Block IP's from accessing my network?

[MrSimplicity]

I googled to no avail. And I know the simplest solution is disabling it out right.

 

Background: I have RDP enabled on my home server and port forwarded so that I can access it from elsewhere when I'm not home. I access it more often when I'm not home than when I am.

Question: I need to figure out how to block specific IP's from my network entirely. I have the log file from my router with all the IP's that have tried accessing my server and would not care if I had to enter every single one manually. I have a netgear nighthawk router and after googling a solution found that netgear does not have a service that has a feature to specifically block IP's.

Is there anyway to do this that wouldn't require me to disable to the port forward or to buy a new router? Or maybe something I can setup to block any IP that has a failed login attempt even once?

If it comes down to it I'll just disable the port forward but I would very much rather not. As I said I access my server more when I'm not home.

[Levent]

3 hours ago, MrSimplicity said:

Background: I have RDP enabled on my home server and port forwarded so that I can access it from elsewhere when I'm not home. I access it more often when I'm not home than when I am.

That is a MAJOR no no. Looking at the spec sheet of your router, it seems it supports OpenVPN Connect server to access to your network from outside. Set up your own VPN and connect to your networking using that VPN. Dont go out forwarding 3389, 445 and 139 out in the open.

[Vishera]

2 hours ago, MrSimplicity said:

I googled to no avail. And I know the simplest solution is disabling it out right.

 

Background: I have RDP enabled on my home server and port forwarded so that I can access it from elsewhere when I'm not home. I access it more often when I'm not home than when I am.

Question: I need to figure out how to block specific IP's from my network entirely. I have the log file from my router with all the IP's that have tried accessing my server and would not care if I had to enter every single one manually. I have a netgear nighthawk router and after googling a solution found that netgear does not have a service that has a feature to specifically block IP's.

Is there anyway to do this that wouldn't require me to disable to the port forward or to buy a new router? Or maybe something I can setup to block any IP that has a failed login attempt even once?

If it comes down to it I'll just disable the port forward but I would very much rather not. As I said I access my server more when I'm not home.

That's a great way to get hacked...

 

As @Levent said use OpenVPN Access Server to access your network.

[Denniz]

4 hours ago, MrSimplicity said:

I googled to no avail. And I know the simplest solution is disabling it out right.

 

Background: I have RDP enabled on my home server and port forwarded so that I can access it from elsewhere when I'm not home. I access it more often when I'm not home than when I am.

Question: I need to figure out how to block specific IP's from my network entirely. I have the log file from my router with all the IP's that have tried accessing my server and would not care if I had to enter every single one manually. I have a netgear nighthawk router and after googling a solution found that netgear does not have a service that has a feature to specifically block IP's.

Is there anyway to do this that wouldn't require me to disable to the port forward or to buy a new router? Or maybe something I can setup to block any IP that has a failed login attempt even once?

If it comes down to it I'll just disable the port forward but I would very much rather not. As I said I access my server more when I'm not home.

You should never forward smb ports...

[Alex Atkin UK]

19 hours ago, Denniz said:

You should never forward smb ports...

While true, there is nothing there suggesting they are forwarding SMB, only RDP (which is also a no no of course).

[wseaton]

Forwarding port 3389 is a really bad idea. Use the VPN as suggested on your Firewall.

 

I've gone rounds with this problem with countless clients. As soon as you block an external IP the bot will simply move to another IP. Don't bother with geo blocking either. The bad guys are smart enough to rent servers on networks that get around this. You cannot actively filter attacking IPs. 

[Alex Atkin UK]

46 minutes ago, wseaton said:

Forwarding port 3389 is a really bad idea. Use the VPN as suggested on your Firewall.

 

I've gone rounds with this problem with countless clients. As soon as you block an external IP the bot will simply move to another IP. Don't bother with geo blocking either. The bad guys are smart enough to rent servers on networks that get around this. You cannot actively filter attacking IPs. 

Geoblocking does help, my server logs used to be absolutely full of exploit attempts on my web and SSH servers and they all stopped once I limited incoming to US and EU only at the router.  Its not foolproof by any means, but if you know you will never access from outside a specific country anyway, its another layer of protection - or at least cuts down on log spam.

 

Basically every extra layer you have to deter people will encourage the bots to move along to someone else.  Plus it cuts down on how much of a resource hog it is as its dropped straight at the firewall rather than making it to the server and wasting CPU cycles.