0

I'm managing a Server 2008. I need to access it by Remote Desktop on 3389.

But I'm experiencing several Brute-Force attacks on 3389 per day.

I notice that it always comes from the same workstation, but with different IPS. I then assume that the hacker is using a proxy.

My question: Is there a way to block Proxy incoming connections for 3389 on the firewall or elsewhere?

Thanks, Zoe

4
  • Can you not white list the IPs / subnet that you are connecting from?
    – arco444
    Jan 28, 2014 at 13:12
  • Yes, of course I can do that, but it's a hard work regarding the fact, that I need to access this server from different places(no proxies) in various countries. Isn't there a simple way to detect incoming connections from proxy IP's and Block them ?
    – user293981
    Jan 28, 2014 at 13:24
  • sounds like a good reason to use a VPN. Set up some kind of VPN at the server and use the firewall to only allow remote connections from the VPN server IP.
    – PsychoData
    Jan 28, 2014 at 13:27
  • I can't think of any way you could possibly detect if an IP is being used as a proxy or not. If you are being hacked, you can't even be sure the hacker is using a proxy. What's to say he/she doesn't have control of hundreds of compromised machines from which the attacks are being directly launched?
    – arco444
    Jan 28, 2014 at 13:31

1 Answer 1

0

Block all connection from outside of your network and create a vpn in case you need to access it from different places.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .