Bulk import IPs into your Windows Server 2008 R2 Firewall

Posted on Feb 4, 2011 by Paul White

UPDATE 8/5/2012
I recently noticed that the IPDENY.com website was down, not sure if this is temporary, or not, but I went ahead and rewrote my script to use a different free IP to COUNTRY database. This article has been updated for the new script.

If you are like me you take server security very seriously. You lock down all your ports, and you even firewall IPs that try to use exploits. But eventually you determine that non of your clients do business in China or Russia, and its easier to just block those countries, rather than trying to block individual IPs. Well this brings another problem. Windows Server 2008 R2 has no user friendly way to do a bulk import of IPs. Luckily I found a VB script that you can run and it will automatically add the IP blocks you want to block.

Why block country IP blocks

Most of the world's comment spam and hacker attacks come from Russia, Ukraine, China, India. If your websites have no customers in those countries then there is no reason to let them in. IT specialists are very well aware of the growing Firewall between the western world and other countries. comment spam and hacker attacks don't usually originate from USA IPs because ISPs are usually very quick to shut them down. But when its in another country, things don't move as fast. This had lead to server administrators to block entire IP blocks right at the firewall.

Before I get started, I want to give credit to the original author
Steve on Alcoholiccustard.co.uk did an excellent job on the original script
I simply took what he did and expanded it just a little for my own purposes.

How do you we get Country IP Blocks?

Easy, there is a website called ipinfodb.com which lists out all the various countries and their IP blocks. What is great is they give you the option of listing them out by RAW text, IP Tables, or Apache HTACCESS ( Allow or Deny ). Using the IP Tables option I wrote a script to easily import them.

Modifications to the original Script

The original script was setup to block various remote IPs from all local IPs on Port 80 ( HTTP ) and Por 443 ( HTTPS ). I modified the script to also include the specified local IPs that need to be protected. I did this because when you have a serve with 50+ websites, and each website has its own IP, some of those websites might not want to block foreign countries. Also the original script blocked Japan, but I see Ukraine as more of a threat than Japan. The original script also is setup to only store 200 remote IPs into a single rule. I tried to up this to 500, but got errors on a few files, so I took it back to the 200 he recommended.

Important lines of code

Below there is a line of code the specifies the Local IPs this Firewall rule is supposed to affect.
serverIPs = "yourFirstIP,yourSecondIP,yourThirdIP"
just update this with the actual IPs you want to protect with a comma between each IP.
You can also use blocks( 123.123.123.123/8) and ranges (123.0.0.0-123.255.255.255)
Just be sure to add a comma between each IP / block / range

Just take the code below copy and paste it into a blank text document ( update the code to specify your IPs ), save it and then change the extension from .txt to .vbs Then double click on it. You will see a series of command prompt windows open and close this is normal. Each time is adding a new rule to your firewall. This script should work on both Windows 7 and Windows Server 2008 R2. This script will not work in Windows XP, Server 2003, Vista, or Server 2008

Bulk Import IPs into Windows 7 and Windows Server 2008 R2 Firewall Script

The following script is what I run on my server, be sure to change the IPs to match your server, and add / remove countries to the list. You might notice I don't enable this on all my IPs, as some of my clients do want to get traffic from China / India.

'########################################################################
' netsh advfirewall firewall - Details on the command here: http://technet.microsoft.com/en-us/library/dd734783(WS.10).aspx
' To be run on Windows Vista/7/Server 2008/2008R2 only
' IP data supplied by ipdeny.com
'########################################################################

Dim objShell
set objShell=CreateObject("Wscript.shell")

'########################################################################
' This URL has the IP lists
'########################################################################

objURLpre = "http://ipinfodb.com/country_query.php?country="
objURLpost = "&output=iptables&filename=blocklist.txt"

'########################################################################
'Firewall Rule
'########################################################################

rulename = "AllSites HTTP "

'########################################################################
'Local IPs to Protect
'list all IPs that you want to protect
' format them as either single IPs, 123.123.123.123
' IP blocks, 123.123.123.123/24
' IP ranges, 123.0.0.0-123.255.255.255
' with a comma separating them
'########################################################################

serverIPs = "199.119.176.70-199.119.176.126,199.119.177.2-199.119.177.11,199.119.177.13-199.119.177.28"

'########################################################################
'Remote IPs per Rule, Its recommended to keep this at 200
'You can try higher numbers, but the script might error on you
'########################################################################

percommand=200

'########################################################################
'Zone files to pull from
'If there are countries not listed here, visit ipdeny.com, to add them
'########################################################################

Dim arrayzone(22)
arrayzone(0) = "AF" 'Afghanistan
arrayzone(1) = "CN" 'China
arrayzone(2) = "DZ" 'Algeria
arrayzone(3) = "HK" 'Hong Kong
arrayzone(4) = "IN" 'India
arrayzone(5) = "IQ" 'Iraq
arrayzone(6) = "KZ" 'KAZAKHSTAN
arrayzone(7) = "NG" 'Nigeria
arrayzone(8) = "PA" 'Panama
arrayzone(9) = "RU" 'Russia
arrayzone(10) = "RO" 'Romania
arrayzone(11) = "UA" 'Ukraine
arrayzone(12) = "TW" 'Taiwain
arrayzone(13) = "ID" 'Indonesia
arrayzone(14) = "BG" 'Bulgaria
arrayzone(15) = "VN" 'Vietnam
arrayzone(16) = "SK" 'Slovakia
arrayzone(17) = "MD" 'Moldova
arrayzone(18) = "TR" 'Turkey
arrayzone(19) = "PH" 'Philippines
arrayzone(20) = "BR" 'Brazil
arrayzone(21) = "LV" 'Latvia

For each URL in arrayzone

 '########################################################################
 'Get IPs from the current zone
 '########################################################################

 Set objHTTP = CreateObject("Msxml2.XMLHTTP")
 objHTTP.open "GET", objURLpre & url & objURLpost, False
 objHTTP.send

 HTTPstatus = objHTTP.Status

 If HTTPstatus= "200" Then

 GetHTML = objHTTP.responseText

'########################################################################
 'Delete previous firewall rules with the same name
'########################################################################

 netshCommand = "NETSH advfirewall firewall delete rule name=" & chr(34) & rulename & " " & url & " Block" & chr(34)
 errorcode = objShell.Run(netshCommand, 1, true)

'########################################################################
 'wscript.echo errorcode 0 = good / 1 = bad
'########################################################################

 current = 0
 iplist = ""

iparray=Split(GetHTML, chr(10))

 For each ip in iparray

 If current = 0 Then
iplist = ip
current = 1
 Else 
iplist = iplist & "," &ip
current = current + 1
 End If

 '########################################################################
 'If we have reached our limit then push the rule to the firewall
 '########################################################################

 if current = percommand Then
netshCommand = "NETSH advfirewall firewall add rule name=" & chr(34) & rulename & " " & url & " Block" & chr(34) & " dir=In  action=Block Enable=yes profile=public,private,domain localip=" & serverIPs & " remoteip=" & ipList & " protocol=tcp"
 errorcode = objShell.Run(netshCommand, 1, true)
current = 0
iplist = ""
 End If

Next

'########################################################################
'Add any left over IPs
'########################################################################

if current > 0 Then
netshCommand = "NETSH advfirewall firewall add rule name=" & chr(34) & rulename & " " & url & " Block" & chr(34) & " dir=In  action=Block Enable=yes profile=public,private,domain localip=" & serverIPs & " remoteip=" & ipList & " protocol=tcp"
 errorcode = objShell.Run(netshCommand, 1, true)
End if


 Else
 wscript.echo "ERROR GETTING TO URL: " & URL
 End If

Next

wscript.echo "done"

I hope this helps everyone.

Windows Server 2008 R2, and Windows 7 Firewall High Memory Usage

Before you go off an run this script a dozen times ( one for each website ) You need to be aware of one very important fact. The windows Firewall normally is pretty conservative on memory usage. However The more rules you add to your firewall the more memory your firewall will consume. When you run this script it will add about 100 rules to your firewall. If you customize it for each site, you now have 60 rules for each site on your server. After setting up this script with about 6 sites, I noticed some issues. The first was one of my svchost.exe processes had grown to about 800 MB. This svchost.exe was registered with BFE ( Base Filtering Engine ), DPS ( Diagnostic Policy Service ), and MpsSvc ( Windows Firewall ). I noticed a direct connection between the number of firewall rules and the memory usage of svchost.exe. So if you are going to use this script to add firewall rules, I recommend you only make one set of rules for all your sites. Turns out the Windows Firewall is not a very efficient Process. If you do make separate rules, when you reboot your server, you might noticed that your svchost.ext is eating up an entire thread of CPU, plus continually growing in size. Mine grew to 1.4 GB of memory usage, before the CPU finally stopped, and then the memory usage dropped to 800 MB.

Turns out the problem was some of the rules on my firewall got corrupt. If you run into this problem go into your firewall and delete all the rules you imported. Then reboot. After rebooting check your taskmgr and make sure you don't have a scvhost.exe process that is running out of control. If you don't then all is clear, and you can start reimporting your firewall rules. If you do see it, just wait til its done running. Eventually ( might be 10 - 20 minutes ) it will settle down and you can load your firewall control panel. Delete some more rules and reboot again.

Remember that with any request made to your server, every block rule will be evaluated. So if you have 1000 block rules, every rule will be checked, and this can slow your server down a little. Even though I didn't notice any slow downs on my server ( Dual 3.6 Ghz Xeon ), there is bound to be a slight performance hit

If you run this with just a single set of rules, the memory usage will stay under 40 MB. So this is just a warning to anyone that decides they are going to setup a custom set of rules for every website on their server.

I have attached my original VBS file in a zip. Feel free to download and use this. Also you use this script at your own risk, I am not liable for any damages. Feel free to share this with others who might benefit. And please link to this article to help get the word out.

Discussion

name
Email	Needed to confirm comment, but not made public.
Website

	Email me when someone comments on this blog

When you Post your Comment, you'll be sent a confirmation link. Once you click this link your thoughts will be made public.. Posts that are considered spam will be deleted, Please keep your thoughts and links relavent to this Article