Fail2Ban4Win

While blocking IP addresses is not complicated overall, things can get a bit problematic when it comes to banning addresses that are part of a group, such as a specific country, for instance. Whether it is because of scammers, viruses, unsolicited emails or activating limited access for a specific organization, blocking IP addresses is done via the firewall.

Fail2Ban4Win is a service that works quietly in the background to monitor connection attempts coming from specific addresses so that it can temporarily block them.

As previously mentioned, this is not a program per se, but rather a tool that works as a Windows service that runs in the background. It doesn’t come with an interface where you can add the data and all modifications are done within the JSON file found in the installation folder.

The same file is used to specify additional information regarding the ban, such as the event that triggers it, number of authentication attempts and duration of the block. The tool simply monitors for events that meet the specified details from various logs and takes action when it detects a matching event.

Once the duration of the ban is done, the rule is deleted from the firewall and another ban will be enabled when the criteria is met again. In case the app is restarted, then all rules are deleted and the monitoring starts from scratch.

According to the developer, subnets that are repeatedly blocked will automatically have an 1 day increased ban. The automatica ban doesn’t exceed 4 days and the aforementioned duration will be the norm for the problematic subnets.

Fail2Ban4Win is a tool that addresses advanced users who have their reasons to want to block a range of IP addresses, either for testing or for security reasons.