XServer – we build Internet
Language
Currency
Login
How to protect RDP on Windows Server against brute-force attacks?

How to protect RDP on Windows Server against brute-force attacks?

How to Protect RDP on Windows Server from Brute-Force Attacks and Securely Connect Remote Employees to the Server via WireGuard VPN

🛡️ How to Secure RDP on Windows Server Against Brute-Force Attacks Using WireGuard VPN

Brute-force attacks targeting the default Remote Desktop Protocol port (TCP 3389) are a primary security headache for Windows Server administrators. Automated bots scan public IP addresses around the clock, flooding event logs with failed login attempts and causing high CPU utilization. Leaving port 3389 exposed to the public internet is a major security risk, but how can you provide seamless, secure remote access for your team without setting up complex Active Directory domain infrastructures?

Here is a simple, lightweight, and reliable security approach using a lightweight WireGuard VPN gateway deployed directly on your server.

🧭 Solution Architecture

This design isolates public traffic from internal administrative access:

  • 🔒 WireGuard VPN listens on a dedicated UDP port (for example, 51820). Remote employees connect to this endpoint from anywhere.
  • 🚫 RDP (TCP 3389) is completely blocked on the public network interface via Windows Defender Firewall, rendering it invisible to external port scanners.
  • 🔑 Remote Desktop access is granted strictly inside the VPN tunnel using the internal IP address of the virtual network.

This setup completely mitigates external password-guessing attacks, maintains low system overhead, and allows multiple users to work simultaneously in isolated RDS sessions.

📝 Step-by-Step Configuration Guide

Step 1. Installing WireGuard on Windows Server

  1. Download the official installer from wireguard.com/install and run it on your Windows Server machine.
  2. Open the WireGuard application, click Add Tunnel → Add empty tunnel... (or press Ctrl+N).
  3. Configure the server profile:
[Interface]
Address = 10.10.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

💡 The application automatically generates public/private key pairs when saving the configuration.

Step 2. Configuring Windows Defender Firewall

To allow client connections to the VPN server from the internet, open the inbound UDP port. Open PowerShell as Administrator and execute:

New-NetFirewallRule -DisplayName "WireGuard Inbound" -Direction Inbound -Protocol UDP -LocalPort 51820 -Action Allow

Step 3. Connecting the First Client Device

On the client machine (e.g., employee laptop), install WireGuard and create a configuration file with the following settings:

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.10.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_SERVER_PUBLIC_IP:51820
AllowedIPs = 10.10.0.0/24

On the Windows Server instance, add the client's public key under the [Peer] section:

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.10.0.2/32

Activate the tunnel on both ends and verify connectivity by running: ping 10.10.0.1.

Step 4. Blocking Public RDP Access

To prevent malicious bots from probing the Remote Desktop service over the internet, restrict port 3389 exclusively on the public interface (replace Ethernet0 with your internet-facing network adapter name, which you can verify using Get-NetAdapter):

New-NetFirewallRule -DisplayName "Block RDP on Public Interface" -Direction Inbound -InterfaceAlias "Ethernet0" -Protocol TCP -LocalPort 3389 -Action Block

⚠️ Important: Do not block port 3389 globally across all interfaces without specifying -InterfaceAlias. Doing so will cut off internal access over 10.10.0.1 as well.

Once applied, connection requests via the public IP address will be dropped. Remote employees connected via VPN can access the server using its internal tunnel address (10.10.0.1).

👥 Scaling: Adding More Users

Expanding access for additional team members does not require structural changes. The workflow takes three steps:

  1. Create a local user account in Windows Server (via Computer Management → Local Users and Groups) or Active Directory.
  2. Generate a new key pair on the employee's client device inside the WireGuard app.
  3. Append a new [Peer] block to the server configuration file, assigning the next available internal IP address (e.g., 10.10.0.3/32, 10.10.0.4/32):
[Peer]
PublicKey = NEW_EMPLOYEE_PUBLIC_KEY
AllowedIPs = 10.10.0.3/32

Configuration updates take effect instantly without restarting the VPN service.