Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've seen plenty of people suggesting that you can limit RDP access to a range of IP addresses by using IPsec instead of using the built in Windows Firewall. This is exactly what I need to be able to do, but I have not been able to find any examples of how to actually set it up...and I'd rather not mess it up and boot myself off the server and not be able to reconnect.

Can anybody explain how to use IPsec to limit RDP access to a range of IPs?

share|improve this question

IPSEC is not the tool for this. You need to use a firewall of some kind: Either the built-in Windows firewall or one positioned elsewhere on your network.

You may want to consider using IPSEC to encrypt & authenticate the RDP traffic in addition to a firewall to restrict access to the RDP port, but these are separate considerations from a security standpoint.

Note that you can effectively use IPSEC to block access to RDP (simply require IPSEC encryption/authentication on all RDP traffic, and anyone trying to talk without encryption/authentication won't get through), but this is a side effect and isn't the most correct approach to restricting access. It also means more work for your server (it's going to try to negotiate IPSEC for each connection attempt, rather than simply refusing the attempt if you use a standard firewall to restrict access to the port).

share|improve this answer
Windows firewall is not really a feasible solution for me right now. I do not want to block any communication besides RDP, and you'd can't just turn on RDP have to add exceptions for everything you want to allow. I can not afford to miss anything and have downtime for this public facing server. – wham12 May 16 '11 at 21:21
@wham12 - this is how firewalls work (at least if they're set up by anyone sane): You block everything and allow only what you need. Conduct an assessment to determine what ports/services you need available (and to whom) and proceed accordingly. A firewall that just blocks one or two ports is the equivalent of trying to stop a tank division with a cardboard cutout... – voretaq7 May 16 '11 at 21:41
I understand that. We have a physical firewall unit seperate from the server, which is configured correctly...but I can not access it's settings (hosted externally). I just need to limit RDP to a certain range of IPs as soon as possible. – wham12 May 17 '11 at 14:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.