Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running "IP Security Policy Managment" to block ip addresses.

Is it possible to create a new filter by using the console or by using win32 api? I would like to automate the process from my application.

share|improve this question
i would try this on StackOverflow as it's more suited there (with more programmers that may know how to do that) – MadBoy Oct 21 '10 at 20:32
up vote 4 down vote accepted

The netsh tool in the ipsec context will do what you're looking for. Have at look at Microsoft's reference for detailed information.

In the the ipsec dynamic context of netsh you can apply rules on-the-fly (which won't be made persistent), or you can use the ipsec static context to make changes to the persistent configuration (which aren't applied immediately). You can create rules and filter lists and manipulate the ipsec policy exactly like you would from the GUI. It's really very handy.

I suspect that you'll be able to figure it out since you're already familiar with all the terminology in the GUI, which is virtually the same in the command-line interface. Here's a short example creating a policy (not active), a filteraction (block), a filterlist, adding a filter to that filterlist (any source, destination me, ICMP), and adding a rule to the policy.

netsh ipsec static add policy name=MyPolicy

netsh ipsec static add filteraction name=MyFilteraction action=block

netsh ipsec static add filterlist name=MyFilterlist

netsh ipsec static add filter filterlist=MyFilterlist srcaddr=any dstaddr=me protocol=ICMP

netsh ipsec static add rule name=Rule1 policy=MyPolicy filterlist=MyFilterlist filteraction=MyFilteraction

share|improve this answer
Are there any alternatives for windows xp? – jgauffin Oct 31 '10 at 20:25

wipfw is a BSD-licensed Windows port of ipfw from FreeBSD. If I would be you, I would study its code and eventually reuse it in my application.

share|improve this answer

This should be possible with netsh firewall or with netsh ipsec; unfortunately, I have never really used these commands, so I cannot help you any further. As always, you can get the help screens using netsh <command> /?.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.