{"id":65,"date":"2016-02-28T17:28:35","date_gmt":"2016-02-29T01:28:35","guid":{"rendered":"http:\/\/www.gregsitservices.com\/blog\/?p=65"},"modified":"2017-03-23T00:11:06","modified_gmt":"2017-03-23T07:11:06","slug":"blocking-unwanted-countries-with-windows-firewall","status":"publish","type":"post","link":"https:\/\/www.gregsitservices.com\/blog\/2016\/02\/blocking-unwanted-countries-with-windows-firewall\/","title":{"rendered":"Blocking Unwanted Countries with Windows Firewall"},"content":{"rendered":"

I get a lot of clients asking me what they can buy for protecting themselves from countries they don’t want connecting to their office or home network since they have no business with these countries and the threat they pose in hacking.<\/p>\n

A simple and “zero cost” solution already exists with their Windows<\/strong> system. Windows Firewall<\/strong> can be used to solve this situation in a very easy manner using distributed country IP Tables<\/strong> and PowerShell<\/strong>.<\/p>\n

Below is a tutorial I wrote explaining the process:<\/p>\n

How to Block County IP’s in Windows Firewall with PowerShell<\/strong><\/span><\/h3>\n

Step 1<\/strong><\/span>: Create a directory for working with PowerShell and PowerShell Scripts. Example: C:\\ip-security<\/p>\n

Step 2<\/strong><\/span>: Download the PowerShell script Import-Firewall-Blocklist.ps1 from http:\/\/www.gregsitservices.com\/ip-security\/ip-security-package.zip<\/a> and extract the PowerShell script Import-Firewall-Blocklist.ps1 to your C:\\ip-security folder.<\/p>\n

Step 3<\/strong><\/span>: Go to http:\/\/www.ipdeny.com\/ipblocks\/<\/a> and download the IP Tables in CIDR Format\u00a0of the countries that you do not want accessing your windows system at all. To the Right of each list grab the “aggregated zone file” for each country. Click them on them and you will see a list of IP’s. Right click and save that file to your C:\\ip-security directory using a basic format, THIS IS IMPORTANT<\/span>.<\/p>\n

Example: Save China as china.zone.txt so that if you update the zone file it will remove any Old Rules that are created. Optionally you can grab the larger lists (on the left) but, the aggregated zones are based on activity.<\/p>\n

I recommend the following Zones:<\/p>\n

    \n
  1. CHINA (CN) (save as china.zone.txt)<\/li>\n
  2. KOREA, DEMOCRATIC PEOPLE’S REPUBLIC OF (KP) (save as northkorea.zone.txt)<\/li>\n
  3. RUSSIAN FEDERATION (RU) (save as russia.zone.txt)<\/li>\n<\/ol>\n

    Step4<\/strong><\/span>: Run PowerShell\u00a0as Administrator (right click PowerShell and select Run as Administrator).<\/p>\n

    Step 5<\/strong><\/span>: Type without quotes “PowerShell.exe -ExecutionPolicy Bypass” – This will set the scripts Policy of PowerShell to run so that it can make the Windows Firewall Rules.<\/p>\n

    Step 6<\/strong><\/span>: Begin entering the Zones into your Windows Firewall. Option 1<\/em> is for Older Versions of PowerShell. If Option 1<\/em> does not execute then use Option 2<\/em>.<\/p>\n

    Option 1<\/em>: Import-Firewall-Blocklist.ps1 -inputfile china.zone.txt<\/p>\n

    Option 2<\/em>: .\\Import-Firewall-Blocklist.ps1 -inputfile china.zone.txt<\/p>\n

    Do this for each of your Zones.<\/p>\n

    Step 7<\/strong><\/span>: Just for precaution let’s now set PowerShell back to Restricted Access on Scripts. Type without quotes “PowerShell.exe -ExecutionPolicy Restricted”.<\/p>\n

    That’s it we are done… I suggest you keep your zone files so that you can update them easy by overwriting them. I would update them about Once a Month if you are experiencing attacks. Below is how the rules will look inside Windows Firewall.<\/p>\n

    Note<\/span>: Notice the rule names are china.zone-#001 etc.. This is why it’s important to be consistent with the file name (china.zone.txt) for future updates to overwrite and remove rules automatically to save time and effort.<\/p>\n

    \"Windows
    Windows Firewall Zone Rules<\/figcaption><\/figure>\n

    How to Remove\u00a0Zones in Windows Firewall with PowerShell<\/strong><\/span><\/h3>\n

    Below is how you can remove the entries using the scripts and zone files.<\/p>\n

    Option 1<\/em>: Import-Firewall-Blocklist.ps1 -inputfile china.zone.txt -deleteonly<\/p>\n

    Option 2<\/em>: .\\Import-Firewall-Blocklist.ps1 -inputfile china.zone.txt -deleteonly<\/p>\n

    Another\u00a0Country IP Table Resources:<\/p>\n