fail2ban for Windows: what to use instead

There is no native fail2ban for Windows. fail2ban is written for Linux and BSD: it reads text log files and bans through tools like nftables, iptables or pf, while Windows records failed logons in the Event Log and filters traffic with Windows Defender Firewall. The closest equivalent is IPBan, a free, MIT-licensed service that watches failed RDP, SSH, SQL Server and other logins and blocks the source IPs in Windows Firewall. For RDP, the stronger fix is not exposing port 3389 to the internet at all.

Why fail2ban doesn't run on Windows#

fail2ban is built around three Unix assumptions:

1. Logs are text files or the systemd journal. Windows records a failed logon as event ID 4625 in the Security event log — a binary store that fail2ban has no backend for.
2. Bans are shell commands for a Unix firewall. Every action in action.d calls nft, iptables, firewall-cmd, pfctl or similar tools. None exist on Windows.
3. It runs as a Unix daemon with a Unix domain socket between fail2ban-client and fail2ban-server.

The fail2ban source itself marks Windows as not currently supported, and there is no official Windows build. The "fail2ban for Windows" downloads you'll find are different projects that borrow the name or the idea. See how fail2ban works for the full architecture.

Can you run fail2ban in WSL2?#

You can install fail2ban in a WSL2 distribution (sudo apt install fail2ban in Ubuntu on WSL), but it protects only what runs inside that Linux VM:

The WSL2 firewall only filters traffic going into the WSL2 VM. Even in mirrored networking mode, connections to Windows services never pass through it. WSL distributions also aren't designed to run as always-on services and can be stopped when idle.

You could write a custom action that calls powershell.exe through WSL interop to add Windows firewall rules, but that needs an elevated session and an exported copy of the event log — fragile, and not something to rely on for a public-facing server. Docker Desktop has the same limitation; fail2ban in Docker assumes a Linux host. If you want the real thing, run fail2ban on a proper Linux VM or reverse proxy that fronts the service. For anything on the Windows side, use a Windows-native tool.

Windows alternatives to fail2ban#

These tools do what fail2ban does — watch for failed logins, block the source IP in the firewall — using Windows' own event log and firewall:

IPBan: the closest thing to fail2ban for Windows#

IPBan runs as a Windows service, subscribes to the Event Log and counts failed logons per IP. When an address crosses the threshold in ipban.config (the same file sets ban duration, whitelists and extra log sources), it adds the address to Windows Firewall rules created by IPBan, and removes it when the ban expires. It supports Windows 10 or newer and Windows Server 2016 or newer; Windows Server 2025 needs IPBan 2.0.1 or later. The free edition is open source on GitHub; IPBan Pro is a paid subscription with central management for many servers — check ipban.com for current pricing.

The project's README installs the latest release from an elevated PowerShell prompt:

$ProgressPreference = 'SilentlyContinue'; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/DigitalRuby/IPBan/master/IPBanCore/Windows/Scripts/install_latest.ps1'))

That runs a script straight from the internet as Administrator. If your policy doesn't allow that, download the release ZIP from the project's GitHub releases page, review it, and install the service manually as the README describes.

How it maps to fail2ban concepts: ipban.config ≈ jail.local; the failed-login threshold and window ≈ maxretry and findtime; ban time ≈ bantime; whitelist ≈ ignoreip. IPBan also runs on Linux, but there fail2ban has far more filters, so IPBan is mainly interesting for mixed Windows/Linux fleets that want one tool.

EvlWatcher, RdpGuard and wail2ban#

EvlWatcher was a small free tool aimed squarely at RDP: a service scanned the Security log for failed logons and added offending IPs to a single Windows Firewall rule, with a GUI to manage bans. It worked with almost no configuration — a two-hour ban after repeated failures and a permanent list for repeat offenders. Its author discontinued it and archived the repository in September 2026 (last release v2.1.62). Existing installs keep working, but plan a move to IPBan or another maintained tool rather than deploying it on new servers.

RdpGuard is commercial software with a long list of supported services — useful on Windows hosting servers that run IIS, SQL Server, mail and FTP side by side and want a GUI and vendor support.

wail2ban was an early PowerShell port of the fail2ban idea. It's useful to read, but don't deploy an unmaintained script on a production server.

Stop RDP brute force on Windows Server#

Banning tools reduce noise; these steps remove most of the attack surface and matter more than any ban tool:

Restrict the Remote Desktop rules to known addresses:

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.0/24,198.51.100.10

To see who is trying, filter the Security log for event 4625:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20

Block a single attacker by hand while you set up automation:

New-NetFirewallRule -DisplayName "Block 203.0.113.42" -Direction Inbound -RemoteAddress 203.0.113.42 -Action Block

Changing the RDP port reduces log noise from the dumbest scanners but isn't a security control.

Windows account lockout policy#

Windows can lock an account after repeated failed passwords. Open secpol.msc (or Group Policy) → Account Policies → Account Lockout Policy, or set it from an elevated prompt:

net accounts /lockoutthreshold:5 /lockoutwindow:15 /lockoutduration:15
net accounts

The second command shows the current values. Defaults depend on the Windows version and any security baseline or Group Policy applied: Windows 11 22H2 and later enable a 10-attempt, 10-minute lockout out of the box. Newer Windows Server releases can also lock the built-in Administrator account for network logons.

Lockout is not a substitute for IP banning. It slows guessing against one account, but the attacker keeps trying other usernames, keeps consuming resources, and can deliberately lock out your real users. Use it alongside an IP-banning tool, not instead of one.

Linux servers next to Windows#

Many teams run Windows for RDP and Linux for everything public-facing. On the Linux side, fail2ban is the standard tool: install it and enable the SSH jail in a few minutes. If the "Windows RDP" you're protecting is actually xrdp on a Linux box, fail2ban handles it natively with the upstream xrdp filter (see the filter list) and an [xrdp] jail.

Ban data isn't shared between fail2ban and Windows tools out of the box. If you need one shared block list across both platforms, use IPBan on both, or a tool with agents for both, such as CrowdSec (fail2ban vs CrowdSec).

FAQ#

Is there a fail2ban for Windows?#

No. fail2ban only runs on Linux, BSD, macOS and other Unix-like systems, because it reads text logs and calls Unix firewall tools. On Windows, IPBan is the closest equivalent: it reads failed logons from the Event Log and blocks IPs in Windows Defender Firewall. RdpGuard is a commercial option; EvlWatcher was discontinued in September 2026.

What is the fail2ban equivalent for Windows Server 2022 and 2025?#

IPBan by DigitalRuby, a free MIT-licensed service. It supports Windows Server 2016 and newer, including 2022 and, from version 2.0.1, Server 2025. Install it as a service, adjust thresholds in ipban.config, and it blocks IPs with repeated failed RDP, SQL Server or other logons in Windows Firewall.

How do I stop RDP brute-force attacks on Windows?#

Best: don't expose RDP to the internet — use a VPN or Remote Desktop Gateway with MFA. If RDP must be reachable, limit the firewall rule to known IPs, keep Network Level Authentication on, set an account lockout policy, and run an IP-banning tool such as IPBan to block repeat offenders.

Can I run fail2ban in WSL2 on Windows 10 or 11?#

You can install it, but it only bans traffic to services running inside the WSL2 Linux distribution. It can't read the Windows Event Log, and its firewall rules don't affect Windows services such as RDP, SMB, IIS or SQL Server. For those, use a Windows-native tool like IPBan.

Is IPBan free?#

Yes. The core IPBan project is open source under the MIT license and free to use on Windows and Linux. IPBan Pro is a paid subscription from the same developer that adds central management of many servers; see ipban.com for current pricing.

Does Windows account lockout replace fail2ban?#

No. Account lockout locks a user account after repeated wrong passwords, but it doesn't block the attacker's IP. The attacker can keep guessing other usernames and can lock out legitimate users on purpose. Use lockout together with an IP-banning tool and restricted RDP access.