Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I've a Windows Server 2016 and I want to allow unlimited incoming requests from some specific IPs, but prevent others from DoS attacks.
I see RDP Defender but I'm not sure how good or safe it is to use. How to whitelist some IPs and prevent others from DoS and other attacks? (preferably using Windows Server or Plesk)
Thanks.
If you white list the IPs that you trust, that implies every other IP except those are blocked. That will effectively prevent other IPs from DOS attacks. The assumption of course is that the firewall configuration is not erroneous and/or the firewall itself is considered "secure" by any reasonable standards.
Where a tool like RDP Defender comes in to add value, is when you can't know the specific IPs that should be using your service and thus cannot white list them, and/or you don't want to assume those IPs are trustworthy.
RDP Defender, and tools like it, allow you to open up your services to IP's and then it looks for behavior patterns from those IPs and blacklists based on behavior criteria.
It is worth pointing out that, according to RDP Defender's site, this tool works by monitoring for failed login attempts and then leverages windows firewall to put rule(s) in place to block traffic from those IPs. This is important to think about for several reasons:
1) DOS/DDOS attacks don't necessarily leverage logon attempts, and thus will go undetected and unblocked.
2) The defense of blocking the IPs where suspicious traffic is generated, in itself, can be used as the attack method for DOS. If an attacker can embed itself into something a lot of people use, when that attack launches it will be coming from a lot of IP addresses. If your defense is to block each of those source IPs, some of those IPs might be valid customers of your service which are getting shut off. If your defense is to block entire sub nets, that will certainly have the potential to shut off a lot of IPs not trying to do harm. Lastly, if the attacker spoofs IP address, then they can target to make you shut down IPs as they wish.
Disclaimer - I never recommend that someone put a server onto the public Internet (especially Windows) without the expertise of someone who knows all the intricacies involved. Your best case scenario is a very hardened system that is as protected as is possible considering the nature of the services it has to provide to the public Internet, but still vulnerable in ways which you know and your business have assessed and decided risk accept. Your worst case scenario is thinking your server is well hardened and protected, but isn't and you find that out in a way that costs the business huge amounts of lost revenue, fines, legal liabilities, and/or impact to reputation. Moreover, even if the security is very effective at time of deploy, it is not untypical for that security to fade as time goes by -- so there is an ongoing operational aspect to think about.
My answer is not intended to do anything more than help you think about this.
You are mixing up different concepts. A white list (and rate limiting, i.e. allowing only a few requests from an IP that is not whitelisted) and DoS share no common ground.
While you could, either at application level (it is unclear what you mean by „incoming request“, so this might be changes for many different applications) or by using a stateful firewall that will limit the rate of connections from a non-whitelisted IP to the server, implement this, it wouldn’t help against DoS or DDoS.
In case of a DoS, as much as a single packet might be enough to trigger a DoS, depending on the vulnerability exploited to DoS.
If you however follow the seemingly common (and highly inaccurate) idea that DoS and DDoS are the same thing, you maybe catch DDoS attacks that aim at the application layer, i.e. exhausting Server ram or disk space, maybe computing power.
More common however are DDoS attacks that exhaust the targets network capabilities and this solely depends on your servers network connection. Even with a stateful firewall before that, the connection to your server will still be blocked, even if not as much connections come through directly to your server.
While you can (and should) do some form of rate limiting, maybe something analogue to fail2ban on Linux to make vulnerability discovery hard, this doesn’t exactly helps with DoS or DDoS attacks.
While I didn’t look up RDP defender, I suppose it only checks the RDP protocol, no other applications, so this is probably an addition to thwart the threat at an application level as suggested above.
