Prevent blocked IPs from connecting to your network.
Prevent blocked IPs from connecting to your network.
I searched without success and understand the easiest way is to turn it off completely. Context: My home server uses RDP with port forwarding, allowing remote access from outside my home network. I tend to use it more when away than when I’m present. My question: How can I prevent specific IP addresses from reaching my server entirely? I have a log file from my router showing all attempts that tried to connect and would ignore manual checks. My Netgear Nighthawk router has no built-in feature to block certain IPs specifically. Is there a workaround that doesn’t require changing port forwarding or replacing the router? Perhaps a system in place to block any IP with even one failed login attempt? If needed, I’m okay turning off port forwarding but would prefer not to. As mentioned, I access the server more when I’m not home.
That is a MAJOR no no. Looking at the spec sheet of your router, it seems it supports OpenVPN Connect server to access to your network from outside. Set up your own VPN and connect to your networking using that VPN. Dont go out forwarding 3389, 445 and 139 out in the open.
This method is effective for gaining unauthorized access. As mentioned, utilize an OpenVPN Access Server to connect to your network.
Sending traffic through port 3389 is a serious mistake. Stick with the VPN recommended in your firewall settings. I've dealt with this issue repeatedly across many clients. Once an external IP is blocked, the bot just changes to another one. Avoid relying on geo-blocking either—hackers can easily use servers on bypassed networks. You won't be able to block attacking IPs directly.
Geoblocking provides some level of security. My server records previously showed many attempts to exploit my web and SSH servers, but they ceased once I restricted incoming traffic to just the US and EU via the router. It’s not a perfect solution, but if you’re certain access will only come from a specific country, it adds another defense layer—reducing log clutter as well. Every additional barrier makes it harder for bots to succeed, and it minimizes unnecessary CPU usage by dropping traffic directly at the firewall instead of sending it all to the server.