I've discovered my VPS server with RDP access is getting attacked. Event log shows a bunch of 4625 events. Now I know for using RDP, this is just the nature of things.
I have changed the RDP port right from the start (I know it won't prevent attacks, but it's better than running default 3389), so someone must have port sniffed me, and now everybody knows my ip with the RDP port I used, and starts hammering at it.
What I've done so far is changed the port yet again, and installed Evlwatcher (so if my new port gets discovered, at least Evlwatcher will kick in and start ip blocking). I've checked the windows policies are in place against the risk of them discovering actual accounts and hammering away at them. (https://www.malwarebytes.com/blog/news/2022/07/microsoft-clamps-down-on-rdp-brute-force-attacks-in-windows-11)
It's been a day since the port change, and no attack yet (or so I thought).
I pulled out wireshark and checked out what's happening, and finding a bunch of ips are still hammering my server at the previous rdp port. Now I'm guessing the firewall is kicking them all out, so they don't actually reach my server (I don't see the 4625 event). But seeing them show up on my wireshark is still concerning.
Question is, is there anything I can do to further block these? As this is a VPS, I don't have control to go a level higher in terms of blocking on the networking layer, hardware firewall etc. My gut feeling is, wireshark is just showing people knocking at my door, so nothing I can do about them aside from waiting for them to stop (like annoying solicitors)
Also any suggestions to improve this situation would be appreciated. I would still like to keep RDP though. VPN would be nice, but not sure if I can do that on the VPS and somehow keep the RDP port under that umbrella.