Powershell function to get IPs and Subnets for one or more domains


1/15/2015 update: released version 1.1 – Powershell version 2 compatible.


You may be in a situation where you need to block incoming network traffic from one or more domains. Firewalls typically need IP addresses or subnets to configure firewall rules. This Powershell script has a function that accepts one or more domains and returns their IP addresses and subnets. It uses the Get-Whois function that was written by Joel Bennett in June 2013. To use this function, download the script from the Microsoft Center Repository, unblock it, run it, then use as shown in the examples. Example:

Get-DomainIPs amazonaws.com

Outputs a PS object with domain, IPs, & CIDR properties of amazonaws.com domain Example:

Get-DomainIPs (Get-Content .\Domains.txt)

Outputs an array of PS objects, each having domain, IPs, & CIDR properties of the domains listed in the file .\Domains.txt Example:

log (Get-DomainIPs (Get-Content .\Domains.txt) | FT -Auto | Out-String) -LogFile .\log.txt

Get-DomainIPs01 Outputs an array of PS objects, each having domain, IPs, & CIDR properties of the domains listed in the file .\Domains.txt It uses log function to display output and save it to log file .\log.txt Example: $BlockList = Get-DomainIPs (Get-Content .\Domains.txt) $BlockList | FT -Auto $BlockList | Out-Gridview $BlockList | Export-Csv -Path “.\BlockList.$(Get-Date -format yyyyMMdd_hhmmsstt).csv” -NoType The first line in this example obtains a list of the IPs and subnets of domains in .\Domains.txt file The second line displays the list on the console screen The third line displays it in Powershell ISE gridview Get-DomainIPs02 The forth line exports it to CSV file. Note: if any IP or CIDR has multiple values, it will not save properly to CSV.  Use Export-Clixml and Import-Clixml instead to save as XML

Advertisements

5 responses

  1. Jason

    I’m having issues with the script. Simply executing Get-DomainIPs amazonaws.com returns no values. Are there prerequisites for this to work? Thanks in advance. This will be huge for something I’m trying to tackle.

    January 30, 2015 at 4:06 pm

  2. Jason,
    If you’re using this in Powershell (as opposed to Powershell_ISE), dot source the script first to load the function, then execute it as in:
    . .\get-domainips
    Get-DomainIPs -Domains amazonaws.com

    Make sure you’re running in elevated permissions – run-as administrator

    January 30, 2015 at 5:43 pm

  3. Jason

    Sam,

    Sorry, but I must be missing something. Here’s the error that I’m receiving:

    PS C:\Get Domain> . .\Get-DomainIPs.ps1
    PS C:\Get Domain> Get-DomainIPs -Domains amazonaws.com

    Unable to find type [ordered]: make sure that the assembly containing this type is loaded.
    At C:\Get Domain\Get-DomainIPs.ps1:207 char:27
    + $Props = [ordered] <<<< @{
    + CategoryInfo : InvalidOperation: (ordered:String) [], RuntimeException
    + FullyQualifiedErrorId : TypeNotFound

    New-Object : Cannot validate argument on parameter 'Property'. The argument is null or empty. Supply an argument that i
    s not null or empty and then try the command again.
    At C:\Get Domain\Get-DomainIPs.ps1:212 char:60
    + $BlockMe += New-Object -TypeName psobject -Property <<<< $Props
    + CategoryInfo : InvalidData: (:) [New-Object], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.NewObjectCommand

    Thanks again for your help!

    January 30, 2015 at 10:11 pm

    • Yep, this happens if trying to run this on Powershell 2. This has been designed for Powershell 4. I will post a PS2 version..

      January 31, 2015 at 3:32 am

  4. Jason

    That was it! Thanks for your help.

    February 2, 2015 at 9:12 pm

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s