Fail2ban for Windows

Fail2ban for Windows Server: the WFP-based alternative

On Linux, fail2ban has protected against brute force for years. ServerBouncer brings the same idea natively to Windows Server – as a service, with profiles for Windows services, a web UI and a CLI.

ServerBouncer block list with the reason for each block

The idea – and what Windows adds

TaskServerBouncer
Read sourcesWindows event logs (Security, Application, System, operational channels) and log files with rotation
Match patternsReady-made profiles instead of custom filters: RDP, SMB, Kerberos, IIS, Exchange, SQL Server, OpenSSH, RRAS, NPS, RD Gateway, SIP and more; custom logs via regex or JSON lines
CountSliding window per IP, per user (password spraying) and per subnet
BlockWFP filters in the kernel, IPv4 and IPv6, escalating duration, all or individual ports
Avoid lockoutWhitelist with host names, active RDP and admin sessions are never blocked, learning mode
OperateWeb UI with explanations, sbc CLI, MSI with silent installation

Beyond blocking

  • Incidents when a logon succeeds after failures
  • Port knocking with signed packets for RDP, SSH, SMB or SQL
  • Geo and ASN rules from local data
  • Hardening check and behavior detection against exploits without a logon

fail2ban is an independent open-source project; ServerBouncer is not affiliated with it and uses none of its code.

More use cases

Try ServerBouncer on your servers

Starts in learning mode – you first see what would be blocked.

Request early accessInstallation