When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox).
Because IPSec Filtering is not stateful, if you don't have this option enabled then you can't communicate in both directions. From this article, I quote:
If you don't mirror your rules, then you can't communicate in both directions. IPsec is not "stateful" in the way that Firewall is - if you have a rule from A to B without the B to A component, then IPsec on A will drop all traffic from B, even if it is the response to request sent by A. That's part of what makes IPsec so difficult to effectively use as a firewall.
If I have a rule that says:
Allow inbound connections to my IP address to port 5666 from any port on remote host 172.16.3.200
Which would be implemented as:
netsh ipsec static add filter filterlist="NAGIOS NSClient" srcaddr=172.16.3.200 srcport=0 dstaddr=ME dstport=5666 mirrored=yes description="Inbound" protocol=TCP
Would the "mirror" rule be:
Allow outbound connections from my IP address from port 5666 to any port on the remote host 172.16.3.200
What are the security risks of such a configuration with regards to unwanted traffic?