How to install IPBAN on Windows to protect the RDP port

One of the most common problems with running a Windows server in the cloud is attacks on the RDP port, which can prevent access to the server or, if attackers gain access, lead to the loss of all your data. In this article, we will show you how to install IPBAN, which uses system logs to detect failed login attempts and block IP addresses so they cannot keep trying to access the system.

Enable Windows Firewall

Open Control Panel from "Inicio > Control Panel".

Click "Windows Defender Firewall".

In the menu on the left, click "Turn Windows Defender Firewall on or off".

Enable "Private network settings" and "Public network setting" and click "OK".

The result should look like this.

Steps to install IPBAN

To install IPBAN, open a PowerShell terminal with administrator privileges as follows:

Once PowerShell is open, run the following commands one at a time to download and install IPBAN:

1. Download the installation script:

Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/DigitalRuby/IPBan/master/IPBanCore/Windows/Scripts/install_latest.ps1' -OutFile 'C:\install_ipban.ps1'

2. Allow the script to run:

Set-ExecutionPolicy Bypass -Scope Process -Force

3. Run the installation:

& 'C:\install_ipban.ps1'

During installation, you will be asked to select the service startup type. Type 1 (delayed-auto), the recommended option, and press Enter.

When the process is complete, you should see something similar to the following image, and the configuration file will also open.

Check that IPBAN was installed correctly

Open Windows Services and check that a service named IPBAN has been created and is running.

Now use File Explorer to navigate to "C:\Program Files\IPBan" and check that the file "logfile.txt" is starting to record the actions IPBAN takes.

2021-03-02 14:57:17.3686|WARN|DigitalRuby.IPBanCore.Logger|Initializing service
2021-03-02 14:57:17.4171|WARN|DigitalRuby.IPBanCore.Logger|Detecting os version...
2021-03-02 14:57:17.5149|WARN|DigitalRuby.IPBanCore.Logger|OS version detected: Name: Windows, Version: 10.0.17763, Friendly Name: Microsoft Windows Server 2019 Datacenter, Description: Microsoft Windows 10.0.17763
2021-03-02 14:57:17.5481|WARN|DigitalRuby.IPBanCore.Logger|Running as a Windows service
2021-03-02 14:57:17.6531|WARN|DigitalRuby.IPBanCore.Logger|Preparing to run service
2021-03-02 14:57:17.6955|WARN|DigitalRuby.IPBanCore.Logger|Starting service
2021-03-02 14:57:17.6955|WARN|DigitalRuby.IPBanCore.Logger|Running service
2021-03-02 14:57:18.1923|WARN|DigitalRuby.IPBanCore.Logger|IPBan is free software created and refined over many years.
2021-03-02 14:57:18.1923|WARN|DigitalRuby.IPBanCore.Logger|Please consider upgrading to the pro version for more advanced functions, shared ban lists and much more.
2021-03-02 14:57:18.1923|WARN|DigitalRuby.IPBanCore.Logger|Learn more at https://ipban.com
2021-03-02 14:57:18.1923|INFO|DigitalRuby.IPBanCore.Logger|Initializing IPBan database at Data Source=C:\Program Files\IPBan\ipban.sqlite
2021-03-02 14:57:18.6904|WARN|DigitalRuby.IPBanCore.Logger|IPBan service started and initialized
2021-03-02 14:57:18.6904|WARN|DigitalRuby.IPBanCore.Logger|Log levels: True,True,True,True,False,False
2021-03-02 14:57:20.2096|INFO|DigitalRuby.IPBanCore.Logger|Adding log file to parse: C:/Program Files/Microsoft/Exchange Server/*/TransportRoles/Logs/FrontEnd/ProtocolLog/**.log
2021-03-02 14:57:20.2096|INFO|DigitalRuby.IPBanCore.Logger|Adding log file to parse: C:/Program Files/Smarter Tools/Smarter Mail/**/*.log
2021-03-02 14:57:20.2096|INFO|DigitalRuby.IPBanCore.Logger|Adding log file to parse: C:/Program Files (x86)/Smarter Tools/Smarter Mail/**/*.log
2021-03-02 14:57:20.2167|INFO|DigitalRuby.IPBanCore.Logger|Adding log file to parse: C:/SmarterMail/logs/**/*.log
2021-03-02 14:57:20.2167|INFO|DigitalRuby.IPBanCore.Logger|Adding log file to parse: C:/Smarter Mail/logs/**/*.log
2021-03-02 14:57:20.2167|INFO|DigitalRuby.IPBanCore.Logger|Adding log file to parse: C:/Program Files (x86)/Mail Enable/Logging/SMTP/SMTP-Activity-*.log
2021-03-02 14:57:20.2167|INFO|DigitalRuby.IPBanCore.Logger|Adding log file to parse: C:/Program Files/Mail Enable/Logging/SMTP/SMTP-Activity-*.log
2021-03-02 14:57:20.2167|INFO|DigitalRuby.IPBanCore.Logger|Adding log file to parse: C:/Program Files/Tomcat/logs/**/*access_log*.txt
2021-03-02 14:57:20.2167|INFO|DigitalRuby.IPBanCore.Logger|Adding log file to parse: C:/IPBanCustomLogs/**/*.log

Finally, check Windows Firewall to see whether it has started creating blocking rules. It may take some time before the first IP address is blocked. To check this, go to Inicio > Control Panel > Windows Defender Firewall > Advanced Setting. You should see rules like these:

If you open the properties of one of the rules, you can see that IPBAN created it:

Initial configuration

Open the file "C:\Program Files\IPBan\ipban.config" in notepad and edit the following variables:

 <add key="FailedLoginAttemptsBeforeBan" value="3"/>
 <add key="BanTime" value="02:00:00:00"/>
 <add key="Whitelist" value="IPs_DE_Confianza"/>

For example, if your Internet connection has a static IP address, you can replace "IPs_DE_Confianza" with your connection's IP address. If you do not have one, leave it blank as it is by default.

Also, create a file in "C:\Program Files\IPBan\" named "unban.txt" so that if an IP address is blocked incorrectly, you can add it to this file to unblock it. The file must contain one IP address per line.

With these steps, IPBAN is configured to provide extra security for your server.

We hope this has helped. Have you tried it? Leave us your comments! 🙂

Remember, if you have any questions about this article or anything else related to your servers on Clouding, email us at soporte@clouding.io We are here to help with whatever you need!