up vote 3 down vote favorite
3
share [g+] share [fb]

I have a server running Windows Server 2003. I want to only allow traffic from my IP address and block all other traffic from all other addresses. I'd like to know how to correctly configure this IP Security Policy using the MMC within Windows.

link|improve this question
100% accept rate
Before you block all traffic you should keep in mind that this will also block all access to your domain controllers, the internet, etc. You'll be better off changing the ACLs on your router or your firewall to block access, then setup a VPN tunnel into the server so that you can connect securly. – mrdenny♦ May 28 '09 at 1:16
That's what I'm looking for. It's a hosted VPS and I need to connect to it from only my machine, so I intentionally want it blocked from the internet except for my connections. Unfortunately I don't have access to the router or firewalls as it's hosted by a third party. – The Matt May 28 '09 at 1:18
They can't setup these rules for you? That's a much more secure way to go. I can't provide ipsec directions as I do everything at the firewall level. – mrdenny♦ May 28 '09 at 1:22
feedback

1 Answer

up vote 3 down vote accepted

Best place to start is at the Microsoft TechNet IPsec page. It's fairly simple to set up a local IPsec policy that will accept packets from a single address only. I think you'll need two rules:

Rule 1

  • Filter list with one filter: from any-address:any-port to my-address:any-port
  • Filter action: block Rule: link the list with the action; all interfaces; no tunnel; any authentication method

Rule 2

  • Filter list with two filters: from your-workstation-address:any-port to my-address:any-port
  • Filter action: permit
  • Rule: link the list with the action; all interfaces; no tunnel; any authentication method
link|improve this answer
Perfect! Those rules worked great. Thank you. – The Matt May 28 '09 at 2:50
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.