Every blocked address is another entry in one list with no grouping, no expiry, no meaningful ordering and no comment beyond the per-filter description. After a few dozen entries there is no way to say when an address was added, by whom or why — so entries are never removed and the list only grows.

There is no useful logging. The filter action blocks the packet and that is the whole story: nothing records that a block occurred, which address it was, or how often. A mistaken entry is therefore invisible — a customer or a probe stops reaching the server with nothing to explain it — and a rule stopping a daily attack looks exactly like one dead for a year.

Assignment is all-or-nothing. A policy is either assigned or it is not, and only one can be assigned at a time. Nothing can be disabled individually to test a theory, so troubleshooting means unassigning the whole policy — dropping every block on a production server at once, usually while something else is going wrong.

Underneath all three, the mechanism is being used against its purpose. IPsec is a framework for negotiating authenticated and encrypted communication between hosts; blocking is one behaviour it happens to offer, and the wizard above is a tour through tunnels, Kerberos response rules and security methods, none of which concerns dropping packets.

What replaced it

Windows Server 2008 shipped Windows Firewall with Advanced Security, which made this technique obsolete rather than merely inconvenient. It had a real rule model: rules individually named and enabled or disabled, scoped by profile, restricted by remote address, tied to programs, services and ports, inbound and outbound as separate decisions. It could be driven from the command line and deployed through Group Policy. And it logged.

The lesson outlives the products: where a mechanism is used for something adjacent to its purpose, the shortcomings appear not as failures but as absent facilities — no history, no logs, no way to test a change.

Reading it today

Current guidance is in the Windows Defender Firewall documentation, support status in the Microsoft product lifecycle documentation, and NIST SP 800-123, the Guide to General Server Security covers host-level filtering in its wider context.

Related notes are filed under Security, viruses and trojans and Windows and Server. The note on enabling ping replies in Windows Server 2008 shows the same host in the firewall generation that followed, and the full index is at post archives.