Documentation
Installation and getting started
ServerBouncer ships as an MSI. Interactively it is set up in a few minutes; for many servers there is silent installation.
Interactive installation
Install ServerBouncer-<version>.msi by double-clicking it. The service starts in learning mode (7 days): blocks are only simulated. The web UI is reachable locally only at https://localhost:8443.
Silent installation (GPO, Intune, RMM)
Public MSI properties:
| Property | Default | Meaning |
|---|---|---|
WEBUI_PORT | 8443 | Port of the local web UI and API |
LEARNING_MODE | 1 | 1 = learning mode (blocks only simulated), 0 = live immediately |
CONFIGFILE | – | Path to a prepared serverbouncer.json; used as the initial configuration (WEBUI_PORT/LEARNING_MODE are then ignored) |
WHITELIST | – | Separated by ;: IP addresses, CIDR ranges or host names. Applied once on first start |
DESKTOP_SHORTCUT | 1 | 0 = no desktop shortcut |
The properties apply to the first installation only: an existing %ProgramData%\ServerBouncer\serverbouncer.json is never overwritten, updates keep the configuration.
:: Default, unattended, with log
msiexec /i ServerBouncer-1.0.0.msi /qn /l*v "%TEMP%\serverbouncer-install.log"
:: Different port, learning mode off, management networks on the whitelist
msiexec /i ServerBouncer-1.0.0.msi /qn WEBUI_PORT=9443 LEARNING_MODE=0 WHITELIST="10.0.0.0/8;192.168.10.0/24;jump.example.local"
:: Prepared configuration
msiexec /i ServerBouncer-1.0.0.msi /qn CONFIGFILE="\\fileserver\deploy\serverbouncer.json" WHITELIST="10.0.0.0/8"
:: Without desktop shortcut
msiexec /i ServerBouncer-1.0.0.msi /qn DESKTOP_SHORTCUT=0msiexec exit codes: 0 success, 3010 success, restart required, 1603 failure (check the log).
First steps
- Open the web UI:
https://localhost:8443on the server. As local administrator you need no account there. - Check the whitelist: add management networks and jump hosts so you never lock yourself out.
- Enable profiles: RDP, SMB and Kerberos are the basis; add profiles for IIS, Exchange, SQL Server and others as needed.
- Review hardening: the hardening page shows the key findings and three one-click fixes.
- Evaluate learning mode: during the first days ServerBouncer shows what it would have blocked. Then switch protection on.
- Optional: make RDP a protected service and register devices for
sbc knock.
CLI basics
sbc status # service state
sbc whitelist list # show the whitelist
sbc blocks # active blocks
sbc block 203.0.113.7 --minutes 60 # block manually
sbc unblock 203.0.113.7 # remove a block
sbc config export C:\backup\sb.json
sbc config import C:\backup\sb.json --dry-run
sbc knock server.example.com rdp --minutes 60With sbc config export and import you carry whitelist, manual blocks and profiles over to other servers. Secrets such as database connection strings are not included.
Uninstall
msiexec /x ServerBouncer-1.0.0.msi /qnUninstalling removes all WFP filters and firewall rules created by ServerBouncer.