I've got a port exception that I've added to Windows Firewall. And under Scope, I'm able to add specific IP addresses allowed, each separated by a comma. The problem is, how can I enter a range of IPs?

I don't mean kind of thing. I have a user who's IP keeps changing, and they're located in Austria. Their IP is always 91.113... I'd basically like to allow that.

Or, is there a better solution? I'm not keen about opening up such a wide range of IPs but his IP is changing daily and is really frusterating for everyone. Our dynamic IP here at the office in Canada only changes every 4 months, so I was hoping that it wouldn't be a big deal to restrict.

Thanks for the insights.


You're right that it's not the best solution however if you need something quick and dirty then you could try a wildcard, for example 91.113.*.*

  • thanks Marko I'll use that until I can solve it more appropriately with something like DynDNS. – Scott Klarenbach Sep 16 '09 at 16:52
  • I get a "Format Not Valid" message when trying to implement wildcards. – Scott Klarenbach Sep 16 '09 at 17:09
  • if it's always 91.113.*.* you can use – Daniel Dec 17 '09 at 15:27

Maybe you could get him set up with DynDNS which can use the router or a program installed on one of his computers (if the router doesn't natively support DynDNS)to keep a DNS name of his dynamic IP always updated. For instance, I use DynDNS for a small client of mine (using their simple LinkSys WRT54G that has DynDNS support built in) and I always know that smallclient.DynDNS.org (not actual domain name) is their IP. You could then do a reverse query every morning on the DNS name that you set up for him and have his true IP address. I'm sure it could be scripted on your server to reverse query that domain name, add the proper IP exception and scrub the old exception every 12 or 24 hours.

Kinda slipshod... but then isn't that what most IT projects end up being anyway? =)


I hope I don't talk nonsense now, but wouldn't be a correct notation? It's of course not the "real" range, but should cover your needs.


I'd be wary about opening a range of addresses, especially since they are public addresses doled out to anyone who uses the same ISP. What are the chances of getting a static address from the ISP?

  • unfortunately a static ip is not avail. – Scott Klarenbach Sep 16 '09 at 16:51

There is certainly a better solution; don't base your security on IP addresses, try to find something else - a certificate token, username/password, ...

For the situation as is I see no other solution as playing with dynamic DNS as already suggested, or opening your firewall a lot - to cover all possible IPs you need. This is where you should ask yourself if it's worth; what security you still have then?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.