How to use Windows Firewall to block Hackers and Malware

Using intelligent automation in this Windows Firewall tutorial you can block hackers and malware ips using community blocklists.
Live workshop event on Discord: discord.gg/XyM5SJqZ?event=111...
Get Crowdsec Open Source IDS (sponsor): www.crowdsec.net/?mtm_campaig...
Buy the best antivirus: thepcsecuritychannel.com/best...
Join the discussion on Discord: discord.tpsc.tech/
Get your business endpoints tested by us: tpsc.tech/
Contact us for business: thepcsecuritychannel.com/contact

[@pcsecuritychannel]

We will have a live discord workshop and hangout to discuss some of the concepts in this video, building a malware lab etc. Make sure you sign up in the events section of our discord if you'd like to attend next week: discord.com/invite/XyM5SJqZ?event=1112466823535919194

[@fiverZ]

But why Discord? From a security standpoint, Discord is a big yikes. Any other ways to take part?

[@Zach-Hyde]

@@fiverZ Why is Discord a big yikes?

[@fiverZ]

@@Zach-Hyde Excessive data collection, blatant GDPR violations, proprietary, shady af CEO, very easy to abuse the reporting system... There's a few reasons to avoid it.

[@Zach-Hyde]

@@fiverZ yikes

Is there a way to do this on a router level? Or wouldn't that help at all,

[@SonicFan535]

Just so you know, the example script you showed could potentially have a huge vulnerability, because if the server hosting that file with the IPs ever gets compromised, an attacker could basically inject whatever Powershell command they want in place of the "ip" that you're appending to the command string, and just like that they can perform arbitrary remote code execution on your PC.

[@gamewarrior9107]

so should i do this or no

[@eveleynce]

it would be a good idea to just make a weekly reminder to manually download the file from a legitimate site rather than automatically downloading it every day

[@sanjaykrishnaob]

If anything like that does happen Your antivirus product will kick in to block those threats or block RCE using its behavioral component. If the antivirus is from reputable company ofc.....

[@tiagoferreira086]

A simple more or less effective solution, would be accept only numeric values, and maybe apply some kind of pattern detection to check if it is in an ip valid format.

[@CesarAugustoRL]

Good catch!

[@EnejJohhem]

Imagine blocking Microsoft using Windows Firewall

[@404_sorry-am-not-found]

Imagine blocking system using the Firewall :D

[@noanyobiseniss7462]

Thats what the hosts file is for. :)

[@404_sorry-am-not-found]

guess what’s my IP

[@ollicron7397]

I would do that 😂

[@404_sorry-am-not-found]

@@ollicron7397 then tell me

[@bleakyfinder2692]

Leo, you are talking to normal people here. Unless you show us all step by step from a blank start,this is very good content for tech heads, clear to me and maybe most as Mud.

[@rainzerdesu]

I think he makes some assumptions since I think a "normal" person, as it were, wouldn't be actively watching a PC security channel. If it were a safe assumption to believe the average person would, it wouldn't repeatedly show most common passwords being like 123456

[@CubensisEnjoyer]

I mean this is pretty much step by step...I would say this is about as beginner-friendly as this topic gets.

[@walid6329]

get friendly without everything he mentioned, pause the videos from time to time you'll get it, it's beginner friendly

[@filipskater]

Are you 12?

[@googleinc6033]

ask chat gpt

[@CesarAugustoRL]

Great video, just ensure that the list has IP numbers in the correct format, so to avoid code injection.

[@-blackcat-4749]

you can just add an if statement inside the loop to check against regex pattern that conforms to ip format

[@biohuk]

​@@-blackcat-4749but where to put it exacly?

[@yddkvnxo5151]

awesome vid dude thank you! im getting into cyber security, doing a course so i can get my foot through the door an stuff like this is so helpful on my journey. The reason i decided to get into cyber sec is because I was playing a game one night and some dude got mad an hit me offline, i couldnt play for a whole day almost. With zero knowledge on how to combat that I was like yeah I wanna learn this stuff an so here I am. Thanks again! I look forward to learning more stuff from your vids! cheers!

[@Martin-ot7xj]

Hi there, it was one of the best tutorial videos you made and shared with us. kindly upload more like this content regarding the block Vulnerable IP to protect more on Windows and router. thnx

[@mettbonbon2186]

Thanks for the cool guide! I did the same thing but with powershell and it makes one rule for inbound and one for outbound. It works great and downloads the list for me as well.

[@anwarulbashirshuaib5673]

@TPSC Just to stay safe, when parsing those IP addresses, you can create a regex pattern that would match only IP addresses and nothing else. That would make the process of injecting remote code much more difficult.

[@JakubVacek42]

Exactly what I was thinking. I'd also log rejected entries so I'd know if the source cannot be trusted.

[@basroos_snafu]

I would love to have a list of malicious Microsoft IP's that were updated daily and implemented the way you demonstrated... What I have done manually is blocking the Windows Search executable, it works well, although it delays the local search function a bit. Thanks for this interesting video!

[@brianhenry4662]

Very informative video. I actually started building a small tool to check for blacklisted IPs using the same resource.

[@jibberjabber6919]

Added these blocklists on my router. Thanks.

[@Rareparrot]

Thanks for the video - I went down a slightly different path. Firstly - I wasn't sure when you said "delete all the rules every day" you meant the default ones windows already had, so that wasn't clear at all. If you were deleting your firewall rules everyday, a good script would include a command line to backup the firewall rules that are already there before deletion. Not all of us are gurus so a safe backup practise is very healthy :) Also, secondly, I go back a bit :) am over 50 (used the text based early internet) and remember using a program called peerblock. Love it or hate it, it is still to my surprise available to download. It's also portable. I don't recommend anyone use it BUT it does give the option of leaving the firewall (and settings untouched). By me using this program ( a proof of concept too) it was able to suck up the complete block list :) For it to work it needs to run all the time. Back in the day it was popular but then unpopular probably because someone worked out how to bypass it........... Still really appreciate these videos and learned about the abuse list from it, Thanks so much......!

[@tokhyanwaruddin2631]

Hi, Thanks for the to the point video. I do have one comment, in my opinion it would be more clean to have one "BadIP" rule with all the IP address in it instead of having 100+ firewall rules. can you also show how to do that with the python script?

[@NO-END]

Good video Leo I knew about this already i have Bitdefender but if you are on a budget or you love windows Firewall this is a good thing to do. I would set the rules manually though.

[@BeamngPerimeters]

when i click on a recent video on your channel my cat jumps onto my lap and watches the whole thing with me

[@3isr3g3n]

Network security cat, nice!

[@therealhussein]

well intelligent and informed cat

[@fr34k09]

ended up using openai to fix whatever happened with the text extracted from the screenshot that I tooked and it works, thx 👍

[@pepeshopping]

The proper way to do it is at the firewall/router level! A proper malware that came through phishing would have no problem disabling the windows firewall completely.

[@1superheld]

Wouldn't it be better to use 1 rule with multiple ips? But otherwise nice learning!

[@pcsecuritychannel]

Yes. I thought about that but this was just the simplest way I could find to implement it. If you can make a more efficient version that works I’m happy to pin it.

[@1superheld]

@@pcsecuritychannel Left a new comment with a PoC in Powershell :)

[@nenume00]

@@1superheld where is it ?

[@Rekit0]

In addition, you can make this more automated by adding a task to task scheduler to run this script every day using pythonw, so you don't get the terminal popup while using your computer.

[@pcsecuritychannel]

Yes, I forgot to add that part, that is how you automate the process daily.

Thanks for pointing this out. I noticed the missing piece of running that script wachting this video. 👍

[@ireallyreallyreallylikethisimg]

isnt the list going to end up being multiple gb's in size though?

[@RetrospillBlogspotNO]

@@ireallyreallyreallylikethisimg The list in his example is tiny - ~2kb, so no.. He deletes everything already blocked, and then adds everything from the most recent list.. You could probably find a lot bigger ip lists online - but never multiple gb's.. If that's the case you'd better off whitelisting the IPs you trust :)

[@Mr420]

Thanks took some trys never coded much before

[@walid6329]

awesome one mate✔️😛

[@csparty11]

You could do this on every host but i think it would be way smarter to do this on a central router/firewall solution like pfsense/opnsense or a commercial solution.

[@priyojitdeb1891]

nice and informative, thanks!

[@Chewbacca55]

Can you not just add all IPs to one rule insteald of creating a single rule for each IP? Would be faster, right?

[@Wexutar]

It would be nice to make the script available to download for those who are not into programming and scripting. Please

[@empatikokumalar8202]

Can we apply this method to the programs that we use but are constantly controlled? For example, we use program A without a license. to its own company so that it does not hinder its use. Does it prevent you from sending information?

[@0x-003]

do you have a video on how you setup these testing machines? i want to learn how to setup mine so I can test programs etc

[@daLiraX]

Not sure how the performance is affacted by the Windows Firewall itself. But if it behaves like the hosts file it... will be pretty much unusable after a certain point, since it will become somewhat unresponsive for minutes. But still an interesting idea, it's still somehow sad that we lack a simple solution to basically have a pihole in your PC itself (since those are hard to get still and became pricey aswell).

[@nicolascivitelli3859]

Muchas gracias por el video, muy buena idea.

[@Schnitzer325ci]

Is 365 referencing this site already? Or do we have to add IOC list and if so, how do we keep that updated without a CSV pull via PS

[@sir.keyboardwarrior5357]

Great stuff. I used your script but it wasn’t adding in the rules. With help of ChatGpt, I managed to make few changes and it is running perfectly in my Windows 11 22H2 version. Thank you 🙏

[@vanessamoises8090]

Hi, may i know how did you make it work? I also used the script but i cannot run it.

[@sir.keyboardwarrior5357]

sure, It was just some tweaks here and there. How do I share you the code?

[@sir.keyboardwarrior5357]

@@vanessamoises8090 sure, It was just some tweaks here and there. How do I share you the code?

[@salafzoon]

Thank you for your informative video, was wondering where I can get your script please?

[@marksvirsky9103]

Great content as always. Next phase: How to block windows spyware using windows defender

[@erwinancer6138]

Fantastic thank you

[@SonOfJoy]

Hey TPSC , What is the way that I can get a copy of that script that you wrote to have all of those Bad IP's blocked by Windows Firewall?

[@Scubad1975]

Hello love videos question what's the best firewall I use Windows Firewall and Antimalware bytes also what would you recommend for security

[@Zetsua]

Yo! Can you do a video on the virus that was in Minecraft mods recently? Would like to know more about it and see what all it does. I thankfully wasn't infected but perhaps you can see what all the virus touches and messes with.

[@dhuantegg]

Nice video dude, but I’m getting in doubt. Recently I decided to replace the Windows Defender to Bitdefender Antivirus Free version + comodo firewall and I’ve noticed gains over performance. Here’s my question should I use my actual combo with this tool? or I’m safe with Bitdefender + comodo? (i know that my pc can be susceptible to attacks or any kind of virus) I hope someone can guide me

[@FurryNonsense]

Please do another top anti-virus tier list video

[@ianmusicstein]

When I get pop ups to allow a game to use the firewall I decline it and the game still works. I checked the firewall rules and in some cases windows just allowed it anyway, in other it is not selected as allowed, but still works anyway.

[@saviorvx1883]

i reinstall windows every other day, and i tend to export my setting and then convert it to a script be it app settings, registry tweaks etc to a .bat or .cmd i wanted to know if the ips can be added onto one entry instead of having 1000s firewall entrys to keep it organised yknow...well ill be trying to configure it thank you

[@CUBEOFSIX]

Could you make a video on how you would setup a fresh install of Windows 11?

[@AnthoJoh]

By adding all those rules, will that slow down a pc or internet browsing?

[@anwarulbashirshuaib5673]

yes I was also thinking the same

[@guilherme5094]

Really nice.

[@privatechannel1272]

Now what about what is the best free firewall? Is Comodo firewall good, I have that along side with my antivirus. (And I also have Crowdsec)

[@piffdaddy420]

where can i find this script? and does comodo firewall automatically block the bad ips with their updates?

[@gearfriedtheswmas]

I just use Simplewall and block everything I don't need or what I don't understand why it wants to connect.

[@Carfreak226]

Would like to have this script. Please and thank you. Also, will this script work in PiHole on a network wide basis?

[@aavvaallooss2]

I use Skynet Firewall available for Asus routers with Merlin firmware

[@fbifido2]

can your script subnet them to make the list smaller ??

[@jackfishthe6th373]

Keep in mind that if you create a lot of rules in Windows Defender it will unfortunately slow down your internet speeds. (This comment was made in error, read further comments below)

[@pcsecuritychannel]

I have seen no evidence of that. Have you tested that? How did you measure it.

[@jackfishthe6th373]

@@pcsecuritychannel Good thing you asked because I forgot I made this comment. I unfortunately made the confusion of this blocking method that you discussed with a different method of editing the Hosts file on a Windows 10 OS. My previous comment was actually in regards to the method of editing the Windows Hosts file. If you want more explanation on the Hosts file method and how I tested that let me know. Sorry for the mistake. 👍

[@AhatiMaat]

Is Malwarebytes good compare to what you showed on your video.

[@chris122380]

Why not block these IP addresses using the host file that way they never come in to begin with where is the firewall still a better idea because it can block both directions? Will this slow down the firewall? How can we get a copy of this script? I don't see a link for it in the description.

[@alitwiratama3939]

This video is great from beginner to protect PC from hacker and malware, but I create program same as you but I really got error in my program, the error code is: IndexError: list index out of range in code: ip = row[1]. How to fix this error? Thank you.

[@mohammedodeh7601]

Would an anti-virus like Bit Defender already have those IPs black listed?

[@penultimatename6677]

I suspect the answer is yes and likely better than Windows virus protection

[@Steve-du1ic]

You are the first person I ever heard call GUI "Gee You Eye" instead of "Gooey". Damn I'm old lmao

[@lenarnie2973]

Need some soft to automate process, everyday download file and update list in firewall, but nice thing, i like it

[@sam.walker_dc]

Love your videos! Keep up the awesome work!

[@verynice5258]

Thank you

[@Zachsnotboard]

so do these rules expire ? Or the IP is blocked indefinitely, because that seems like it could cause some issues as those IPs may be used for legitimate services in the future

[@moss8448]

Does not Malwarebytes Premium do this sort of thing? I have it and it constantly blocks sites.

[@synthlord6575]

I'm sure if I tried scripting that in Powershell, I would get errors for every line..

[@prodbyd1972]

Could you do that with a batch file ?

[@d1m18]

Does that Python script clear the old rules and start over?

[@grapefruitinstrument1394]

Couldn't you use something like peerblock and add this list?

[@Abaddis-en2sr]

Very good channel and my question is illegal apps in Play store installing my phone how much dangerous

[@HimanshuSharmazzzz]

I believe I can simply use the mentioned blocklist with my Pihole ?

[@Henk717]

I made a very similar script for the Half-Life 2 Deathmatch community since there is a malicious server that spams the server list with fake redirection servers.

[@nayeemx11]

that great, can please give another video for getting all adult websites list, with blocking them. Also automate this on windows startup.

[@souviksamanta8938]

if I wish to add the link from this file then how to do without automation ?

[@timetriad6199]

Is this available for home routers, like ASUS, Netgear, etc?

[@ospy_edits]

Hey man can you make a vedio of how to make a constantly swapping or bouncing ip I really need it

[@acolis89]

If using a pi-hole, will be this redundant?

[@666KoXz666]

where to download script?

[@ngbs75]

how can i run the python script by pulling in a admin command prompt screen

[@kingofrandom4060]

can you make a video for safing port master program

[@walkabout16]

How is this different from a Host file?

[@arsims1]

I recommend: Loaris Trojan Remover, Malwarebytes, and any Endpoint security.

[@rocha1001]

how i can dowload the script? very useful thx for the work.

[@fifteen8]

Wait, what? 7:58 "As far as I'm aware I've never really seen Windows firewall block the malware IPs I test with." Can you clarify? I used to manually set a lot of Windows firewall rules, and they did work. I also set rules to deny any application that wasn't whitelisted. It just got too cumbersome.

[@murphybrown32216]

where is the file to download

[@mik3lang3lo]

Newbie question, but can a bad ip become a good ip? You know, a year has passed, the person or malware that used that ip no longer exists and the number is allocated to something else.

[@alevolt1596]

Pubblic Ip addresses are assigned by IANA (Internet Assigned Numbers Authority), then National organizations distribute them to Internet Service Providers and they administrate them. The choice to blacklist an ip is made by the ISP, if the ip address isn't use for malicius activity the ip is no long blacklisted

[@nextworks3257]

nice video, i do already a .bat for do the same thing but when i enable the firewall my connection interrupt :/

[@nextworks3257]

nothing i fixed, thanks for the proof of concept

[@study3954]

Can I set this on inbound as well?

[@ChaunceyGardener]

I just let Sordum's freeware Firewall App Blocker in whitelist mode and never have to deal with Windows Defender GUI itself. You can just add EXEs, processes and even folders into the window and voilá. Firewall configured in 5 seconds.

[@gearfriedtheswmas]

Will it be possible to use the firewall as an ad blocker?

[@Leonard_MT]

Yes, that is somewhat possible.

[@aminsec]

where i can copy the python script ?

[@Harb000]

Comodo Firewall vs Windows Firewall which is better?

[@franciscohorna5542]

i dont use that i use norton smart firewall that comes with norton 360 delux plus for up to 5 devices

[@vasstselepidis231]

i am trying to make this script run and i get an error on line 9 as the following SyntaxError: '(' was never closed i have typed mycsv = csv.reader(filter(lambda x: not x.startswith(#), response.splitlines())) what have i written wrong ? help me out

[@biohuk]

​@@CoolIcingcake3467how I can add statememt pattern inside the loop against the regex pattern that conforms to IP format? And how I add IP's to the rule if(ip)!=("dst_ip"): print("Added Rule to block",ip) rule="netsh advfirewall firewall add rule name='BadIP' Dir=Out Action=Block RemoteIP="+ip subprocess.run(["Powershell", "-Command", rule])

[@biohuk]

How to add IP's to the rule but not rules

[@SametKaratas-jm5zg]

I use router Parental Controls feature to block malware and adult IP

[@ovarb12]

Where can i get the script and what do i edit it with?

[@JapaneseMonke]

What is this program in 6:39? how do i do this code?

[@jetenk]

Visual Studio

[@Vyr-kj1cr]

Portmaster for the win

[@XGaMePLaYeR1994x]

Can we use a pihole to block all these ip adressed ?

[@jetenk]

i think u can import list but dont remember since i'm using diversion & skynet now ^^

[@big_floppa]

Why not just use Simplewall?

[@Hex_Tv]

I can’t put my script in the command prompt

[@myFares]

If you add large number of rules , your computer booting will be very very slow .

[@enforcerridley158]

That certainly happens hen you do this with the host file.

[@seansingh4421]

Configuring Firewall on the Local Router is far far easier and effective than dealing with this and also Microsoft cannot reset your firewall settings with system updates