Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Basically as the title says I would like to be able to lockdown the internet through DNS settings on Windows Server 2008 R2 - preferably I would lock down everything and then just have a 'whitelist' of certain ip addresses / domain names - is this possible?

It can be done via the router, but I think due to the number of users we have on our network (50+) it struggled with the workload, so any help with getting the server to do the legwork rather than the router would be much appeciated, thanks.

share|improve this question
Does it have to be done via DNS or can it be done via the firewall? – Dave Aug 7 '12 at 11:55
Actually either method would be great, just based on my limited experience with servers et al I thought DNS would be the way to go – Keir Lavelle Aug 7 '12 at 11:57
up vote 3 down vote accepted

By firewall:

  1. Log into your server via Remote Desktop Connection.
  2. Start -> administrative tools > windows firewall with advanced security.
  3. On the left side of the firewall window click on the inbound rules option.
  4. On the right side of the screen click on New Rule.
  5. Click on the custom radio button and then click next.
  6. Make sure the All programs radio is selected then click next.
  7. On the protocol and ports options leave everything at its defaults and click next.
  8. On the scope screen you will see two boxes the top one is for local IP addresses and the bottom is for remote IP addresses. In this scenario we are trying to block an outside (remote) IP from accessing anything on the server so we will need to add the IP address to this section only as it will not be a local IP address.
  9. Click on the radio that says “these IP addresses ” in the remote section as shown below:
  10. Click on the Add button.
  11. In the next window we will be adding a single IP address to the rule, you can also add an entire range at this point if you wish.
  12. Click ok, click next.
  13. Make sure you select the Block the connection radio on the next screen and then click next.
  14. Leave all of the options on the next screen checked this will be sure to block the IP no matter the connection they are trying to use. Click next.
  15. Name the rule on the next screen something you can remember in case you wish to remove or edit it in the future. Click finish and that's it.


By DNS (which looks more fiddly) (Sorry to send you away but there is so much content on each I can't copy the answer)

share|improve this answer
Very simple - even I could do it! lol - thank you – Keir Lavelle Aug 7 '12 at 12:16
And how would you whitelist via the DB as thats what the OP asked aswell? – Vinzenz Jul 27 '15 at 17:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.