I've discovered my VPS server with RDP access is getting attacked. Event log shows a bunch of 4625 events. Now I know for using RDP, this is just the nature of things.

I have changed the RDP port right from the start (I know it won't prevent attacks, but it's better than running default 3389), so someone must have port sniffed me, and now everybody knows my ip with the RDP port I used, and starts hammering at it.

What I've done so far is changed the port yet again, and installed Evlwatcher (so if my new port gets discovered, at least Evlwatcher will kick in and start ip blocking). I've checked the windows policies are in place against the risk of them discovering actual accounts and hammering away at them. (https://www.malwarebytes.com/blog/news/2022/07/microsoft-clamps-down-on-rdp-brute-force-attacks-in-windows-11)

It's been a day since the port change, and no attack yet (or so I thought).

I pulled out wireshark and checked out what's happening, and finding a bunch of ips are still hammering my server at the previous rdp port. Now I'm guessing the firewall is kicking them all out, so they don't actually reach my server (I don't see the 4625 event). But seeing them show up on my wireshark is still concerning.

Question is, is there anything I can do to further block these? As this is a VPS, I don't have control to go a level higher in terms of blocking on the networking layer, hardware firewall etc. My gut feeling is, wireshark is just showing people knocking at my door, so nothing I can do about them aside from waiting for them to stop (like annoying solicitors)

Also any suggestions to improve this situation would be appreciated. I would still like to keep RDP though. VPN would be nice, but not sure if I can do that on the VPS and somehow keep the RDP port under that umbrella.


  • 2
    There is nothing you can do about computers trying to access a port. Have you considered limiting RDP/firewall to just your IP?
    – schroeder
    Oct 27, 2022 at 15:43
  • Thanks for the reply. That would be my next step, but I need to be careful with that as I don't have a permanent IP. It'll be cool if I can somehow setup one of those e-mail to me to confirm new IP thing. Then I don't have to worry about lockouts.
    – Jason Chu
    Oct 27, 2022 at 16:13
  • What OS are you using on the VPS?
    – Polynomial
    Oct 27, 2022 at 18:42
  • I should have mentioned, thought it would be implied since I mentioned RDP, but it is a Windows Server.
    – Jason Chu
    Oct 27, 2022 at 19:02
  • Which version of Windows Server, specifically? 2008 R2, 2012, 2012 R2, 2016, 2019, 2022?
    – Polynomial
    Oct 27, 2022 at 19:02

1 Answer 1


Since you mentioned that you don't necessarily have a permanent static IP, you can instead create a firewall rule that allows access from one or more subnets that belong to your ISP.

If you put your public IP address (of the system you RDP from, not the server) into an ASN (autonomous system number) lookup service (e.g. this one), you can find the AS# for your ISP and the AS prefix (subnet) you're currently in. If you then search for that AS#, it'll give you the full set of AS prefixes that are part of that AS#.

For example, if my public IP address was, the AS# would be 19281 (QUAD9-AS-1, CH), which is part of the prefix. If I then search for 19281, it shows me the full list of prefixes:

The Windows firewall rule dialog only lets you add one subnet to a rule at once, so you might want to use Set-NetFirewallRule in Powershell to load all the subnets in at once if there are a lot of them for your ASN.

After setting up a firewall rule through the UI, with everything configured except the subnet list, you can add all of the subnets in an array like this:

Get-NetFirewallRule -DisplayName "Restrict RDP to [ISP] subnets" -OutVariable rule

Set-NetFirewallRule -InputObject $rule[0] -RemoteAddress @("", "")
  • 1
    Think I'll go with that for now. Then in case where I need to access the server outside of my ISP's ip, I'll just VPN into one, then RDP from that.
    – Jason Chu
    Oct 28, 2022 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .