World of EUC

<https://support.citrix.com/article/CTX222249/how-to-create-responder-policy-allowblock-a-set-of-ips>

Thanks for that, i have labbed up a solution and it looks like its going to work - the thing i am stuck on is what to do with how to handle public IPs i want to drop while allowing only 1

Create a data set with the known IP in it, and when you do the responder put .NOT on the end.

image.png

in DataAllow dataset i have put an IP of a Win10 VM in my lab

In the first policy put .NOT on the end and change the action to DROP

... and if you need to log the drops/allows, create a separate responder policy where the action is noop and add a rate limiter to it, this way you can drop all the requests but only log the first packet in selected timeframe

Or use #CoreLogic (batteries included) :stuck_out_tongue: <https://github.com/corelayer/CoreLogic> :innocent: