RDP Brute Force Attacks

Question

I've discovered my VPS server with RDP access is getting attacked. Event log shows a bunch of 4625 events. Now I know for using RDP, this is just the nature of things.

I have changed the RDP port right from the start (I know it won't prevent attacks, but it's better than running default 3389), so someone must have port sniffed me, and now everybody knows my ip with the RDP port I used, and starts hammering at it.

What I've done so far is changed the port yet again, and installed Evlwatcher (so if my new port gets discovered, at least Evlwatcher will kick in and start ip blocking). I've checked the windows policies are in place against the risk of them discovering actual accounts and hammering away at them. (https://www.malwarebytes.com/blog/news/2022/07/microsoft-clamps-down-on-rdp-brute-force-attacks-in-windows-11)

It's been a day since the port change, and no attack yet (or so I thought).

I pulled out wireshark and checked out what's happening, and finding a bunch of ips are still hammering my server at the previous rdp port. Now I'm guessing the firewall is kicking them all out, so they don't actually reach my server (I don't see the 4625 event). But seeing them show up on my wireshark is still concerning.

Question is, is there anything I can do to further block these? As this is a VPS, I don't have control to go a level higher in terms of blocking on the networking layer, hardware firewall etc. My gut feeling is, wireshark is just showing people knocking at my door, so nothing I can do about them aside from waiting for them to stop (like annoying solicitors)

Also any suggestions to improve this situation would be appreciated. I would still like to keep RDP though. VPN would be nice, but not sure if I can do that on the VPS and somehow keep the RDP port under that umbrella.

Thanks.

Answer 1

Since you mentioned that you don't necessarily have a permanent static IP, you can instead create a firewall rule that allows access from one or more subnets that belong to your ISP.

If you put your public IP address (of the system you RDP from, not the server) into an ASN (autonomous system number) lookup service (e.g. this one), you can find the AS# for your ISP and the AS prefix (subnet) you're currently in. If you then search for that AS#, it'll give you the full set of AS prefixes that are part of that AS#.

For example, if my public IP address was 9.9.9.9, the AS# would be 19281 (QUAD9-AS-1, CH), which is part of the 9.9.9.0/24 prefix. If I then search for 19281, it shows me the full list of prefixes:

9.9.9.0/24
149.112.149.0/24
149.112.112.0/24
199.249.255.0/24
2620:fe::/48

The Windows firewall rule dialog only lets you add one subnet to a rule at once, so you might want to use Set-NetFirewallRule in Powershell to load all the subnets in at once if there are a lot of them for your ASN.

After setting up a firewall rule through the UI, with everything configured except the subnet list, you can add all of the subnets in an array like this:

Get-NetFirewallRule -DisplayName "Restrict RDP to [ISP] subnets" -OutVariable rule

Set-NetFirewallRule -InputObject $rule[0] -RemoteAddress @("1.2.3.0/24", "5.6.7.8/32")