For anyone looking for an program that will create the IPSEC policy, filters, etc and automatically scan the event log and add IP's to the block list, I've written a small program that does just that.
As a web hosting provider my customers need external access to my SQL Server instance. I too had the problem where my event log would be filled with thousands of entries for hackers attempting to login to my MSSQL instance with the 'sa' login. After much searching, I decided to write my own program, have it create the neccessary IPSEC items, and then scan the event log every 60 seconds for attacks from new IP addresses. It then adds the IP address to the IPSEC filter, and blocks all traffic to and from the IP. I have only tested this on Windows Server 2008, but believe it will work on other versions as well. As a side note you may need to run it with administrator privileges so that it has the correct permissions to access the event log and to create IPSec policies and filters.
Feel free to download the program using the link below. Donations are always appreciated using the link in the right-click menu of the taskmanager icon.
Please note that this only works for SQL login attempts using the 'sa' login, but I could modify it to work for other log events as well. Also, you can view the IP's that have been blocked, but you will continue to see some items in the event log since the program only runs every 60 seconds. This is due to not being able to delete a single event log entry, and I didn't think deleting the entire log would be a good idea. As a result you will need to clear the log manually on ocassion. If needed I do have a version that archives the log file after 5,000 entries and then clears it. I found that this helps in CPU utilization since the app doesn't have to keep processing the same event log entries on each run.
DISCLAIMER - By downloading and installing the above-mentioned program, you agree to hold me harmless for any damage, loss of data, corruption, or any other functionality issues resulting from the use of said software. I have tested the program to the best of my ability and currently have it running on 2 servers, but you have been warned to use at your own risk.