Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Looking at my Event Log I see that right now an attempt is being made at brute forcing my 'sa' user for Sql Server on my Windows Server web edition box. I know that firewall rules are not the only solution, but I thought this could be a learning experience. I created a rule to block the offending IP address from inbound traffic for all applications.

The problem is, as I watch, the same IP address continues to log unsuccessful log in attempts. Does anything else have to happen before a rule goes live? Do I need to restart something? Could another setting be over-ruling the new rule? Thanks

share|improve this question
I would suggest running a stateful-inspection firewall that blocks access on your SQL port. It's generally not a good idea to allow just any old packet wandering in off the network to attempt to connect to services on your machines. If you NEED machines outside your network to directly access your database, you ought to be running some form of VPN solution to encrypt and secure that traffic. – Magellan Jan 27 '12 at 15:37
@AdrianK - thanks for the suggestions. There are definitely various aspects of this server that I have yet to nail down, I just wasn't sure what the implementation time was like for a Firewall Rule or if I had done something wrong, it happened to be the second of those options. – Justin C Jan 27 '12 at 17:17
I'd give you additional information on how to do this in Windows, but I'm a Linux guy and don't do Windows "routing". No sense in burning another Win license when a lightweight Linux machine does it cheaper, faster, and better. – Magellan Jan 27 '12 at 18:12
up vote 1 down vote accepted

Solved my own question. It seems when I created the rule I added the IP address I wanted to block to the "Local IP address" group and not the "Remote IP address" group. When I later added the IP to the remote group, after the rule had been created, it still didn't go into effect. When I created a new rule though, and added the IP address I wanted to stop to the Remote section correctly, everything worked as it should.

Of course, a few hours later I was just getting hit by another IP address.

share|improve this answer
Please remember to accept your own answer. :-) – Nic Feb 5 '12 at 9:23
@nic - thanks, forgot about that – Justin C Feb 6 '12 at 5:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.