Please understand that I have been through all the posts regarding this issue and my issue has not been resolved which is as follows: I have a brand new installation of Server 2008 R2 SP1, with all updates installed and with no modifications to any of the firewall rules nor any added rules of my own. I want to restrict RDP access to certain IP addresses only using the scope tab of the Remote Desktop (TCP-In) rule but it simply is not functioning as it should. This rule is set to cover all network profiles and all network interfaces of the server.However, I can still Remote Desktop in from ANY IP address. Where else can I investigate?


I have found the issue, there was an inbound rule called tcp all that was allowing all tcp ports from 0-65535 that was enabled and as a result was not blocking the IP address as it was supposed to. I disabled the rule and all is working correctly now. thank you to all that assisted, much appreciated. Note that I have NO idea where this rule came from but it was not on another server that I checked, which is how I found it to begin with. Thanks again.

  • Open the "Windows Firewall with Advanced Security"
  • Choose the "Inbound Rules"
  • Goto the "RDP Rule" / Edit
  • Chosse the "Scope" section
  • Edit the "Remote IP Adresses"

Screenshot from Server 2012 but Server 2008 R2 is very similar

enter image description here

For every rule you may have three profiles (Domain Networks, Private Networks, and Public Networks). Take care to use the wanted profile.

  • as explained above that is EXACTLY what I have done to the letter. – Mark de Wet Oct 31 '18 at 10:53
  • @MarkdeWet did you use the correct profile and is the profile active? – marsh-wiggle Oct 31 '18 at 11:02
  • 1
    @MarkdeWet You need to edit your question to provide details about exactly what you have done. Right now it is only a vague description. – Michael Hampton Oct 31 '18 at 11:58
  • @boboes yes I used all profiles and all profiles are active. @ Michael Hampton I'm sorry but I really cannot see how much more explicit I can be. – Mark de Wet Oct 31 '18 at 12:07
  • @MarkdeWet check the remote ip which conects to port 3389 using „netstat -abn“ at the Terminal Server (also IPv6). Is it the expected adress? – marsh-wiggle Oct 31 '18 at 12:55

Firstly, you should do these changes not only to the TCP IN rule.
RDP (at least on a Server 2012 R2) has three different Inbound rules:

  1. TCP IN (Port 3389)
  2. UDP IN (Port 3389)
  3. TCP IN (Random Port to shadow a Session.)

Hope that helps, the rest is answered by boboes.

Maybe your Firewall is disabled, you can't see that in the "Windows Firewall with Advanced Security", but under: Control Panel -> System and Security -> Windows Firewall

  • HI noelli, no sorry Server 2008 R2 SP 1 only has 2, that is Remote Desktop (TCP-In) and Remote Desktop-Remote FX (TCP-In) – Mark de Wet Oct 31 '18 at 10:52
  • @MarkdeWet Seeing your Comments on Boboes answer, i ask myself, is your Firewall even activated? You don't see that in the "Windows Firewall with Advanced Security" Window but in your Systemcontrol. If it is activated, are you in an Domain and have Group-Policies eventually overriding your settings? – noelli Oct 31 '18 at 13:51
  • yes my firewall is activated, no I am not on a domain and I have not configured any GPOs to override any firewall settings. As I have stated this is a brand-new installation of Server 2008 R2 SP1, nothing else has been set up or installed or anything like that. – Mark de Wet Oct 31 '18 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.