IPBan and RDPGuard alternative for Windows Server
A Windows Server with Remote Desktop open to the internet gets password guesses around the clock. Windows records every failed logon, but it does not block the address that sent it. Tools such as IPBan, RDPGuard and Cyberarms fill that gap. Here is what each one does, and when a single tool for bans, firewall view and security check may fit better.
- The problem: Windows logs failed logons (Event 4625), but every guess still reaches your login screen.
- What these tools do: read the failed logins and block the attacking address after a few failures.
- IPBan, RDPGuard, Cyberarms: ban tools for Windows; Fail2Ban is the well-known open-source tool for Linux-style systems.
- When Coinetic may fit better: you want bans, a live view of the Windows Firewall, outbound control and a security check in one tool.
1. The problem: Windows logs attacks, but does not stop them
Every failed RDP, SQL Server or mail login ends up in a log, often thousands a day. Windows has an account lockout policy, but that locks the account, not the attacker, and can lock out your own administrators. What is missing is a step that reads these failures and blocks the attacking address. Read more in our guide to Event ID 4625.
2. The tools people compare
IPBan (DigitalRuby)
IPBan is free, open-source software on GitHub that blocks attackers on Windows and Linux. According to its README it detects failed logins from the Event Viewer and / or log files; on Windows it watches RDP, OpenSSH, VNC, MySQL, SQL Server, Exchange, SmarterMail and MailEnable, and other applications can be added in its configuration. It runs on Windows 10 or newer and Windows Server 2016 or newer. Settings are in the ipban.config file. A paid IPBan Pro is offered on ipban.com.
RDPGuard (NetSDK)
RdpGuard by Netsdk Software FZE is a brute-force protection tool for 64-bit Windows and Windows Server. It runs as a Windows service and blocks an address after repeated failed logins. The vendor lists RDP, MS-SQL Server, MySQL, FTP, HTTP, IIS web login, ASP.NET forms, RD Web Access, IMAP, POP3, SMTP, VoIP (SIP), SSH (OpenSSH) and MS VPN (RRAS). A fully functional 30-day free trial is available.
Cyberarms
Cyberarms Intrusion Detection is described in its GitHub repository as a free and open-source intrusion detection and prevention system for Windows Server 2008 R2 and later. The repository states that it is a fork of the original Codeplex project, kept as a backup and not supported.
Fail2Ban on Windows?
Fail2Ban is the open-source tool that scans log files and bans addresses with too many failed logins by updating firewall rules. Its README describes the installation on Linux-style systems and does not mention Windows, which is why many administrators look for a Windows tool that works the same way.
At a glance
Only facts the vendors state themselves; where a vendor does not say, the cell is left empty (–).
| IPBan | RDPGuard | Cyberarms | Coinetic | |
|---|---|---|---|---|
| Free / open source | Yes (free version); Pro paid | No; 30-day trial | Yes | No; 30-day trial |
| Windows versions named | Windows 10+, Server 2016+ | 64-bit Windows and Windows Server | Server 2008 R2 and later | Windows 7 SP1 / Server 2008 R2 SP1 to Windows 11 / Server 2025 |
| Also for Linux | Yes | – | – | No |
| RDP failed logins | Yes | Yes | – | Yes |
| SQL Server, MySQL | Yes | Yes | – | Yes (Pro) |
| OpenSSH | Yes | Yes | – | Yes (Pro) |
| Windows VPN (RRAS) | – | Yes | – | Yes (Pro) |
| Live firewall log: every allowed and blocked connection, with the rule that decided it | – | – | – | Yes |
| Make a rule matching a packet (right-click a log line) | – | – | – | Yes |
| Open ports view: what listens, the program behind it, who can reach it | – | – | – | Yes |
| Live connections: program, remote owner and country | – | – | – | Yes |
| Outbound control: ask before a new program connects out | – | – | – | Yes |
| Port scans and trap ports: scanners banned | – | – | – | Yes |
| Web server attacks and floods (IIS, nginx, Apache, Caddy) | – | – | – | Yes (Pro) |
| Security check with one-click, reversible fixes | – | – | – | Yes |
| Firewall change watch: alerts and switches it back on | – | – | – | Yes |
| AI security analyst (Ask AI on any line, ban, port or connection) | – | – | – | Yes (Pro + AI) |
| Phone unlock (port invisible until unlocked from your phone) | – | – | – | Yes |
3. Coinetic: a ban tool, and a lot more
IPBan, RDPGuard and Cyberarms do one job well: block the address behind repeated failed logins. Coinetic does that too – and because it is built on the Windows Firewall, it also gives you the whole picture a ban tool cannot: every connection the firewall allows or blocks live with the rule behind it, one-click rules straight from a log line, which ports are open to the internet, which programs phone out, port scans and web attacks stopped automatically, a security check that fixes what it finds, a watch that puts the firewall back if something switches it off, remote ports you can make invisible until you unlock them from your phone, and an AI analyst that explains any of it in plain words. One tool instead of a ban script plus Event Viewer plus firewall edits plus a port scanner.
With Coinetic: one tool, installed in minutes, then it runs by itself
- Bans password guessers automatically: after the number of failed logins you choose, within the hours you choose. Windows / RDP in every plan; VPN, SQL Server, MySQL / MariaDB, PostgreSQL, Exchange, hMailServer, OpenSSH, VNC and FTP in Pro. Your LAN and whitelisted addresses are never banned.
- Shows every connection live, with the firewall rule that decided it. Right-click a line to ban the address, look up who owns it, or make a rule.
- Stops more than logins: port scans and trap ports in every plan; web attacks and connection floods on IIS, Caddy, nginx and Apache in Pro.
- Under Attack mode for botnets that try once from thousands of addresses: admin ports such as RDP, SSH and SQL Server close to the internet, while LAN, VPN, web and mail keep running.
- One-click security check: open ports against the rules, risky settings and stale rules, each with an explanation and a reversible fix.
- Watches the firewall: if something switches it off, Coinetic alerts you and switches it back on. It runs as a Windows service, also when nobody is logged on, and works in any Windows language.
- Your AI security analyst (Pro + AI): right-click any line, ban, port or connection and choose Ask AI, e.g. “Which addresses attacked RDP last night, and is anything still open?”. It looks up this computer's Coinetic data itself and answers in plain words, with what to do on this machine.
Already running another ban tool that keeps its own firewall rules, such as IPBan? In Coinetic's Firewall changes list you can mark that program as trusted, so its rule updates are recorded but raise no alert.
Download Coinetic, install, done - it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.
More guides: all Coinetic guides.
Frequently asked
Is there a Fail2Ban for Windows?
Fail2Ban itself is documented for Linux-style systems. On Windows, tools such as IPBan, RDPGuard and Coinetic do the same job: they read failed logins and block the attacking address.
Can Coinetic run next to IPBan or RDPGuard?
Coinetic works through the Windows Firewall and keeps its bans in its own rules, named Coinetic Ban list N, so they never mix with other rules. Rule changes made by a program you trust can be marked as trusted in Coinetic, so they raise no alert. Running two ban tools is usually not needed, though.
Will an automatic ban lock out my own administrators?
In Coinetic, LAN and private addresses are never banned, and you can put your offices, partners or monitoring on the whitelist. They are shown, but never banned.
Is Coinetic only for businesses?
No. It protects Windows Servers and PCs, for companies and home users alike. The Simple view shows at a glance whether you are protected and what needs you.