Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here's the problem. I have two network connections on my DEV machine.

LAN - Connects to the building network and internet. IP is assigned by DHCP and is 192.168.30.XX.

LOCAL - Connects to a switch, which has one TEST machine. IP is And the test machine is at

Right now I remotely reboot the TEST machine, then ping to see when it's come back up.

Problem is, yesterday someone (probably accidentally) added a machine to the building LAN that has an IP of, so now when my TEST machine is rebooted and I ping for it, I get a response from this remote machine on the LAN, my software thinks the TEST machine is back up, and tries to log in. This obviously fails, because it's not the TEST machine responding, and it's still mid-reboot.

My question is, how do I either:

  1. prevent all requests for from going out over LAN, or
  2. force all requests for to go out over LOCAL

UPDATE: I think the best solution would be to modify the routing table so that packets to are blocked over one interface, and statically routed over the other.

Thing is, while I can add a static route using this:

route add mask

But Windows will still automatically fail back to the LAN and attempt to ping there if that static route fails.

Is there a way of blocking traffic to a specific interface or gateway within the routing table?

share|improve this question

migrated from Apr 30 '12 at 12:10

This question came from our site for professional and enthusiast programmers.

Can you be more specific, are both interfaces configured with a netmask of /24 ( and does your DEV machine receive a default route through DHCP on the LAN interface? – zero0cool Apr 28 '12 at 15:35
What operating system does DEV run, please? – thb Apr 28 '12 at 15:36
Unfortunately I just lost my VPN, so I can't check at the moment. But I'm pretty certain that both connections have a mask. I'll check the default route. And the DEV machine is running Win7. – static416 Apr 28 '12 at 16:55
The solution would be to assign the TEST machine some other ip address that is unlikely to be used by anyone say – Ramhound Apr 30 '12 at 14:14
@Ramhound probably best to avoid anything near a broadcast address, especially if people are plugging different devices into the network. – HaydnWVN Apr 30 '12 at 14:55

Not sure why I didn't think of this earlier, but the simplest solution is to just create a custom rule within the windows firewall to block connections to/from the specified IP, on a certain interface or connection type.

UPDATE: Doesn't really solve the problem either. This just causes pings to come back as "General Failure", rather than as a timeout or destination unreachable. "General failure" causes an exception in C#, and I'd have to write a handler to catch it.

Again, I COULD write an exception handler, but that isn't very elegant.

share|improve this answer

If someone 'added a machine' onto the network and gave it a static IP address outside of the DHCP scope then they're probably experiencing other problems too... Not being able to connect to Printers/other machines/other odd problems due to being on a different subnet. Find out who this person is and setup their PC correctly (ie on DHCP!).

Check your server that the DHCP scope is set correctly, then see if there is a lease for the 'rogue' PC. Expire it if found. Then add DHCP exceptions for your PC's you want to use on a different subnet, if they are not already present. Might be a good idea to flush the DNS on the server after doing any of this too.

IF you're not the network administrator then get them involved - people shouldn't be setting up PC's on your network if they don't know how to do it!

As you've already figured out - best way to block an IP address is to add it into the Firewall, you could also add exceptions into the Firewall too...

share|improve this answer
Yeah, this is sort of the problem. Our company builds network-connected devices. When built, all of these devices default to the IP If someone in marketing connects one to the wrong ethernet port, it shows up throughout the whole building. – static416 Apr 30 '12 at 15:03
So I need a sustainable way of dealing with this problem, cause it's going to happen constantly. I need to be able to block packets with a certain destination IP from going out over a specific connection. – static416 Apr 30 '12 at 15:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .