Features

All ServerBouncer features

Detect, block, understand: ServerBouncer protects Windows Server against brute force, password spraying and the consequences of a break-in – on-premises and traceable.

Detection: brute force, spraying, subnets

ServerBouncer counts failed logons in a sliding window (30 minutes by default) with three counters:

  • per IP – 5 failures by default,
  • per IP and number of distinct users – detects password spraying (4 users by default),
  • per subnet (/24 or /64) – 20 failures from at least 3 addresses.

On top: decoy user names such as admin or sa (one attempt is enough), double weight for unknown users and higher thresholds for addresses with a successful logon in the last 14 days. Thresholds and windows are configurable globally and per profile.

List of logon attempts with country, service, user and result

Kernel-level blocking with the Windows Filtering Platform

Blocks become WFP filters – packets from the source are dropped before they reach the service. On Windows Server 2025 a new block was active in under 0.5 s, even with 100,000 active filters. Windows Firewall is used only as a fallback.

  • Escalating duration: 1 h, 24 h, 7 days from the third block – configurable, also permanent
  • All ports or only specific local ports, including whole CIDR ranges
  • The whitelist with IPs, networks and host names always wins
  • Lockout protection: addresses of active RDP and admin sessions are never blocked
  • Every block shows its reason
Block list explaining why an address was blocked

Learning mode: observe first, then protect

After installation ServerBouncer starts in learning mode, 7 days by default. Everything is counted and decided, but instead of a block only “would have blocked” is recorded. You review whitelist and thresholds at your own pace and then switch protection on – or let learning mode end automatically. An MSI property switches it off right away if you prefer.

Profiles for your services

Profiles read event logs or log files and produce uniform logon attempts:

AreaProfiles
WindowsRDP, SMB/NTLM, Kerberos, RD Gateway, RRAS, NPS
Web & mailIIS, Apache/nginx logs, Exchange (incl. OWA, ActiveSync), mail servers, web scan rules
DatabasesSQL Server, MySQL, PostgreSQL
File transfer & remote accessIIS FTP, FileZilla, OpenSSH
MoreSIP, Windows Firewall log, custom regex and JSON-lines logs

Regex templates exist for hMailServer, MailEnable, SmarterMail, MDaemon, Kerio Connect, Serv-U and SolarWinds SFTP, among others; they are marked as unverified.

Profile overview with status per source

Incidents: when an attack succeeded

A failed logon is harmless – a successful one afterwards is not. ServerBouncer creates incidents with timeline and status, for example on:

  • a successful logon after many failures from the same IP or subnet,
  • a logon from a blocked network, a new country, hosting/cloud/Tor/VPN or at an unusual time,
  • an RDP service crash and suspicious process chains (see behavior detection).

The default is alert only. Reactions can be enabled per rule: disconnect session, disable account, block IP. Incidents appear live in the web UI, in the CLI and in the Windows event log.

Incident detail with timeline and reactions

Access grants and port knocking (SPA)

Protected services – such as RDP, SSH, SMB or SQL – are blocked for everyone except loopback, the whitelist and active grants. Grants apply per source IP or network and service for 15 minutes to 12 hours and close automatically.

With sbc knock a registered device sends a single UDP packet signed with Ed25519. Replay protection, clock tolerance and a rate limit are built in, invalid packets count as failed logons, and there is emergency access at the console.

RDP closed for everyone until an authorized device knocks – the only defense that also stops unknown exploits.

Access grants with protected services, devices and active grants

Geo, ASN and network-type rules

Rules per service and port by country, ASN or network type: cloud ranges of AWS, Azure, Google Cloud and Oracle, Tor exit nodes and your own VPN/hosting lists. You import the data locally (RIR statistics, MMDB files, provider JSON lists) – ServerBouncer downloads nothing itself and queries no online services.

Country and ASN are shown in the block list, attempts and IP details.

Geo rules per service with source attribution of imported data

Hardening check with one-click fixes

Many break-ins need no password, just too large an attack surface. The hardening check looks at a few effective settings, explains them and computes a score:

  • RDP: NLA, security layer, exposure, port, RD Gateway
  • SMBv1, Windows Firewall profiles
  • Auditing of logons and process creation
  • Account lockout, guest account, built-in administrator

Three safe switches can be fixed with one click after confirmation: require NLA, disable SMBv1, enable logon auditing. Everything else remains a recommendation you apply yourself.

Hardening page with score, findings and fix buttons

Behavior detection: exploits do not log on

Brute-force detection only sees failed logons. Behavior detection looks for typical side effects of attacks:

  • Crash or unexpected end of the RDP service – incident with priority “High”, block of the peers shortly before,
  • RDP connections without a logon (“handshake only”) – count as weighted failures,
  • Process chains after a break-in – a network service starts a shell, a LOLBin or an unsigned program: “Critical” incident.

Each detection can be switched individually, with reaction “block” or “alert only”. ServerBouncer never terminates or modifies a process or service.

Behavior detection incident with process chain

Connections and processes at a glance

Two views show what runs on the server and who talks to it: all TCP connections, listeners and UDP endpoints with process, block and whitelist status, plus a process tree with user, command line, CPU, memory and open ports.

  • Authenticode signature, including catalog-signed Windows files – verified offline
  • SHA-256 on demand, with a link to look it up on VirusTotal that your browser opens; the server uploads nothing
  • Read-only: no button terminates processes or drops connections
Process detail with signature, SHA-256 and connections

Web UI and CLI

Web UI

  • Local only by default at https://localhost:8443; the local administrator needs no account and no 2FA there
  • Opt-in LAN access with user accounts and mandatory 2FA (passkeys or TOTP)
  • Step-up 2FA for critical changes, roles Reader, Operator and Admin
  • Live data, command palette, keyboard shortcuts, light and dark, German and English

CLI sbc

  • Manage status, blocks, whitelist, incidents and users
  • sbc config export/import for a consistent configuration across servers
  • sbc knock for access grants, without administrator rights
  • API tokens for your own scripts

Operation and deployment

MSI and silent install

Deploy via GPO, Intune or RMM with properties for port, learning mode, whitelist and a prepared configuration.

SQLite, SQL Server, PostgreSQL

SQLite is the default. For larger environments SQL Server (including Express) or PostgreSQL (preview).

Offline and data-minimal

No telemetry, no outbound connections by default, diagnostics export as ZIP with optional redaction – without upload.

Protection for your use case

RDP protection

Secure RDP against brute force and password spraying: WFP blocking, close RDP entirely with port knocking, crash and handshake-only detection.

SMB & Kerberos

Detect failed SMB/NTLM and Kerberos logons, uncover password spraying and block attacking IPs on Windows Server with WFP.

Exchange, IIS & mail

Brute-force protection for Exchange (OWA, ActiveSync), IIS, IIS FTP and mail servers like hMailServer or MDaemon – via log and event profiles.

SQL Server & databases

Detect failed database logons on SQL Server, MySQL and PostgreSQL and block the source IPs on Windows Server automatically.

Fail2ban for Windows

The fail2ban idea for Windows Server: read event logs and log files, count failures, block attackers – with web UI, CLI and WFP.

Port knocking (SPA)

Keep RDP, SSH or SMB closed for everyone and open them only for authorized devices: single packet authorization with Ed25519 for Windows Server.

Geo-blocking

Block countries, ASNs, cloud ranges and Tor per service and port – with locally imported data and no online lookups, on Windows Server.

Try ServerBouncer

Request early accessSee the roadmap