How to Enable and Configure RDWeb Access Protection
To Enable RDWeb Access Protection
1. Launch the Dashboard and click the link next to RDWeb Access Protection:
How to enable RD Web Access Protection in RdpGuard
The RDWeb Protection Settings dialog will open:
RDWeb Protection Settings dialog
2. Check Enable RDWeb Protection and click Save
RDWeb Access Protection Configuration
Automatically detect log files location - by unchecking this option you have the ability
to manually specify the IIS logs directory for the RDWeb Access website.
In most instances, RdpGuard is capable of detecting the IIS log files location automatically.
However, in rare cases, you might need to manually specify it.
Advanced Settings
Clicking the "advanced settings" link will open the Advanced HTTP Settings dialog where you can
configure additional HTTP protection settings.
Advanced HTTP Detection Engine Settings
Use the X-Forwarded-For field to read client IP address
By default, RdpGuard reads the client IP address from the Client IP field in the IIS log.
If your web server is behind a proxy server, you may need to enable this option to read the client
IP address from the X-Forwarded-For field.
This option should only be enabled if you are hosting the website behind a proxy.
Note: Proper configuration of your proxy server and IIS logging is required for this feature to work correctly.
When using the X-Forwarded-For option, the default blocking mechanism may not work as expected because
banning the real client IP must be done on the proxy level. Without additional configuration, the blocking will not
actually occur.
To ensure requests from detected malicious IPs are blocked, you can use IIS IP Restrictions combined with
Custom Actions in RdpGuard.
Configuring Custom Actions in RdpGuard
Follow these steps to configure IIS to block IPs based on RdpGuard detections:
Ensure that the IP and Domain Restrictions feature is installed in IIS.
Enable IIS IP Restrictions to prevent requests from blocked IPs.
Use Custom Actions in RdpGuard to dynamically update the IIS IP block list when a new malicious IP is detected.
Configure the following actions in RdpGuard:
IP Blocked Action
Task: Execute program
Path:c:\Windows\system32\inetsrv\appcmd.exe
Arguments:
set config /section:system.webServer/security/ipSecurity /+"[ipAddress='%IP%',allowed='false']"
IP Unblocked Action
Task: Execute program
Path:c:\Windows\system32\inetsrv\appcmd.exe
Arguments:
set config /section:system.webServer/security/ipSecurity /-"[ipAddress='%IP%']"
With this setup, detected malicious IPs will be automatically added to the IIS IP restrictions list, effectively blocking their requests.
"This sotware is really great. It's a relief. Because my server is constantly under attack. Thanks RdpGuard"
- Joaquim De Sousa Marques
"Nice product. I used to implement something similiar in a low-tech and cumbersome manner via a script called
TSBlock (not mine). This makes it much easier and is well worth the pricetag for SMB's."
- J. Johnson
"Absolutely amazed at your product. We are a church in the North Dallas area,
and I discovered this morning multiple failed logon attempts via our Remote Access Server.
A friend suggested your product, so I immediately downloaded the trial.
It had a list of about five blocked IP addresses in minutes, and that was enough to
lead me to push the BUY button. Over the past 10-15 minutes the list is now about thirty with at least a
third being international attempts to break into our system.
Thanks for a great product. You may have just saved us much grief."
- John Hallford
"Love the software. RDP on our Windows servers is just ridiculous.
We would block it in the router but we have lots of old-time customers that would have issues."
- Scott Hirsch
"Love the software! Makes it easier than tailoring VB Scripts!!"
- Nick Brennan
"It's a great product - really stopping those RDP attackers :-)"
- Dave, UK
"First of all: Your application is very (!!!) useful and I like it very much securing my 2012 R2 server.
RdpGuard is the best solution, I found on the market and after 10 minutes of testing it I ordered the fully-featured version. :-)"
- Carsten Baltes
