2

I am search to find a program, or a way to block ips that make port scan on the server.

The goal is to hide some ports like remote desktop on a different port. So some are search the port with port scanning to locate this port and start the attacks.

The server is running Windows Server 2008 64-bit, and its a remote administrate server with iis and mail services mostly.

In previus versions of Windows Servers (eg on 2003) I use the comodo firewall that have this ability, but on 2008 comodo just not work and I am searching for something else but still did not found any.

Can you please give me some ideas/solutions ?
Thank you in advanced.

Improve this question
4
  • edited my answer below.
    – gravyface
    Feb 25, 2011 at 13:33
  • 1
    Blocking port scanning is security by obscurity - which is no security at all. I wouldn't waste my time worry about port scans, just lock down the firewall and secure the few services that are allowed through.
    – Chris S
    Feb 25, 2011 at 14:15
  • @Chris I like what you say, but I need some more reasons, can you please give me an example why I do not waste my time on that block ?
    – Aristos
    Feb 25, 2011 at 20:10
  • today's 'hackers' aren't after well protected machines/networks. They're botnets, looking to expand their network. They're looking for easily exploitable low-hanging fruit to use as a platform to launch other attacks. If you change the port a service normally operates on, the botnets will never find it. If on the other hand a clandestine organization is bent on hacking your server, they'd quickly realize after trying X ports, an IP gets blocked, so they'd use hundreds of ports (botnet?) to try all the ports. If your IPS blocked all IPs, it'd be an effective DDoS.
    – Chris S
    Feb 25, 2011 at 20:38

3 Answers 3

Reset to default
3

I'd really want a hardware firewall in front of this server if it's exposed to the Internet.

Also, use IP restrictions in whatever firewall you end up using to only permit RDP access from certain hosts/IP ranges. This will eliminate your typical, random port scanning.

EDIT

If you can't restrict access by IP address/range, have a look at Snort, an Intrusion Detection/Prevention System, that's free/open source and runs on Windows*.

*Have not used it on Windows 2008 64-bit, but can confirm it does work on win32.

Improve this answer
3
  • Well this is a good option on a full control system by me, but I am on a shered network leasing a computer and I can not have this options - nether can ask for a common firewall that shere this with the other servers. I need to protect my server with my procedure/software
    – Aristos
    Feb 24, 2011 at 13:28
  • If you control the Windows 2008 Firewall, you can put in IP restrictions.
    – gravyface
    Feb 24, 2011 at 17:12
  • +1 for the snort and thank you. - I will check it today
    – Aristos
    Feb 25, 2011 at 20:12
0

Windows Server 2008 have a (good) firewall. Switch it on.

http://technet.microsoft.com/en-us/library/cc772589(WS.10).aspx

Improve this answer
1
  • Is ON anyway, but is not what I ask for. I ask for blocking port scanning.
    – Aristos
    Feb 24, 2011 at 15:44
0

This is a dawdle with Linux or BSD. Upgrade to a real operating system or put a good quality scriptable firewall in front of it?

The NT firewall is scriptable - using netsh advfirewall.

So you'd just need to write a server daemon to listen on several ports either side of the one you're wanting to protect then add a blocking rule for that IP address. You'll also need to maintain a list of what IP's you've blocked and when so you can remove the rules later and prevetn the table getting too large.

But a much better solution is to use whitelisting to only allow specific clients - or a VPN.

Improve this answer
2
  • Well I do not know Linux or BSD and my programs and pages are all on windows. I just have to live with that. The whitelist is an option that I can not do because we login from non static ips.
    – Aristos
    Feb 24, 2011 at 15:47
  • Then use a VPN or tunnel via SSL with client authentication
    – symcbean
    Feb 27, 2011 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .