-2

i got issue with ransomware attacks day and night from Russia/Ukraine...

even with secure rdp some of them get passes now and then and make me suffer...

so i want to block geo block whole Russia/Ukraine till Microsoft actually think of something and patch this issue...

there is no GeoBlock as far as i know in firewall

so i downloaded http://www.ipdeny.com/ipblocks/ ip's based by country

i know this command netsh advfirewall firewall set rule name = " .....

but it only add up to thousand ip's and if i re run it for next thousand it delete previous batch and replace it with new ones...

i saw some netsh advfirewall firewall add rule name = "

but couldn't figure it out what do i misses to make it work

here is the sample i run

C:\Users\User>netsh advfirewall firewall add rule name = "RussiaOutBlock" new remoteip = "2.16.159.0/255.255.255.0" One or more essential parameters were not entered. Verify the required parameters, and reenter them.

i appreciate insight on this matter of if there is easier way to solve this problem

thank you

closed as off-topic by kasperd, Drifter104, Dennis Kaarsemaker, Dave M, fuero Sep 19 '18 at 15:56

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – kasperd, Drifter104, Dennis Kaarsemaker, Dave M, fuero
If this question can be reworded to fit the rules in the help center, please edit the question.

1

This is entirely the wrong approach.

First, if you have "secure RDP", how come the attackers get through anyway? This is not normal.

Second: This would be unreliable, as you are now still vulnerable to non-russian IPs attacking you...

Solution: Don't expose the RDP port directly. Put all your stuff except things that need to be public behind a global firewall and only allow access via a secure and proven VPN (e.g. not PPTP) or otherwise secure method like SSH port forwarding.

  • yup, thats indeed abnormal, as far as i checked with sophos they re-engineered NSA exploit and breakthrough even i have windows-firewall trendmicro even changed rdp port in registry ... quiet headache – Amin MyCard Aug 31 '18 at 6:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.