Protect Remote Desktop Connection on Windows Server 2022 Using Firewall

Securing your Remote Desktop Protocol (RDP) connection on a Windows Server 2022 is a Critical step in safeguarding your server from unauthorized access and cyber threats. While RDP is convenient for remote management, hackers who exploit weak configurations or unprotected connections often target it. One of the most effective ways to enhance security is to use the built-in Windows Firewall.

In this article, we’ll explore detailed steps and best practices for using the firewall to protect your RDP connection on Windows Server 2022.

---

Understanding the Importance of Securing RDP

RDP is widely used for remote management and troubleshooting, but its accessibility makes it vulnerable to:

• Brute-force attacks: Automated attempts to guess login credentials.
• Unauthorized access: Exploitation of weak or default passwords.
• Ransomware deployment: Attackers use RDP as an entry point for malware.

A properly configured firewall acts as the first line of defense, filtering and restricting incoming traffic to ensure only authorized connections are permitted.

---

Setting Up and Configuring Windows Firewall

Windows Server 2022 comes equipped with Windows Defender Firewall, a robust tool for managing and controlling network traffic.

Step 1: Open the Windows Defender Firewall

1. Open the Server Manager and click on Tools in the top-right corner.
2. Select Windows Defender Firewall with Advanced Security from the drop-down menu.

This interface provides access to inbound and outbound rules, allowing you to customize traffic settings.

---

Configuring Inbound Rules for RDP

Inbound rules determine which external connections are allowed to access the server.

Step 2: Enable RDP Rule

1. In the Windows Defender Firewall with Advanced Security window, select Inbound Rules from the left-hand menu.
2. Look for the Remote Desktop (TCP-In) rule.
3. If it’s disabled, right-click and select Enable Rule.

This allows RDP traffic through the default port (3389) unless modified.

---

Step 3: Restrict IP Address Access

Limiting RDP access to specific IP addresses enhances security by allowing only trusted devices to connect.

1. Right-click on the Remote Desktop (TCP-In) rule and select Properties.
2. Navigate to the Scope tab.
3. Under Remote IP address, select These IP addresses and click Add.
4. Enter the IP addresses or ranges you want to allow and click OK.

This ensures that only specified addresses can access your server via RDP.

---

Step 4: Change the Default RDP Port

Changing the default RDP port from 3389 to a non-standard port adds an extra layer of obscurity.

1. Open the Registry Editor (regedit).
2. Navigate to:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp.
3. Locate the PortNumber key, modify it, and enter a new port number (e.g., 3390).
4. Update your inbound firewall rule to allow traffic on the new port:
   • Create a new inbound rule for the chosen port in the Windows Defender Firewall with Advanced Security.

---

Using Advanced Features for Enhanced Protection

Step 5: Enable Network Level Authentication (NLA)

NLA requires users to authenticate before establishing a connection, reducing the server's exposure to unauthorized access attempts.

Steps:

1. Open the System Properties dialog.
2. Go to the Remote tab.
3. Select Allow connections only from computers running Remote Desktop with Network Level Authentication (NLA).

NLA works seamlessly with firewall rules to ensure that only authenticated users can connect.

---

Step 6: Implement Geo-Blocking

Geo-blocking restricts access to your server based on geographical locations.

Steps:

1. In the Windows Defender Firewall with Advanced Security, create a new inbound rule.
2. Use third-party tools or IP range lists to block traffic from specific countries.

While not built into the Windows Firewall, IP ranges can be manually added for countries you want to block.

---

Step 7: Enable Two-Factor Authentication (2FA)

Though not a direct feature of the firewall, 2FA significantly strengthens RDP security.

• Use Microsoft’s Remote Desktop Gateway or third-party solutions like Duo Security to integrate 2FA with RDP.
• The firewall can be configured to allow only traffic from the 2FA authentication service, ensuring additional security.

---

Monitoring and Auditing Firewall Activity

Regular monitoring helps detect unauthorized access attempts and ensures your firewall rules are functioning as intended.

Step 8: Enable Logging

1. Open Windows Defender Firewall with Advanced Security.
2. Click on Monitoring in the left-hand menu.
3. Enable logging for both successful and failed connection attempts.

Logs can be reviewed in the default log file:
C:\Windows\System32\LogFiles\Firewall\pfirewall.log.

Step 9: Review Event Logs

Use the Event Viewer to track RDP-related events:

1. Open the Event Viewer (eventvwr).
2. Navigate to:
   Windows Logs > Security.
3. Look for Event ID 4625 (failed login attempts) and Event ID 4624 (successful logins).

---

Best Practices for RDP Firewall Security

• Regularly Update the Server: Ensure Windows Server 2022 has the latest security patches.
• Disable RDP When Not in Use: Turn off RDP if it's not actively needed to reduce the attack surface.
• Combine with VPN: Use a Virtual Private Network (VPN) to add another layer of security, requiring VPN access before RDP traffic is allowed.
• Use Strong Passwords: Ensure all accounts use complex passwords to prevent brute-force attacks.