34

Can anyone recommend a fail2ban-like tool for a Windows OS? I've got a couple of Windows Media servers that get hammered with brute force authentication attempts. I would like to plug these authentication failures into some kind of blocking tool.

2
  • Could you provide some clarification? What are you trying to accomplish? What version of Windows? Are you trying to block bad logins to PCs, network shares, Terminal Servers, IIS-hosted pages, etc?
    – Skawt
    Commented Jun 18, 2009 at 6:20
  • Clarified my question.
    – nurikabe
    Commented Jun 18, 2009 at 9:45

9 Answers 9

33

I know of no tool that will do this "out of the box". I wrote a script to do something like this with failed OpenSSH logons on Windows, but I can't share it with you because it "belongs" to the Customer for whom I wrote it.

Having said that, it was a simple VBScript program that had an event log sink to watch for new failed logons and, if enough happened in a time window, add an IP route (using the "route" command) to route traffic to the offending IP address to a "MS Loopback Adapter" on the system.

For other types of logs, it would be a fairly trivial matter to write. Since I didn't have IPtables on Windows, the loopback adapter seemed like the next best thing. (You can't do a "route x.x.x.x mask 255.255.255.255 127.0.0.1" on Windows-- you need an adapter to route the traffic to, because the 127.0.0.1 loopback isn't a "real" interface on Windows.)

(If you want something like this written, contact me out-of-band and we can discuss the specifics of such an arrangement.)

Edit:

I decided to write something to do this and I've released it under a Free license.

6

I recently installed IPBan on Windows Server 2019:
https://github.com/digitalruby/ipban

And it's radically decreased number of failed RDP logins:
Failed RDP logons

3
  • what's the name of this "dashboard"?
    – Kreker
    Commented Feb 10, 2021 at 9:32
  • 1
    @Kreker, that's Discover app in the Kibana. The data is sent by Winlogbeat.
    – Slavik
    Commented Feb 11, 2021 at 8:02
  • Ipban runs on Linux and windows ;)
    – jjxtra
    Commented Apr 19, 2021 at 2:27
4

EvlWatcher

What's EvlWatcher?

It's basically a fail2ban for windows. Its goals are also mainly what we love about fail2ban:

pre-configured
no-initial-fucking-around-with-scripts-or-config-files
install-and-forget
1
  • always the first thing I install on a cloud server
    – JJS
    Commented May 12, 2022 at 13:21
3

Check out this project - ts_block

I'm using it and thus far its terrific (Windows Server 2008 R2 RDS, system is behind a firewall but I didn't feel like using an ssl vpn gateway to the server)

1

wail2ban claims to be a Windows port of fail2ban

1

I found a tool called RdpGuard (https://rdpguard.com) that starts at $79 and appears like it might work. I haven't tested it yet, but might give it a go for my SMTP solution.

4
  • 1
    It would probably be a good idea to have used the product, before you make the recommendation. Commented Jul 14, 2017 at 19:35
  • A VM hosting company I started using includes a copy on their Windows VMs. It does the trick, and there are hundreds of firewall entries after just a few weeks.
    – atmarx
    Commented Jan 8, 2019 at 12:05
  • I've been using this lately and it works extremely well. I recommend it. I love how it's an easy install with a GUI interface. There are no scripts to set up and run. It's all-inclusive and allows a lot of auto-blocking beyond just RDP, such as SMTP, MySQL, MS SQL, and more if there are failed logins. Very configurable. I have no affiliation with the company that makes this program, just FYI. Commented Feb 20, 2020 at 20:47
  • Ipban is free and has a one click install
    – jjxtra
    Commented Apr 19, 2021 at 2:26
1

You may check Win2ban which is a Fail2ban implementation for Windows systems. It is a packaging of Fail2ban, Python, Cygwin, Winlogbeat and many other related tools to make it a complete and ready-to-use solution for brute-force attack protection.

NB! We are the developer of the solution.

0

It doesn't look like fail2ban runs on windows at all, as it requires iptables which is only available on Linux.

However, I would suggest that you block everything and white-list only the IPs/names you want to be able to connect to the server(s) in question, if at all possible.

0

Another option that I've found is QaaSWall, I haven't tested it yet, but I will be in the next day or so.

1
  • Doesn't work on x64 actually, @Evan I'm using your script
    – Matt Bear
    Commented Oct 18, 2013 at 21:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .