Click here to get back home

Blocking Specific IP Addresses

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Blocking Specific IP Addresses IndyMcDuff 07-18-2006
Posted by IndyMcDuff on July 18, 2006, 12:37 pm
Please log in for more thread options
I run a server so that family can access files. I am continually being
plagued by people trying to get in, most often people who use programs to try
to 'guess' a user name or a pw. Most will try 'administrator'.
However, these tries can go on and build huge files in my log files, so I
can track them down.
How, specifically, do I use IIS to go in and block these IP's?



Posted by Miha Pihler [MVP] on July 18, 2006, 1:09 pm
Please log in for more thread options
Hi,

If I understand correctly you are sharing your files via IIS?

If so, you can set up IP addresses that are allowed access to your server
and deny all others. This will work well as long as IP addresses don't
change often.

After you open properties of the website in IIS MMC click on Directory
Security tab. Now click on Edit button next to "IP address and domain name
resolutions". Here click in radio button "Denied access". Now click on Add
button to add all the IP address that you would like to grant access to IIS.

If you would just like to block certain IP address then leave selected radio
button "Grant Access" and click on Add button. Now add all the IP addresses
that you would like to block.

I hope this helps,

--
Mike
Microsoft MVP - Windows Security

>I run a server so that family can access files. I am continually being
> plagued by people trying to get in, most often people who use programs to
> try
> to 'guess' a user name or a pw. Most will try 'administrator'.
> However, these tries can go on and build huge files in my log files, so I
> can track them down.
> How, specifically, do I use IIS to go in and block these IP's?
>
>



Posted by IndyMcDuff on July 18, 2006, 1:40 pm
Please log in for more thread options
Thank you for your reply. But my family members' addresses are not static.
They are on cable, thus change. AND, we all use AirCard when away. In fact,
I like to access my own FTP when away.

What I see, through my logs, is that particular people in China, and a lot
of @home users try to barge in. THAT is what I would like to stop. I tried
it, but screwed up and now have to restore from Ghost.

So, basically, what I want to do is block these people (yes I do have user
names and long, complicated passwords for my FTP family) from attempting.
That is to say, the 'known offenders'.

Indy


"Miha Pihler [MVP]" wrote:

> Hi,
>
> If I understand correctly you are sharing your files via IIS?
>
> If so, you can set up IP addresses that are allowed access to your server
> and deny all others. This will work well as long as IP addresses don't
> change often.
>
> After you open properties of the website in IIS MMC click on Directory
> Security tab. Now click on Edit button next to "IP address and domain name
> resolutions". Here click in radio button "Denied access". Now click on Add
> button to add all the IP address that you would like to grant access to IIS.
>
> If you would just like to block certain IP address then leave selected radio
> button "Grant Access" and click on Add button. Now add all the IP addresses
> that you would like to block.
>
> I hope this helps,
>
> --
> Mike
> Microsoft MVP - Windows Security
>
> >I run a server so that family can access files. I am continually being
> > plagued by people trying to get in, most often people who use programs to
> > try
> > to 'guess' a user name or a pw. Most will try 'administrator'.
> > However, these tries can go on and build huge files in my log files, so I
> > can track them down.
> > How, specifically, do I use IIS to go in and block these IP's?
> >
> >
>
>
>

Posted by Miha Pihler [MVP] on July 18, 2006, 1:53 pm
Please log in for more thread options
Sorry -- but there is no easy way of doing that. If you want to block these
IP addresses, you will have to build your own list from your log files.
Another option is to change logging options to log less information. That
will make your log files smaller...

--
Mike
Microsoft MVP - Windows Security

> Thank you for your reply. But my family members' addresses are not
> static.
> They are on cable, thus change. AND, we all use AirCard when away. In
> fact,
> I like to access my own FTP when away.
>
> What I see, through my logs, is that particular people in China, and a lot
> of @home users try to barge in. THAT is what I would like to stop. I
> tried
> it, but screwed up and now have to restore from Ghost.
>
> So, basically, what I want to do is block these people (yes I do have user
> names and long, complicated passwords for my FTP family) from attempting.
> That is to say, the 'known offenders'.
>
> Indy
>
>
> "Miha Pihler [MVP]" wrote:
>
>> Hi,
>>
>> If I understand correctly you are sharing your files via IIS?
>>
>> If so, you can set up IP addresses that are allowed access to your server
>> and deny all others. This will work well as long as IP addresses don't
>> change often.
>>
>> After you open properties of the website in IIS MMC click on Directory
>> Security tab. Now click on Edit button next to "IP address and domain
>> name
>> resolutions". Here click in radio button "Denied access". Now click on
>> Add
>> button to add all the IP address that you would like to grant access to
>> IIS.
>>
>> If you would just like to block certain IP address then leave selected
>> radio
>> button "Grant Access" and click on Add button. Now add all the IP
>> addresses
>> that you would like to block.
>>
>> I hope this helps,
>>
>> --
>> Mike
>> Microsoft MVP - Windows Security
>>
>> >I run a server so that family can access files. I am continually being
>> > plagued by people trying to get in, most often people who use programs
>> > to
>> > try
>> > to 'guess' a user name or a pw. Most will try 'administrator'.
>> > However, these tries can go on and build huge files in my log files, so
>> > I
>> > can track them down.
>> > How, specifically, do I use IIS to go in and block these IP's?
>> >
>> >
>>
>>
>>



Posted by IndyMcDuff on July 18, 2006, 2:17 pm
Please log in for more thread options
It need not be easy. I don't mind having the large log files, I can delete
them. I just want to block those IP's to discourage wasting my bandwidth.

All I need to know is the correct way to do it. The one way that you
mentioned:

If you would just like to block certain IP address then leave selected
>> radio
>> button "Grant Access" and click on Add button. Now add all the IP
>> addresses
>> that you would like to block.
>>
is something I will try when I have restored with Ghost (in the process).
Gad, I love Ghost 10. :) Can't tell you the number of times it has 'saved my
hide'! But then again, I am religious about backing up, plus scheduling
after each change. Can slow one down, but worth it.

Indy


"Miha Pihler [MVP]" wrote:

> Sorry -- but there is no easy way of doing that. If you want to block these
> IP addresses, you will have to build your own list from your log files.
> Another option is to change logging options to log less information. That
> will make your log files smaller...
>
> --
> Mike
> Microsoft MVP - Windows Security
>
> > Thank you for your reply. But my family members' addresses are not
> > static.
> > They are on cable, thus change. AND, we all use AirCard when away. In
> > fact,
> > I like to access my own FTP when away.
> >
> > What I see, through my logs, is that particular people in China, and a lot
> > of @home users try to barge in. THAT is what I would like to stop. I
> > tried
> > it, but screwed up and now have to restore from Ghost.
> >
> > So, basically, what I want to do is block these people (yes I do have user
> > names and long, complicated passwords for my FTP family) from attempting.
> > That is to say, the 'known offenders'.
> >
> > Indy
> >
> >
> > "Miha Pihler [MVP]" wrote:
> >
> >> Hi,
> >>
> >> If I understand correctly you are sharing your files via IIS?
> >>
> >> If so, you can set up IP addresses that are allowed access to your server
> >> and deny all others. This will work well as long as IP addresses don't
> >> change often.
> >>
> >> After you open properties of the website in IIS MMC click on Directory
> >> Security tab. Now click on Edit button next to "IP address and domain
> >> name
> >> resolutions". Here click in radio button "Denied access". Now click on
> >> Add
> >> button to add all the IP address that you would like to grant access to
> >> IIS.
> >>
> >> If you would just like to block certain IP address then leave selected
> >> radio
> >> button "Grant Access" and click on Add button. Now add all the IP
> >> addresses
> >> that you would like to block.
> >>
> >> I hope this helps,
> >>
> >> --
> >> Mike
> >> Microsoft MVP - Windows Security
> >>
> >> >I run a server so that family can access files. I am continually being
> >> > plagued by people trying to get in, most often people who use programs
> >> > to
> >> > try
> >> > to 'guess' a user name or a pw. Most will try 'administrator'.
> >> > However, these tries can go on and build huge files in my log files, so
> >> > I
> >> > can track them down.
> >> > How, specifically, do I use IIS to go in and block these IP's?
> >> >
> >> >
> >>
> >>
> >>
>
>
>

Similar ThreadsPosted
IPSec - allowing access to specific ports on specifc IP addresses March 11, 2008, 4:27 pm
Blocking IP Addresses-Tagged server June 15, 2008, 9:21 pm
network filetering my range of IP addresses July 29, 2005, 11:23 am
Specific permission to add new contacs April 9, 2008, 7:42 am
Deny Specific Subnet Access to DC July 17, 2006, 4:06 pm
allow start/stop a specific service through GPO November 14, 2006, 8:37 am
Exclude Specific Groups From Auditing? February 14, 2008, 8:39 am
Enabling EFS to a specific group of pc's July 19, 2008, 12:57 pm
AppCompat, TLB invalidation, CPU specific issues vs. security? May 12, 2008, 7:25 pm
How to non-trusted users write files to specific location December 15, 2005, 3:42 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap