Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a VPN connection that I use while away from home to remote into my home network. I would use a zero config solution like Hamachi, but need access from my mobile device. Therefore, I have my Windows Home Server acting as the VPN server and will accept incoming connections. Both the username and password are strong. However, I'm worried about brute force attacks against my network. Is there something else that I should do to protect my network from having unauthorized access attempts to my network?

I'm familiar with Linux's FAIL2BAN, but wasn't sure if something similar existing for Windows.

enter image description here

share|improve this question
mobile device - what kind of connection it uses? – Serge Sep 27 '12 at 3:05
PPTP (PPP encryption(MPPE)) – kobaltz Sep 27 '12 at 3:47
kobaltz I mean connection to the internet, not to your home network – Serge Sep 27 '12 at 3:59
Oh. It's on a cell wireless 4G. – kobaltz Sep 27 '12 at 4:15
Then most likely it is getting the IP address from a constant range. You can ask your provider what range(s) they are using to assign addresses for 4G clients and allow connections only from these ranges. – Serge Sep 27 '12 at 4:28
up vote 0 down vote accepted

You don't outline to what extent you want/need to protect your home network. So I'll outline some broad things to consider.

First, and this is an absolute must: Ensure you are NOT using MS-CHAPv2 (or any other version). As of this summer, MS-CHAPv2 can now be reliably and consistently broken 100% of the time.

Second, consider using RADIUS for additional authentication and logging mechanism rather than using the default Windows userid/password scheme. Microsft RADIUS guide here. FreeRADIUS is a good implementation.

Third, consider two-factor authentication using something like a token. There's both hardware and software tokens. Two examples of software tokens. iPhone and PC client. And an example of a hardware token vendor here.

Next, once clients connect, consider using quarantine control to slow or delay unauthorized users from quickly accessing resources. If an unauthorized user were to defeat your access controls, your quarantine controls would hopefully reject or isolate them to prevent any malicious acts.

Last, here are some of Microsoft's recommendations. VPN best practices here. And security recommendations here.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.