4
1
I have found out that one IP address is trying to RDP to a machine.
I would now like to get XP to block all incoming connections from this IP address, and I am finding it very frustrating how difficult such a simple task could be.
How do I block incoming connections from one IP address?
Gary Jones
Posted 2012-04-12T11:03:00.787
Reputation: 141
3
You could use the Windows Firewall to block incoming connections on port 3389 from that IP.
Cristian Lupascu
Posted 2012-04-12T11:03:00.787
Reputation: 1 693
1Can you block individual IP address using Firewall in XP? – Gary Jones – 2012-04-12T11:22:55.787
yes, that should be possible. I just tested on my Windows 7 and if I add a custom firewall rule I'm able to specify the incoming IP. On Win XP the UI is a bit different, but it should allow it. Have a look at http://support.microsoft.com/kb/843090 - you can specify firewall exception based on IP address.
– Cristian Lupascu – 2012-04-12T11:31:07.880Specifying an exception on the basis of IP address wouldn't work because I want to exclude one address. The exceptions need to either allow all addresses or a set of specified addresses. There is no way to exclude just one address. – Gary Jones – 2012-04-12T12:08:28.193
You could turn this into an ALLOW rule. For example: ALLOW all incoming conections on port 3389 from all IPs, except 192.168.bad.boy. PS: I think there should already be a predefined ALLOW rule in the firewall that allows RDP, otherwise it wouldn't work. You could tweak it to add the exception. – Cristian Lupascu – 2012-04-12T12:19:58.213
There doesn't seem to be way in the XP firewall to have an exception like this. The only way seems to be to open up a port to either all addresses or to a set of addresses. – Gary Jones – 2012-04-12T12:40:03.833
3
If an inbound connection is getting through your router/modem, it is already a potential threat to other systems on your network, or will be some time, once it detects a hole in your infrastructure.
Unless you have a very old hardware or a modem, I'd suggest first trying to block the IP on the firewall settings of your router.
Enter your administrative web frontend of your router (see manual for standard login and IP) and enter the IP to be blocked in there.
If this should fail, then install/configure the Windows Firewall on your XP and do as this page says.
Precision strike
If your router is asking for an ip address AND a subnet mask to it:
Subnet masking is for defining an IP range based on how many bits are to be allowed beginning from the right side of the IP address. In order to cater for a single IP address, the address mask is 255.255.255.255 or /32, depending on notation. If you need to define a range, study the WIKI page.
Carpet-bombing
Block all incoming connections - This is already the default on most routers, when filtering is activated.
Then you can allow for selected IP addresses/ranges one by one.
Bora
Posted 2012-04-12T11:03:00.787
Reputation: 732
I had a look at IP filtering on the modem but I didn't know what subnet mask to put for the source and destination IPs. – Gary Jones – 2012-04-12T11:59:56.143
Subnet masking is for defining an IP range based on how many bits are to be allowed beginning from the right side of the IP address. In order to cater for a single IP address, the address mask is 255.255.255.255 or /32, depending on notation. If you need to define a range, study this page: http://en.wikipedia.org/wiki/IPv4_subnetting_reference
– Bora – 2012-04-12T12:12:26.283Subnet mask is the same for ANY single IP address, which is 255.255.255.255 – Bora – 2012-04-12T12:23:09.640
Interesting thing about my modem is that it blocks all incoming connections except for any defined exceptions or for NAT forwarding. But for outgoing connections it allows all connections except for any defined exceptions. So what I've done is define an exception for outgoing connections to the IP address. Will that achieve what I want? – Gary Jones – 2012-04-12T12:38:10.667
@GaryJones that should do it, please remember to mark the most helpful answer. – Joshua Drake – 2012-04-12T12:56:29.057
1
It's better to install a good firewall like Comodo Firewall. IP can be blocked via IPsec policy, however it will be hard to add more addresses and manage other rules. Also you may disable RDP as easiest way.
crea7or
Posted 2012-04-12T11:03:00.787
Reputation: 939
1@avirk That's to specify hostname to IP mapping on the local computer, for outgoing connections. He wants to block an external IP from connecting to his computer, an incoming connection and also a completely unrelated concept. – Bob – 2012-04-12T12:33:35.900
@Bob my apologies I misunderstand the question. – avirk – 2012-04-12T13:08:18.227