I've got a Powershell script that adds IP addresses trying to run brute force attacks on my server to a firewall rule that blocks them from accessing it. Recently it stopped working, and started throwing this error:

Exception setting "RemoteAddresses": "The array bounds are invalid. (Exception from HRESULT: 0x800706C6)"

Is there a limit to the number of IP addresses you can put in the Scope of a Windows Firewall rule? This is running on Windows Server 2008 R2.

3 Answers 3


Yes - the limit is 1000 entries total. A single IP addresses is counted as one entry if it's entered on it's own, or a range of IPs is counted as one entry if it's entered as one range.

In my case, deleting one of the IP addresses from the Scope of the above rule will allow the script to add it (or any other IP address) back to the Scope. The errors are thrown for every attempted entry over 1000.

As a workaround, once you get to 1000 entries in the current firewall rule, you can simply create a similar rule with a different Scope. It's not elegant, but it will get the job done.

  • This answer is not correct. See: superuser.com/questions/802355/…
    – Art
    Aug 30, 2014 at 16:37
  • @Art I'll double-check if this is still an issue next week, but as of when I wrote this, I'm 100% sure it was the case.
    – kevinmicke
    Aug 31, 2014 at 15:01
  • Check the answer in my question; the post in the MSDN forum is from one of the devs that works on Windows Firewall. I currently have 1500+ remote IPs in my filter and I can scroll the list just fine as well as add new ones both programmatically and via the GUI.
    – Art
    Aug 31, 2014 at 17:44
  • @Art I checked out your question, and just wrote a little Powershell script to check this. At least on my server, this limit of 1000 is correct. My script added through (1000 IPs) without issue, and then errored out on all of the ones after that. I then checked if I could add the 1001st IP via the GUI, and got this error message. Regardless of what anyone says on a forum, this is the reality on my server, so I believe my answer is correct. What version of Windows and Windows Firewall are you running where you could add more than 1000?
    – kevinmicke
    Sep 3, 2014 at 21:38
  • 1
    There seem to be different limits in different versions of Windows. I can easily add thousands of IP blocks to one rule in the current version of Windows 10, but the same script fails on a Windows 2008 R2 server. Aug 28, 2018 at 15:22

Limit is 1000, except for Server 2022 and Windows 11, the limit is now 10000.

This is from tests in code, it's hard to find any official documentation from Microsoft.

As a side note, if you are using the lower level windows filtering platform api's, I suggest not having more than 10000 conditions per condition type in a filter as I have been getting blue screen errors in Windows 11 when going beyond that. Explains why Windows Firewall in Windows 11 has a 10000 ip address count limit.


This is confusing since I know that Server 2003 allows thousands and thousands of entries in a single ipsec rule and I foolishly assumed 2008 and above also did.

I had received the same error and thought it was due to an overlap of adding a subnet that I had already added a single ip from the subnet and I spent a great deal of time going through the list until I found the overlapping ip, but when I continued to get the error on future ips and subnets I realized I needed to dig some more.

Years ago I had research as much as I could and found a number of articles that stated 2003 did not have a limit. In fact I have one production server that has over 20000 entries in a rule. (that is not a typo - it took years to get to tht number adding on average hundreds per month)

I am glad I found this article as it will save me a lot of time. I took the suggestion here and created a new rule and subnets that returned an error previously are fine in a new rule, so superuser answers a question for me once again.

It's too bad there is not an easy way to export and re-import single rules, the snapin appears to only allow all or none.

Probably a way to do it with powershell, but I guess that should be another question thread. If there happens to be a thread that covers that here, would appreciate the search string to look for or a link.

Edited to add: My OS is Server 2008 Standard x64 SP2

  • This does not answer the proposed question
    – Ramhound
    Sep 4, 2016 at 5:05
  • Please read the question again carefully. Your answer does not answer the original question.
    – DavidPostill
    Sep 4, 2016 at 7:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .