Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server running Windows Server 2003. I want to only allow traffic from my IP address and block all other traffic from all other addresses. I'd like to know how to correctly configure this IP Security Policy using the MMC within Windows.

share|improve this question
Before you block all traffic you should keep in mind that this will also block all access to your domain controllers, the internet, etc. You'll be better off changing the ACLs on your router or your firewall to block access, then setup a VPN tunnel into the server so that you can connect securly. – mrdenny May 28 '09 at 1:16
That's what I'm looking for. It's a hosted VPS and I need to connect to it from only my machine, so I intentionally want it blocked from the internet except for my connections. Unfortunately I don't have access to the router or firewalls as it's hosted by a third party. – The Matt May 28 '09 at 1:18
They can't setup these rules for you? That's a much more secure way to go. I can't provide ipsec directions as I do everything at the firewall level. – mrdenny May 28 '09 at 1:22
up vote 4 down vote accepted

Best place to start is at the Microsoft TechNet IPsec page. It's fairly simple to set up a local IPsec policy that will accept packets from a single address only. I think you'll need two rules:

Rule 1

  • Filter list with one filter: from any-address:any-port to my-address:any-port
  • Filter action: block Rule: link the list with the action; all interfaces; no tunnel; any authentication method

Rule 2

  • Filter list with two filters: from your-workstation-address:any-port to my-address:any-port
  • Filter action: permit
  • Rule: link the list with the action; all interfaces; no tunnel; any authentication method
share|improve this answer
Perfect! Those rules worked great. Thank you. – The Matt May 28 '09 at 2:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.