Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 11 replies
  • Answers 1 answer
  • Subscribers 7 subscribers
  • Views 7357 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Help, getting attacked

Bob Hasy

Hello, today I realized that someone is trying to brute force my RDP Server since a few days.

So I switched of the NAT rule for RDP.

Still the attack keeps going on, the UTM does its work and drops the packets. Since I am getting attacked from multiple IP Adresses, is there anyway to stop this?

Or do I just have to wait until the attacker is stopping it?

Thank you for your thoughts!



This thread was automatically locked due to age.
Parents
  • 0

    #1 - NEVER use nat for a service such as rdp.  Setup a vpn with 2fa for accessing such a dangerous internal service such as this.  I personally feel anyone who has rdp available publicly should be whipped with a wet noodle. Just no.. no no no no no. Good on you for turning it off, now never ever turn that on again.

    #2 - your firewall is doing its job, though you can create an IP group where you collect all these Ip addresses, put it top of your firewall rules as a drop rule, or a nat to blackhole (non-existant ip address).  See #2 community.sophos.com/.../rulz

    #3 - Also consider looking up the various IP addresses in geoip to see if consistently from another country you can consider blocking, though the 13.64 seem to be USA

Reply
  • 0

    #1 - NEVER use nat for a service such as rdp.  Setup a vpn with 2fa for accessing such a dangerous internal service such as this.  I personally feel anyone who has rdp available publicly should be whipped with a wet noodle. Just no.. no no no no no. Good on you for turning it off, now never ever turn that on again.

    #2 - your firewall is doing its job, though you can create an IP group where you collect all these Ip addresses, put it top of your firewall rules as a drop rule, or a nat to blackhole (non-existant ip address).  See #2 community.sophos.com/.../rulz

    #3 - Also consider looking up the various IP addresses in geoip to see if consistently from another country you can consider blocking, though the 13.64 seem to be USA

Children
No Data
Unfiltered HTML