Block a list of IP's to Windows Firewall's outbound connection from CMD

Discussion in 'Scripting' started by ceo54, Nov 30, 2019.

  1. ceo54

    ceo54 MDL Addicted

    Aug 13, 2015
    867
    361
    30
    Hi,

    I'm looking for a cmd or batch script to be able to add a list of IP addresses to block the outbound connection through Windows firewall.

    Any help will be greatly appreciated.

    Thanks
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,217
    84,884
    340
  3. ceo54

    ceo54 MDL Addicted

    Aug 13, 2015
    867
    361
    30
    @abbodi1406 Thanks. Can I use the Ip's as a downward list instead of a aligned list ?

    Example:
    65.52.98.231,
    65.52.98.232,
    65.52.98.233
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,217
    84,884
    340
    No

    you can use this workaround:
    Code:
    set ips=^
    65.52.98.231,^
    65.52.98.232,^
    65.52.98.233
    
    netsh advfirewall firewall add rule name="KMSBLOCK" protocol=any dir=out remoteip=%ips% action=block
     
  5. ceo54

    ceo54 MDL Addicted

    Aug 13, 2015
    867
    361
    30
    Oh! how am I gonna add ^ at the end of a very long list that needs editing every so often. I understand there's a way to easily batch rename the files but not when when the last digit is different with every server address.

    Thank you for the support. Highly appreciated.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,217
    84,884
    340
    Try Notepad3 or Notepad++

    if the list is simple text file, you can use this batch to set the required IPs
    Code:
    @echo off
    reg query HKU\S-1-5-19 >nul 2>nul || goto :eof
    setlocal EnableDelayedExpansion
    cd /d "%~dp0"
    for /f "tokens=* delims=" %%a in (list.txt) do (
    if defined _ips (set "_ips=!_ips!,%%a") else (set "_ips=%%a")
    )
    netsh advfirewall firewall delete rule name="IPsBlock" 2>nul
    netsh advfirewall firewall add rule name="IPsBlock" protocol=any dir=out remoteip=%_ips% action=block
    pause
     
  7. ceo54

    ceo54 MDL Addicted

    Aug 13, 2015
    867
    361
    30
    #7 ceo54, Nov 30, 2019
    Last edited: Nov 30, 2019
    (OP)
    @abbodi1406 you're a life saver. Thank you.

    Just one last think. Where should I put my list ? I tried putting it in the same directory as "list.txt" but the batch gave an error that one or other rule does not meet the criteria. I'm not placing the list in the right place. Place help me just this once. And thanks again.

    [​IMG]
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,217
    84,884
    340
    How the list.txt look like? it should like this
    Code:
    65.52.98.231
    65.52.98.232
    65.52.98.233
     
  9. ceo54

    ceo54 MDL Addicted

    Aug 13, 2015
    867
    361
    30
    Yes, that's exactly how it looks like. I can PM you the list if you like.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. ceo54

    ceo54 MDL Addicted

    Aug 13, 2015
    867
    361
    30
    #10 ceo54, Nov 30, 2019
    Last edited: Nov 30, 2019
    (OP)
    Okay the error went away. Had a few empty lines at the start of the list but I can still access the IP I had in the list, they're not blocked. I shouldn't get a reply from ping.

    Update: Batch from @abbodi1406 is working as intended.

    Thanks man, highly appreciated.

    What happens if I run this again ?

    I keep adding entries to this list, what will happen to the older ones ?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,217
    84,884
    340
    The script delete the firewall rule before adding the updated list again
     
  12. ceo54

    ceo54 MDL Addicted

    Aug 13, 2015
    867
    361
    30
    Understood, a million thanks bud :)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  13. niceman28

    niceman28 MDL Novice

    Jan 25, 2020
    8
    3
    0
    you can use a malwarebyte firewall rule and block ip list etc