Command to block an IP range using IPSEC

Question

I think there is command with netsh .... But not sure about the exact command.

Answer 1

You can do something like this in Windows 2003 or newer OS's to add a policy, a filter list, and an entry to that filter list:

netsh ipsec static add policy name="Prevent TELNET Servers" description="Prevents running TELNET servers"
netsh ipsec static add filter filterlist="My filter list" srcaddr=any srcport=0 dstaddr=me dstport=23 protocol=tcp mirrored=yes

You can use "dstmask" and "srcmask" to specify ranges of IP addresses. Bear in mind that you'll have to actually assign that policy if you want it to do anything.

Some background on using NETSH and IPSEC is available at Microsoft at: http://technet.microsoft.com/en-us/library/cc739550(WS.10).aspx

On XP machines you'll use the IPSECCMD.EXE utility, available from the Windows 2000 resource kit.