title: How to block all but a specific list of IP addresses on a given port using IPSEC on Windows?
body: <p>I have a list of IP addresses.</p>
  
  <p>L={x.x.x.x,y.y.y.y,...etc}</p>
  
  <p>I want to block all IP addresses except for the ones in the above list.</p>
  
  <p>How to do using IPSEC commands in windows machine?</p>
  
  <p>I tried to figure out from the following Microsoft link. But no luck :-(</p>
  
  <p>Example:</p>
  
  <p>My target: Block all ips on 198.18.84.161:80 except for the IP 198.18.84.162</p>
  
  <p>I tried the following.</p>
  
  <p>1) To block all ips on port 80.</p>
  
  <p>Steps:</p>
  
  <p>netsh ipsec static add filterlist name=filterlist_198.18.84.161</p>
  
  <p>netsh ipsec static add filter filterlist=filterlist_198.18.84.161 srcaddr=any dstaddr=Me protocol=tcp srcport=0 dstport=80</p>
  
  <p>netsh ipsec static add filteraction name=action_198.18.84.161 action=block</p>
  
  <p>netsh ipsec static add policy name=policy_198.18.84.161 assign=yes</p>
  
  <p>netsh ipsec static add rule name=rule_198.18.84.161 policy=policy_198.18.84.161 filterlist=filterlist_198.18.84.161 filteraction=action_198.18.84.161</p>
  
  <p>Result: It blocked all ips on port 80</p>
  
  <p>2) To Allow IP 198.18.84.162 on port 80 of the machine 198.18.84.161</p>
  
  <p>Steps:</p>
  
  <p>netsh ipsec static add filterlist name=filterlist_198.18.84.162</p>
  
  <p>netsh ipsec static add filter filterlist=filterlist_198.18.84.162 srcaddr=198.18.84.162 dstaddr=Me protocol=tcp srcport=0 dstport=80</p>
  
  <p>netsh ipsec static add filteraction name=action_198.18.84.162 action=permit</p>
  
  <p>netsh ipsec static add policy name=policy_198.18.84.162 assign=yes</p>
  
  <p>netsh ipsec static add rule name=rule_198.18.84.162 policy=policy_198.18.84.162 filterlist=filterlist_198.18.84.162 filteraction=action_198.18.84.162</p>
  
  <p>Result: This unblocked all IPs on port 80 instead of only unblocking 198.18.84.162</p>