Auto Block IP Windows 2003
Posted by directhostinguk, 05-06-2007, 02:39 PM Anyone got any ideas how to detect and block IPs automatically using RRAS I have a problem with people trying to connect to MsSQL. I cant close this port because I allow clients remote access. I have so many it feels the windows event log. I know you can run this command to add a IP and Port to RRAS Just need to find away of detecting them netsh routing ip add filter name="Local Area Connection" filtertype=OUTPUT srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=xxx.xxx.xxx.xxx dstmask=255.255.255.255 proto=TCP srcport=0 dstport=1433 Thanks in advance Last edited by directhostinguk; 05-06-2007 at 02:43 PM.
Posted by besty, 05-06-2007, 04:09 PM Better make use of any firewall like Visnetic. FOR Ex: VisNetic Firewall lets you block IP addresses or ranges of addresses to prevent unwanted connection attempts. This can be particularly effective in stopping repeated requests from a hacker who is trying a large number of hacks, looking for one that works
Posted by directhostinguk, 05-06-2007, 04:27 PM This isn't a rang I've got eveything from 61 - 219
Posted by tweakservers, 05-07-2007, 10:48 AM perhaps changing your MS SQL listening port to alternative port will helps in this issue. However, your client will need to enter the correct port on their connection string to be able to connect.
Posted by plumsauce, 05-07-2007, 05:54 PM The only feasible ways I see of doing this are: 1. limit logins to static ip's and have your RRAS setup to only allow these source addresses through on 1433. 2. use port forwarding of port 1433 over ssh tunnels and require your customers to use ssh. .
Posted by directhostinguk, 05-07-2007, 06:06 PM I'm looking at doing something in VB that will read the Event Log if there is more than 10 failed logins in 10 minutes then I'll block that IP and send me a email.