I'm trying to block specific ips from connecting to my service. Some poeple are attacking my services and I was hoping to automatically ban their IP when I detect the attack. Here is how I'm implementing it:
command is netsh advfirewall firewall delete rule name="packet flooder 172.20.10.9" remoteip=172.20.10.9
Deleted 2 rule(s).
Ok.
command is netsh advfirewall firewall add rule name="packet flooder 172.20.10.9" dir=in action=block remoteip=172.20.10.9
Ok.
command is netsh advfirewall firewall add rule name="packet flooder 172.20.10.9" dir=out action=block remoteip=172.20.10.9
Ok.
I'm testing this with an attacker on my PC, attacking the service on my PC. Unfortunately the attack still goes through after getting detected and the rules enabled.
I was expecting that once the attack is detected and the rules are added to the firewall the next attack wouldn't work but that isn't the case.
My service has a rule to allow all incoming connections to it.
What am I doing wrong? Why doesn't it work? Is it because I'm testing it both locally? (the service and the attacker) Is it because I've already allowed all incoming connections that its not honoring the block specific IP? Is it because I'm deleting the rule before creating it? (I'm trying to make sure its not duplicated)
I'm using the latest windows server.
UPDATE
