RD Web Access Protection

• How to enable RD Web Access protection
• Advanced settings

RdpGuard monitors IIS logs and Windows Security events to detect brute-force attempts against Remote Desktop Web Access. Configure log discovery below, then use the advanced settings if RD Web Access is behind a reverse proxy.

1. Open RdpGuard Dashboard and click RD-WEB under Monitored protocols.

   

2. Select Enable RD Web protection. Leave automatic log discovery enabled or specify the log folder as described below, then click Save.

   

RD Web Access protection configuration

Automatically detect log files location lets RdpGuard find the IIS website with the /RDWeb application and use that site's log folder. If discovery fails or you need a different folder, clear this checkbox and specify IIS log files location manually.

Select the folder containing the site's u_ex*.log files, for example C:\inetpub\logs\LogFiles\W3SVC1. The number after W3SVC is the IIS site ID; use the folder for the website hosting RD Web Access.

Enable W3C logging for the site and include these fields: Date (date), Time (time), Client IP Address (c-ip), Method (cs-method), URI Stem (cs-uri-stem) and User Name (cs-username).

For correlation with Windows Security events, enable failed logon auditing as described in Recommended Audit Policy Settings. After saving, check View, Show event log in RdpGuard Dashboard for monitoring errors.

Click Advanced settings... in RD Web Settings to open Advanced HTTP Settings. These options control how RdpGuard reads client IP addresses from IIS logs.

Read the client IP address from the X-Forwarded-For field

By default, RdpGuard uses Client IP Address (c-ip) from the IIS log. Behind a reverse proxy, this is usually the proxy's address. Enable this option to use the logged X-Forwarded-For value instead. If it contains several addresses, RdpGuard uses the first one.

Configure your trusted proxy to supply the real client IP and prevent clients from injecting their own first address into the header. Restrict direct access to IIS so requests cannot bypass the proxy. See Configuring IIS to Detect Client IP Behind a Proxy for the IIS logging setup.

Use the connection IP address if X-Forwarded-For is missing

Enable this option to use c-ip when the X-Forwarded-For value is missing. Leave it off if every request comes through a proxy: falling back to the connection address can cause the proxy itself to be blocked.

Click OK, then Save in RD Web Settings to apply the changes.

Blocking requests when using X-Forwarded-For

Reading X-Forwarded-For identifies the client, but does not change where blocking happens. When the connection to your server comes from a reverse proxy, a Windows firewall rule for the original client IP will not block that proxied connection.

Block the client at the proxy, or use IIS IP Address and Domain Restrictions with Proxy Mode and RdpGuard Custom Actions as shown below.

Configuring Custom Actions in RdpGuard

This example adds and removes IPv4 deny entries for one IIS website. Replace RD Web Site in both commands with the site's name in IIS Manager.

1. Install the IIS IP and Domain Restrictions role service if it is not installed.
2. In IIS Manager, select the website, open IP Address and Domain Restrictions, click Edit Feature Settings... and select Enable Proxy Mode. This requires IIS 8.0 or later. See Microsoft's IP Security documentation.
3. Run RdpGuard Dashboard as administrator and open Tools, Custom Actions / Notifications. Add the two actions below.

IP Blocked action

• Event: IP Blocked
• Task: Execute program
• Path: C:\Windows\System32\inetsrv\appcmd.exe

Arguments:

set config "RD Web Site" /section:system.webServer/security/ipSecurity /+"[ipAddress='%IP%',allowed='false']" /commit:apphost

IP Unblocked action

• Event: IP Unblocked
• Task: Execute program
• Path: C:\Windows\System32\inetsrv\appcmd.exe

Arguments:

set config "RD Web Site" /section:system.webServer/security/ipSecurity /-"[ipAddress='%IP%']" /commit:apphost

Save the actions. After a local detection triggers a block, verify that the deny entry appears for the selected IIS site and requests from that client are denied through the proxy. When RdpGuard unblocks the address, the second action removes the entry.

These actions handle future IP Blocked and IP Unblocked events from local detections; they do not synchronize the existing blocked list or addresses blocked only through IP Cloud.