Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have found out that one IP address is trying to RDP to a machine.

I would now like to get XP to block all incoming connections from this IP address, and I am finding it very frustrating how difficult such a simple task could be.

How do I block incoming connections from one IP address?

share|improve this question
1  
@avirk That's to specify hostname to IP mapping on the local computer, for outgoing connections. He wants to block an external IP from connecting to his computer, an incoming connection and also a completely unrelated concept. –  Bob Apr 12 '12 at 12:33
    
@Bob my apologies I misunderstand the question. –  avirk Apr 12 '12 at 13:08

3 Answers 3

You could use the Windows Firewall to block incoming connections on port 3389 from that IP.

share|improve this answer
    
Can you block individual IP address using Firewall in XP? –  Gary Jones Apr 12 '12 at 11:22
    
yes, that should be possible. I just tested on my Windows 7 and if I add a custom firewall rule I'm able to specify the incoming IP. On Win XP the UI is a bit different, but it should allow it. Have a look at support.microsoft.com/kb/843090 - you can specify firewall exception based on IP address. –  w0lf Apr 12 '12 at 11:31
    
Specifying an exception on the basis of IP address wouldn't work because I want to exclude one address. The exceptions need to either allow all addresses or a set of specified addresses. There is no way to exclude just one address. –  Gary Jones Apr 12 '12 at 12:08
    
You could turn this into an ALLOW rule. For example: ALLOW all incoming conections on port 3389 from all IPs, except 192.168.bad.boy. PS: I think there should already be a predefined ALLOW rule in the firewall that allows RDP, otherwise it wouldn't work. You could tweak it to add the exception. –  w0lf Apr 12 '12 at 12:19
    
There doesn't seem to be way in the XP firewall to have an exception like this. The only way seems to be to open up a port to either all addresses or to a set of addresses. –  Gary Jones Apr 12 '12 at 12:40

It's better to install a good firewall like Comodo Firewall. IP can be blocked via IPsec policy, however it will be hard to add more addresses and manage other rules. Also you may disable RDP as easiest way.

share|improve this answer

If an inbound connection is getting through your router/modem, it is already a potential threat to other systems on your network, or will be some time, once it detects a hole in your infrastructure.

Unless you have a very old hardware or a modem, I'd suggest first trying to block the IP on the firewall settings of your router.

Enter your administrative web frontend of your router (see manual for standard login and IP) and enter the IP to be blocked in there.

If this should fail, then install/configure the Windows Firewall on your XP and do as this page says.

Precision strike
If your router is asking for an ip address AND a subnet mask to it:
Subnet masking is for defining an IP range based on how many bits are to be allowed beginning from the right side of the IP address. In order to cater for a single IP address, the address mask is 255.255.255.255 or /32, depending on notation. If you need to define a range, study the WIKI page.

Carpet-bombing
Block all incoming connections - This is already the default on most routers, when filtering is activated. Then you can allow for selected IP addresses/ranges one by one.

share|improve this answer
    
I had a look at IP filtering on the modem but I didn't know what subnet mask to put for the source and destination IPs. –  Gary Jones Apr 12 '12 at 11:59
    
Subnet masking is for defining an IP range based on how many bits are to be allowed beginning from the right side of the IP address. In order to cater for a single IP address, the address mask is 255.255.255.255 or /32, depending on notation. If you need to define a range, study this page: en.wikipedia.org/wiki/IPv4_subnetting_reference –  Bora Apr 12 '12 at 12:12
    
Subnet mask is the same for ANY single IP address, which is 255.255.255.255 –  Bora Apr 12 '12 at 12:23
    
Interesting thing about my modem is that it blocks all incoming connections except for any defined exceptions or for NAT forwarding. But for outgoing connections it allows all connections except for any defined exceptions. So what I've done is define an exception for outgoing connections to the IP address. Will that achieve what I want? –  Gary Jones Apr 12 '12 at 12:38
    
@GaryJones that should do it, please remember to mark the most helpful answer. –  Joshua Drake Apr 12 '12 at 12:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.