Microsoft VPN (RRAS) Protection Settings

RdpGuard's Microsoft VPN (RRAS) protection monitors failed VPN authentication and IPsec negotiation events in Windows event logs. It blocks a source IP address when detections reach the configured limit. The module watches these two event sources:

• System log, RemoteAccess, Event ID 20271 - failed RRAS authentication attempts.
• Security log, Event ID 4652 - failed IPsec Main Mode negotiations. Events recognized as Negotiation timed out are ignored automatically.

In Event Viewer, Windows Logs, check the System and Security logs for new events from your VPN server. Each supported event must contain a valid remote IP address. For event 4652, enable Failure auditing for Audit IPsec Main Mode under Advanced Audit Policy Configuration, Logon/Logoff in the policy applied to the server. See Microsoft's IPsec Main Mode audit documentation.

1. Run RdpGuard Dashboard as administrator. Under Monitored protocols, click MS-VPN to open its settings. This protection is disabled by default.

   

2. Select Enable MS VPN protection and click Save. RdpGuard saves the settings and restarts its service automatically.

   

To adjust the failed-login limit or block duration, open Tools, Options, General. The whitelist also applies. By default, blocked addresses lose access to all server ports. If you use blocking for selected ports, make sure your rules cover the VPN traffic you intend to block.

If an address is not detected, check for new 20271 or 4652 events and inspect their remote IP address and failure reason. If it is detected but not blocked, check the configured limit, whitelist and exclusion rules. Monitoring errors and messages about excluded events appear under View, Show event log in RdpGuard Dashboard.

Exclusion rules skip matching VPN events before RdpGuard counts them toward blocking. Use them for specific, understood failures that should not trigger a block. In MS VPN Settings, select Enable MS VPN protection and click Exclusions.... Enter your rules, click OK, then click Save in the settings dialog to apply them.

Rule syntax

• Write one rule per line. A match against any line skips the event (OR).
• Separate conditions with commas. All conditions on the same line must match (AND).
• Use = to match a value or != to match a different value. The field must exist in the event for either operator.
• The wildcard * matches any sequence of characters.

For example, these rules exclude a particular user/IP combination in RemoteAccess events, or an IPsec policy mismatch from the same address:

IpAddress=203.0.113.25,TargetUserName=vpn-user
RemoteAddress=203.0.113.25,FailureReasonShort=PolicyMatchError

The first line applies to event 20271; the second applies to event 4652. Replace the example address and values with those from events you have reviewed. Other failures from that address remain eligible for detection unless they match another exclusion or the address is whitelisted.

Keep exclusions narrow. An attacker can attempt a known username, so a rule matching only that name also skips an attack using it. Likewise, a broad rule such as FailureReason=*password combination* would skip common bad-password events from any source. Combine relevant conditions on the same line when you need a restriction.

Event ID 20271, RemoteAccess

Windows records this event's data as positional values. RdpGuard adds the following names for use in exclusion rules; these aliases do not appear in the original event XML. A field is available only when its source value is present and nonempty.

• ConnectionId or SessionId - connection/session identifier.
• User - the user value recorded by Windows, such as domain\vpn-user.
• TargetDomainName - the domain from a domain\user value.
• TargetUserName - the username after the backslash, or the full user value when no domain prefix is present. A user@example.net value remains intact.
• IpAddress or IPString - remote IP address.
• FailureReason or Reason - authentication failure reason text.
• ErrorCode - error code recorded by Windows.
• Binary - binary payload value, when present.

Event ID 4652, IPsec

For this event, RdpGuard uses the named fields from the Windows event XML. Useful fields include:

• RemoteAddress - remote IP address; use this field in IPsec exclusions.
• LocalAddress - local endpoint IP address.
• RemoteMMPrincipalName - remote principal recorded for the Main Mode negotiation, when available.
• FailureReason - the failure reason recorded by Windows.
• FailureReasonShort - a normalized reason added by RdpGuard, such as PolicyMatchError or IKEAuthCredentialsUnacceptable. Unrecognized reasons use Unknown.

To check the original names and values, open the event in Event Viewer, select Details, then XML View, and inspect its EventData elements. The additional FailureReasonShort field exists only inside RdpGuard. Use the field names for the event you are targeting: the IpAddress alias from event 20271 is not added to event 4652.