Windows XP comes with its own software firewall to enable you to control what information travels between your PCs and the Internet, but you can also control what enters and exits your PCs by using IPsec filtering rules to filter particular protocol and port combinations for both inbound and outbound network traffic.
IPsec filtering rules are implemented by creating and assigning an IPsec policy to your computer, but first you need to create and define your filtering rules, which control which protocols, ports and IP addresses are allowed or blocked. This is done by running the IP Security and Policy Management Snap-In in a Microsoft Management Console (MMC) and selecting the local computer. You can now add, edit and remove filters by right-clicking IP Security Policies in the left pane of the MMC console and selecting Manage IP Filter Lists and Filter Actions. The next step is to configure the IPsec Policy and to assign it. In the MMC console right-click IP Security Policies on Local Computer and select Create IP Security Policy in order to give the policy a name, add the various IP Filters and Filter Actions to the new Policy, and assign it to the computer.
An IPsec policy can contain several different filter rules and actions, making it very flexible. As well as controlling access to your computer, it can be used to block access to certain sites or applications, such as chat rooms. The IPsec protocol can also be used to provide data privacy, integrity and authenticity but it can't secure all types of network traffic – see the Microsoft Knowledge Base article 253169 for further details.
When using IPsec filter rules you need to have a clear understanding of the impact that blocking specific ports will have. For example, blocking port 135 to guard against the DCOM RPC vulnerability can impact the functionality of Active Directory and Microsoft Exchange, which also use port 135. It is important therefore to test your new filters to ensure that you have accomplished your intended goals. Microsoft Service Pack 2 for XP includes a command line tool IPseccmd.exe, which can be used to manage IPsec policy and filtering rules. For more information on how to use this tool see the Microsoft Knowledge Base article 813878.
About the author
Michael Cobb, CISSP-ISSAP is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book IIS Security and has written numerous technical articles for leading IT publications. Mike is the guest instructor for SearchSecurity's Web Security School and, as a SearchSecurity.com site expert, answers user questions on application and platform security.
This article originally appeared on SearchSecurity.com.
