Is there a limit to the number of IP addresses for a Windows Firewall rule's Scope?

Question

I've got a Powershell script that adds IP addresses trying to run brute force attacks on my server to a firewall rule that blocks them from accessing it. Recently it stopped working, and started throwing this error:

Exception setting "RemoteAddresses": "The array bounds are invalid. (Exception from HRESULT: 0x800706C6)"

Is there a limit to the number of IP addresses you can put in the Scope of a Windows Firewall rule? This is running on Windows Server 2008 R2.

Solution

Yes - the limit is 1000 entries total. A single IP addresses is counted as one entry if it's entered on it's own, or a range of IPs is counted as one entry if it's entered as one range.

In my case, deleting one of the IP addresses from the Scope of the above rule will allow the script to add it (or any other IP address) back to the Scope. The errors are thrown for every attempted entry over 1000.

As a workaround, once you get to 1000 entries in the current firewall rule, you can simply create a similar rule with a different Scope. It's not elegant, but it will get the job done.

Comments

[Art]

This answer is not correct. See: superuser.com/questions/802355/…

[kevinmicke]

@Art I'll double-check if this is still an issue next week, but as of when I wrote this, I'm 100% sure it was the case.

[Art]

Check the answer in my question; the post in the MSDN forum is from one of the devs that works on Windows Firewall. I currently have 1500+ remote IPs in my filter and I can scroll the list just fine as well as add new ones both programmatically and via the GUI.

[kevinmicke]

@Art I checked out your question, and just wrote a little Powershell script to check this. At least on my server, this limit of 1000 is correct. My script added 0.0.0.0 through 0.0.3.231 (1000 IPs) without issue, and then errored out on all of the ones after that. I then checked if I could add the 1001st IP via the GUI, and got this error message. Regardless of what anyone says on a forum, this is the reality on my server, so I believe my answer is correct. What version of Windows and Windows Firewall are you running where you could add more than 1000?

[Ramhound]

This does not answer the proposed question

[DavidPostill]

Please read the question again carefully. Your answer does not answer the original question.

[needfulthing]

There seem to be different limits in different versions of Windows. I can easily add thousands of IP blocks to one rule in the current version of Windows 10, but the same script fails on a Windows 2008 R2 server.