Stop RDP Brute-Force With the Panel Firewall

Quick Fix

Restrict RDP (port 3389) to your own IP using the VM Firewall tab in your Euronodes panel. This works at the network edge, applies immediately on a running VM, and cannot lock you out of the VM Console.

Restrict port 3389 to your IP (2 minutes)

Find your IP - open https://ifconfig.me from where you connect.
In your Euronodes panel, open the VM and go to the Firewall tab.
Add an ACCEPT rule: Protocol TCP, Port 3389, Source your IP, Direction in. Click the green +. It applies immediately.
Add a second rule below it: DROP, Protocol TCP, Port 3389, no source (matches everyone else). Click the green +.
Done. Only your IP can reach RDP now. Every scanning bot on the internet is blocked before it reaches Windows.

Rule order matters

Rules are evaluated top to bottom, first match wins. The ACCEPT rule for your IP must sit above the DROP rule for the port, or the DROP rule catches your own traffic too. See Bulk Firewall Rules if you want to script this with JSON instead of the two single rules above.

This cannot lock you out

The panel firewall only filters the network path to the VM. The VM Console in your panel always works regardless of any firewall rule, so there is no risk of losing access while you set this up.

Why This Happens

It is very rarely your own attempts

A Windows account getting locked after "barely any use" is almost always bots scanning the internet and bruteforcing RDP, not the account owner's own failed logins. If port 3389 is reachable from anywhere, it gets found and hit within hours of the VM going up.

Do not loosen the account lockout policy

Raising the lockout threshold or disabling lockouts does not fix this: it just gives the bots more attempts before Windows notices. The fix is closing the exposure (the Quick Fix above), not tolerating more failed logins.

Alternative: A Non-Default RDP Username

Bots try administrator and admin first, by far. A second, complementary step is to stop using either name for remote logins.

Create a separate RDP user

compmgmt.msc -> Local Users and Groups -> Users -> right-click -> New User.
Pick a login name that is not admin or administrator.
Add it to the Remote Desktop Users group so it can log in over RDP.
Optionally rename or disable the built-in Administrator account for remote logins once the new user works.

This reduces noise from the least sophisticated scanners but is not a substitute for the IP restriction above. Combine both.

Panel Firewall vs. Windows Firewall

These are two different layers, both useful, but they solve the problem differently:

	Panel Firewall (this page)	Windows Firewall
Where it runs	Network edge, outside the VM	Inside the guest OS
Works while locked out of Windows	Yes	No, needs a working login first
Setup	Panel UI, no VM changes	PowerShell or `wf.msc` inside the guest
Guide	This page	Secure Open RDP Access

Start with the panel firewall: it is faster, cannot self-lock you, and works even if the account is currently locked. The in-guest steps in Secure Open RDP Access are a good second layer, or the option if you prefer not to touch panel rules.

FAQ

Do I still need to unlock the Windows account after this?

Yes, this only stops new brute-force attempts. If the account is already locked, unlock it first: Unlock User Account.

Will this affect anything else on the VM?

No. The rule only matches TCP port 3389. Everything else keeps working as before.

My IP changes often, what do I do?

A dynamic IP breaks a fixed allow-list. Use a VPN or zero-trust tool and restrict 3389 to that instead, see the VPN section in Secure Open RDP Access.

Can I do this instead of the Windows-level firewall changes?

Yes, the panel firewall alone is enough to stop internet-wide scanning. The in-guest steps are an additional layer, not a requirement.

Contact Support

Need help?

Not sure how to add the rule: open a ticket, a colleague will set it up on request.
Still getting locked out after adding the rule: include the source IPs from Event Viewer (Event ID 4625) so we can confirm the rule is matching correctly.