Can Windows Firewall block remote desktop connection?

You can restrict RDP access to your server, either by IP address or a range of IP addresses, using the rules in the Windows firewall. You can actually use this same method for any open port, on any Windows PC, running Windows firewall.

One thing before we start. If you are thinking about using this so that you can open RDP up to the internet, Dont. Even though it would work, always try to use a VPN first its much safer. You only have to check out the Shodan website to see the internet is being scanned 24/7 and it wont be long before your open RDP is being Brute Forced.

If your interested in finding out how easy it is to perform a Brute force attack, check out my tutorial on Brute-Forcing passwords with THC Hydra.

I have recently seen a large increase in the number of views I am getting on this tutorial. Guessing, due to lots of people working from home since Covid 19. So I have added a nice PowerShell Automation script after the manual setup, which will automatically block IPs after a specified amount of failed logins and will hopefully help someone out.

Manual Setup

This Manual setup runs you through creating the firewall rule, blocking RDP port 3389, through the windows GUI. This while being remotely connected to the Windows device.

The problem is when you create the block rule there are no options to specify which IPs you want to block until the rule is created. This effectively blocks your current connection and no one wants to have to talk someone through physically accessing a server to remove the rule and regain RDP access. However, to maintain your existing Remote Desktop connection you need to create an allow rule first. Once the rule is created add the IP addresses you want to block then you can change the rule from allow to block.

Create The Firewall Rule

• Open Windows Defender Firewall from Control Panel and click Advanced Security.

• Click on Inbound Rules.

• Then in the Actions Menu Click New Rule.

• Select Port and click next.

• Add 3389 to the specific local ports, Click next.

• Leave this set to Allow the Connection, Click next.

As I said earlier, If we were to set this to Block the connection now, it would block our remote session because you cant specify any connections until the rule is created.

• Leave Domain, Private and Public all checked and click Next.

• Give the Rule a name such as CUSTOM RDP BLOCK and Optionally a Description, then click Finish.

• Your new firewall rule is created and should now be at the top of the rules list.

Creating Your IP Restrictions

• Right click the Rule you just created and click properties.

• Click on the Scope tab.

• Under the Remote IP address section, select These IP addresses and click Add.

• From here you can choose an IP address, address range or a subnet which you would like to block.

Adding Single addresses is fine but can be a little time consuming if youre trying to block addresses Add-Hoc.

An easier and more secure option is to go with a range of addresses, Blocking every IP except the IP address you want to remotely connect from.

• Once you have entered all the IPs you want to block Click OK.

Switch Windows Firewall Rule From Allow to Block

With all the IP addresses that you want to block added to the rule its time to switch the rule from Allow to Block.

• Right Click the Firewall Rule again and select Properties.

• On the General tab, under Action select Block the connection and click OK.

If you are still remotely connected to the server after switching the rule to block. you have successfully locked down RDP without blocking your remote connection.

Remember you can use this same procedure to block access to any port with the windows firewall. however, you probably wont need to create it as an allow rule first unless you want to maintain access to the port while its being configured.

Automating the Rule with PowerShell

With PowerShell and the NetFirewallRule module, you can create a script that automatically blocks IP addresses, after a specified amount of failed logins. We can even get this to run whenever a failed login event 4635 is generated.

The NetFirewallrule is only available in Server 2012\windows 8 and above if your trying to do this in Server 2008\windows7 let me know in the comments below and ill show you how to change the code using netsh advfirewall command instead.

Create the Firewall Rule

Previously, we used the Windows GUI to create our Custom RDP Block rule. However, We can make the rule even quicker using PowerShell with the NetFirewallRule module.

For some reason, you have to add two IPs to the block rule for the PowerShell script to work. Otherwise, if you use a single IP it mashes into the IPs collected from the event and you get an output like 1.1.1.1192.168.0.15. If you know why this happens, please let me know in the comments below.

• Open an elevated PowerShell prompt and type this command.

• You should be able to now see this rule in the inbound rules in windows Defender Firewalls, advanced Security.

The PowerShell Script

Now its time to download the PowerShell Script i created. This basically pulls the IP address out of 4625 failed logon events from event viewer and adds this to our Custom RDP Block rule.

You can download failedlogins.ps1 from the Security Tutorials Git Hub page

Create the Log Folder

For the Script to work you will need to create somewhere for the log files to be saved too. By default this is C:\FailedLogins, However, this can be any location but you will also need to edit the $log location in the Failedlogins.ps1 PowerShell script.

Copy the FaliedLogins.ps1 to this log folder once you have created It. This is optional but will make it easier to follow along with this tutorial.

Time to Test

With FailedLogins.ps1 downloaded, and the log folder created, its time to test the script.

• Firstly Create some failed logins by connecting via RDP and typing the wrong password in.

Remember if you are connecting remotely not to block out your connecting IP and test this from somewhere else.

• Check the security log in event viewer for 4625 events. These are your failed logins, which the script collects and pulls the IP address from.

• Run the FailedLogins.ps1 from an administrator elevated PowerShell Prompt.

Once the script runs, the IP address you where spamming, failed logins from will be blocked and you no longer will be able to RDP from that IP.

You should also see the IP address in the Custom RDP Block firewall rule.

Automating the Script

Now we could just set up a scheduled task to run the script every few hours, which would work just fine or you could just run the script manually. However, my preferred method is to attach the script to run whenever a 4625 Failed login event is generated. This makes the PowerShell script, work like a very basic IDS (Intrusion Detection System).

• Open Event Viewer and right click one of the 4625 event. Select Attach Task To This Event.

• Give the Task a Name and add a description.

• Click Next taking you to the When an event is Logged section. This should be all greyed out, but check that it says Event ID: 4625 in the Security log. Click Next.

• Make sure Start a Program is selected, click Next.

• Type powershell.exe as the program we want to load.

Add the arguments listed below to tell the task to bypass the Execution Policy and the location of the FailedLogins.ps1 script.

• Click Next

• You then get a message to say your task has been created.

• Check on your new task by opening up Task Scheduler and clicking Event Viewer Tasks.

• Lastly, we need to double click the task we just created. Then, select Run whether user is logged on or not and tick Do not store Password.

Final Test

Now try spamming the wrong password at the RDP Connection again. This will eventually fire the script and block the IP Address from connecting any more.

Let me know in the comments below how you found it Implementing FailedLogins in your environment. Maybe you have found an easier way of implementing this or modified my PowerShell script, I want to hear from you.

If you are interested in how to perform a brute force attack on an RDP connection check out my Brute Forcing Passwords with THC Hydra Tutorial.