How to block an attacking IP on Windows Server 2008 R2?

Question

firewall

Greetings.
There is Windows Server 2008 R2 for remote access to accountants. For some time now, bots have been trying to guess the password to the server, in the logs you can see "Audit failure". The standard port 3389 has been replaced with another one, but the attacks continue. Can you please tell me how to configure the server so that after three unsuccessful login attempts, the IP address is automatically blocked? Can this be done in a standard firewall or do I need to buy something extra?

Answer 1

ipfw setting by ip and poppies)

Answer 2

In general, hanging Windows "out" is already not good.
If you still want to post it, then only through an intermediate server, it is also a gateway, or some piece of hardware with a firewall.
*nix-like systems feel best as a gateway. FreeBSD, OpenBSD, Linux etc.
If you do not communicate with * nix, then install windows, raise ISA on it, and then you can more or less manage traffic somehow.
If all this is difficult, then put a piece of iron with a firewall. For example, Cisco ASA, etc... If money does not allow, take a closer look at Microtik.

Answer 3

buy a normal router)

Answer 4

Best to do as oia suggested : access only from certain addresses. Anyone who needs access buys a stat. address (if not) And management explains that other methods of protection are not effective.
Or vpn, with a ban on attacking addresses.

Answer 5

+ oia
+ nfire
or as bk0011m suggested , only then it's not ISA but TMG