How to block a specific IP address

Question

Our Exchange server got some malware on it a few days ago - seems to be removed now - but the server is constantly being hit on port 25 by an IP address out of Vietnam which we do zero business with. The anti-virus is notifying me as much, but it occurs about once every 20 seconds. How can I block this IP address from passing through the firewall? 
 Thanks

Wayne Folta · Answer

You can create a Firewall Rule -- make sure it's higher up in the list of rules so it overrides -- that catches traffic from the WAN zone and the IP address of that host and drops the traffic. You could specify it's going to port 25 or port 25 on your server. You could specify that traffic coming from Vietnam. 
 The idea is that your firewall rules are evaluated in order from top to bottom and the first rule where the from/to/etc matches is used. So you want to be careful that you get it right. Then you can watch the firewall log to make sure the rule is being used only at the appropriate times and not for huge swaths of traffic. 
 Remember also that IP addresses are usually easy to change, so you could end up doing a lot of whack-a-mole. And a sophisticated attacker can use intermediate hosts so that the attack is coming from, say, the US or France or wherever they want, so my idea of rejecting all SMTP traffic from Vietnam -- assuming you do no business in Vietnam at all -- wouldn't stop a determined or sophisticated attacker. 
 But it might just be one person with scripts running on their PC and you could perhaps stop a small load on your Exchange server. More importantly, do you have Microsoft IPS rules enabled? (The default for IPS I think is most all rules, including Windows. Just asking.)

How to block a specific IP address

Top Replies