Deny a guest subnet by source address with a host firewall rule
On a canned Windows administrative host, add an inbound firewall rule that blocks all traffic from the guest subnet 203.0.113.0/24 by source address (scoped with remoteip, all protocols, not a single-port block), then show the named rule to confirm its action and remote scope. This is a host firewall rule: it blocks the guest subnet from reaching this host only. It does not segment the guest VLAN or protect other internal hosts; that is enforced at the L3 boundary. Do not claim this canned host is a real machine. This page teaches a job procedure. These are not exam questions, this is not a score predictor, and nothing here is taken from any certification exam.
Steps
- 1
Run netsh advfirewall firewall add rule name="Block-Guest-to-Admin" dir=in action=block remoteip=203.0.113.0/24. netsh prints Ok. to confirm the rule was added.
- 2
Run netsh advfirewall firewall show rule name="Block-Guest-to-Admin". Confirm Action Block and RemoteIP 203.0.113.0/24.
What you should see
The named rule shows Action Block and RemoteIP 203.0.113.0/24. This denies inbound traffic from the guest subnet to this host only; it does not segment the VLAN or protect other hosts.