Porta SFTP Server has its own customized service to ban external IP address that is not whitelisted. In this post, let’s see how can we set up the Firewall Service Ban (FWSBan). However, to successfully follow this post/blog, you must already have the following on your computer. If not, please read this blog on how to set up Porta SFTP Server. Also, if you do now have SFTP Client please download WinSCP from WinSCP.net. And lastly, the JRE can be downloaded from https://adoptium.net/ (Direct version link: https://adoptium.net/temurin/releases/?package=jre&os=windows&arch=x64&version=17).
Requirements:
- Porta SFTP Server
- WinSCP/SFTP Client
- Java Runtime Environment (JRE) 17
- Windows 7/8/8.1/10/11/Server 2012+
Run Porta SFTP Server and Navigate the Following
Whitelist some IP Address then Check/Tick the “Augment with FWSBan Intrusion Prevention.”
Note. FWSBan requires admin privilege as it interacts with the Windows Advance Firewall Settings.
Put the Admin Credentials to authenticate the installation of FWSBan
Note. After you fill out the required fields, click the “Install” button. After the installation is done, click the “Start Svcs.” to start the FSWSBan service.
Make sure that the service is installed and running
Note. If failed, most likely because you provided the wrong login/account.
Resulting Firewall Block Action Results
Note. Connect using WinSCP Client from a computer that does not have the whitelisted IP address.
In addition to this configuration, if you have to uninstall the FWSBan service without using a Command Prompt (CMD), you have to stop the service first uncheck the FWSBan checkbox then click the “Uninstall” button.
Automatic Full Blocked Protection from Any IP Address
If in case the Inbound Max Limit has been rich due to too many block IPs, the application will enable the Full Blocked Protection (from * Any IP Address) and you have to review the logs to see what is going on. This is the best time to investigate if the server is under attack.
Conclusion
In this post, we tackled the FWSBan which is an alternative to Fail2Ban as the latter is only for Linux. We can see how easily enable the said alternative as we can use the friendly User Interface (UI) of Porta SFTP Server without needing to use Windows Command Prompt (CMD) at all. That said, we’ve successfully run the FWSBan service and see the blocked IP address from the Windows Firewall Inbound Rule’s Scope.
