Windows Firewall

Windows Defender Firewall can block lists of remote addresses natively. This PowerShell script replaces a set of block rules with the current list; schedule it hourly and every listed address is dropped before it reaches RDP, IIS, SQL Server or anything else listening.

The script

Save as C:\Scripts\isipsafe-block.ps1:

$key = $env:ISIPSAFE_KEY
$url = "https://isipsafe.com/api/v1/blocklist?format=txt&confidenceMinimum=90&limit=20000"
$ips = (Invoke-RestMethod -Uri $url -Headers @{ Authorization = "Bearer $key" }) -split "`n" | Where-Object { $_ }
if ($ips.Count -lt 1) { exit 1 }   # keep the old rules if the download failed

Get-NetFirewallRule -DisplayName "isIPsafe block *" -ErrorAction SilentlyContinue | Remove-NetFirewallRule
# One rule per 1,000 addresses keeps each rule small and fast to update.
for ($i = 0; $i -lt $ips.Count; $i += 1000) {
  $chunk = $ips[$i..([Math]::Min($i + 999, $ips.Count - 1))]
  New-NetFirewallRule -DisplayName ("isIPsafe block {0}" -f ($i / 1000 + 1)) -Direction Inbound `
    -Action Block -RemoteAddress $chunk -Profile Any | Out-Null
}
Write-Output ("Blocked {0} addresses" -f $ips.Count)

Schedule it

setx /M ISIPSAFE_KEY sl_your_key_here
schtasks /create /tn "isIPsafe blocklist" /tr "powershell -NoProfile -ExecutionPolicy Bypass -File C:\Scripts\isipsafe-block.ps1" /sc hourly /ru SYSTEM

The rules show up in Windows Defender Firewall with Advanced Security › Inbound Rules. In a domain, you can push the same script to every server as a scheduled task with Group Policy.

To report the attackers that hit you, see Windows RDP and IIS.

Need a hand?

If something here does not work with your version of Windows Firewall, or you have improved it, tell us. We update these pages with what people send.

Windows Firewall and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.