Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I created a windows firewall rule restricting access to port 3389 (RDP) to only one Remote IP. However, I'm still able to Remote Desktop from other machines... Why would this be? Even if I disable the rule for port 3389 entirely I'm still able to connect. I've also confirmed that all 3 profiles (Domain, Public and Private) are set so that "inbound connections that do not match a rule are blocked".

Here are my firewall rules for incoming connections which I exported from Windows Firewall with Advanced Security.

I replaced actual IPs in the list with "Trusted IP", "Trusted IPs", "Public IP" and "Public IP".

I'm using Windows Server 2008 R2 and Windows Firewall with Advanced Security 6.1

share|improve this question
add comment

2 Answers

You're explicitly allowing one IP, but are you blocking the rest of them? Since you note that disabling the rule allows you to connect, I'd suggest that by default there's nothing blocking the port, so making an 'allow' whitelist exception is liable to not accomplish anything. I'd suggest you trying blocking it first, then give priority to the allow.

share|improve this answer
    
All 3 profiles (Domain, Private and Public) are set so that "Inbound connections that do not match a rule are blocked". So yes, the rest are blocked. There must be a rule in my list which is allowing TCP connections to port 3389, but I can't tell which... Unless there is something else I haven't thought of. Any other suggestions? –  David Apr 20 '11 at 1:31
add comment

I've had the same/similar problem. I have one ip (mine) that I want to use to access my database ports, (not a dozen chinese IPs that connect every 10 seconds and bloat my log files to 100MB every day). My default is set to allow (lot's of services running, and don't want to accidentally turn off something, I know, it's bad) but I want to limit malicious activity on the 1433 port, so I set up a block rule with a range that excludes my IP as shown bellow. this (sample) would allow anything from 170.181.. (with the exception of 170.181.0.0)

limit IP

you could also adjust to a tighter (single IP) rule

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.