Banning IP's and Only allowing a select few Connect

[DeadBeet]

My server was recently bruted but not successful, and I need to figure out the bruters IP and ban it, is there a way to find out the IP and then ban it from the server entirely?

Also, my server has a Remote Connection option, of which I use to manage it as it is in another state. I want to make it so only me and another IP are even able to get to the login screen. So like, if someone tried to connect to the server who is not at an IP that is on the list, they will not be able to get to the login screen. Is this possible?

Thanks,
Nick

 

[Stevehewitt]

How was it attacked? IIS, RDP etc... need more details. (Although if the attacker knew what they were doing then the IP would either be spoofed or relayed off a probably innocent 3rd party)

Regarding restricting by IP, I suggest you invest in a good firewall! I'm not aware of any inbuild way to filter a service access by IP (other than IIS). I do know that ISA Server would do it, and possibly RRAS might (but I'm not sure).

Either way, having a server on the net without a firewall is asking for trouble. Easiest way is to put in a firewall and filter it that way.




Steve.

"They have the internet on computers now!" - Homer Simpson

 

[DeadBeet]

Ok, thanks for the help!

 

[djbeenie]

Check out IPCop!

http://ipcop.org/

It's a free powerfull firewall thats SUPER easy to configure. Also check out a plugin for IPCop called Banish. You can bock an ip or range attacks are comming from and they can never get through.

http://banish.sidsolutions.net/

*site is down for somereason at the moment*



dj beenie
A+ Net+ MCP

 

[DeadBeet]

Is IPCop a linux application or can it be windows too?

 

[Roadki11]

If you have a cisco router on the perimeter you can setup an access list really easily. Need a sample just say so.

RoadKi11

 

[DeadBeet]

We dont have any AV or Firewall, self-managed server in California..

 

[djbeenie]

How many users will be behind this firewall?
This will determine if this solution is good for your environment.

It is a Linux firewall. It is an OS of its own, BUT you don't have to know linux to install it or configure anything. Depending on how many users you have, you can take an old machine and slap two nics in it. Load the OS and point your browser to

https://yourIPorhostname:445.

dj beenie
A+ Net+ MCP