4

I restricted the Firewall incoming rules for RDP under Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules.

This action restricted RDP access to only my IP. I confirmed this myself by trying to access from another IP unsuccessfully, can can only access the machine from that 1 static IP.

However I still get 100s of brute force RDP attempts each day. In Event Log / Security section I consistently see other (failed) RDP attempts from other IP addresses (which appear to be external).

Logs list "Unknown user name or bad password" so that tells me that they are getting passed the firewall.

I also changed the RDP port to a custom port #, but that has not helped, I'm assuming I'm being scanned for open ports.

How can this be happening when even I cant log in from a different IP?

Could it be that attackers are somehow circumventing Windows Firewall rule?

Is there anything else that I need to disable from windows services?

Also what else can be done to prevent this?

Appreciate any help here as I'm really not sure how else to stop this, thanks!

Improve this question
15
  • Take a network capture and post it with your question.
    – user2320464
    Commented Sep 21, 2016 at 2:06
  • Thanks for the comment, but what's a network capture?
    – AlexVPerl
    Commented Sep 21, 2016 at 2:20
  • Google has your answer. Typical programs are tcpdump, wireshark, netmon. Use a capture filter for TCP3389. It will show if other IPs are establishing connections or not.
    – user2320464
    Commented Sep 21, 2016 at 2:29
  • @user2320464 thanks, so you're asking me to run it continuously until it catches a login attempt ?
    – AlexVPerl
    Commented Oct 9, 2016 at 2:14
  • 1
    Did you ever figure this out? My gut feeling would be that your firewall wasn't configured the way you thought it was, since I agree with your assessment that it wasn't behaving properly.
    – TTT
    Commented Jun 8, 2018 at 19:03

2 Answers 2

Reset to default
2

This can happen often with Domain Controllers.

Do you have a Domain Controller? If so, on the DC, enable the netlogon.log debugging file (via elevated cmd prompt):

nltest /DBFlag:2080FFFF

Now, go to %WINDIR%\debug\netlogon.log and open it up. You'll be able to see the user(s) attempting to log in, and which machines they're attempting to log in to. It may turn out that you have other systems on the network which are trying to RDP into those systems using Active Directory credentials.

You should be able to track down the offending server with the above data. My guess is something connected to the DC is exposed to 0.0.0.0/0:3389, like an AWS server that remotes into your network using a VPN. May want to check your AWS security groups.

It could really be anything, though. You'll want to find this server before it becomes a pivot point.

Having said that, none of the Wireshark tips in this thread will detect this behavior unless you're on the system being RDP'd into - which is likely not the DC. You'll need to go straight to the DC logs and find out for yourself where it is.

To disable netlogon.log debugging later (via elevated command prompt):

nltest /DBFlag:0x0
Improve this answer
0

Your firewall is just working. Nothing to complain about.

It's allowing only that IP, the others are getting blocked and logged so that you know someone else is trying to reach your RDP.

Improve this answer
7
  • 1
    In EventViewer/Security for failed login attempts I see the following reason "Unknown user name or bad password." That implies to me that a port connection has been made and its the NTLM that is rejecting the login. Shouldn't the Firewall stop the connection before it reaches NTLM?
    – AlexVPerl
    Commented Jul 22, 2016 at 20:55
  • @AlexVPerl oh well, that's an important bit of information you missed in the question ;) Then I can't help you because that just doesn't make sense to me ;)
    – user15194
    Commented Jul 22, 2016 at 21:47
  • @AlexVPerl i have similar situation. the way i undestand it is this. You limit access to rdp for one ip only. when someone tried to brute, any info they send to your server gets logged. they could have the correct user and pss, but they will still get blocked because their ip isnt allowed. just like ssh and public key. if u want to filter ip from actually sending traffic to your server, use something like ipset, or an equivalent for windows. but for your situation you shouldnt worry, it is just the logs way of letting uou know what action has been tried against your server.
    – JShade01
    Commented Jan 2, 2017 at 19:51
  • Thanks @JShade01. I was hoping it would be the case. But it appears that when Windows Firewall blocks traffic the request does not even make it to the Login Layer / Active Directory. I use VPN for dedicated IP, so this scenario was easy for me to test. When IP is blocked there is no record of the attempt in EventViewer. Windows Firewall will have log entry somewhere, but not EventViewer. In my case EV lists the reason as "incorrect login / password" which implies that the request is passed Firewall at that point. At this point I'm convinced that my VPN IP isn't as dedicated as advertised...
    – AlexVPerl
    Commented Jan 2, 2017 at 21:38
  • @AlexVPerl If you will, take a look at this link superuser.com/questions/979312/…. It talks about using rdp through ssh. This way you can forget about clear text and use a public key to log in, meaning only uour device will be able to log in, and brute forces to your rsp and ssh ports are rendered meaningless traffic.
    – JShade01
    Commented Jan 2, 2017 at 21:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .