Stop Repeated Firewall Connection Attempts From Same IP

I know this error drives you crazy

You're checking your firewall logs, and there it is — the same IP address showing up over and over, trying to connect every few seconds. It feels like someone's trying to break in. But relax: most of the time, it's just a misconfigured device or a service scanning the internet. Let's shut it down.

The fast fix: block that IP

On Windows, use Windows Defender Firewall. Open it, go to Inbound Rules, then New Rule. Choose Custom > All programs > Protocol type: Any. Under Scope, in the Remote IP address section, add the offending IP. Set the action to Block the connection. Apply to all profiles. Name it something like "Block Bad IP". Done in under 2 minutes.

On Linux with iptables, run this command (replace the IP with yours):

sudo iptables -A INPUT -s 203.0.113.45 -j DROP

That drops all traffic from that IP. For a permanent rule, save it with iptables-save or use your distro's firewall tool like UFW: sudo ufw deny from 203.0.113.45.

On a router (like a home Netgear or TP-Link), log into the admin panel. Look for Access Control or Firewall Rules. Add a rule to block that IP. Save and reboot if needed.

Why this happens in the first place

That IP is probably a bot scanning for vulnerable services, or a misconfigured device (like a printer or camera) trying to phone home. It could also be a VPN server that's broken and keeps retrying. In rare cases, it's a DDoS attack, but if you're a home user or small business, that's unlikely. The repeated attempts are normal internet noise — think of it like someone knocking on every door in a big apartment building.

Less common variations of the same problem

Here are a few twists I've seen in my years running help desks:

IP changes every time: If the IP keeps changing (like 192.0.2.x), it's a botnet scan. A single block won't help. Use a geoblock or rate-limit connections.
Same IP but different ports: Blocking the IP works, but if you only want to block specific services (like SSH or RDP), use a firewall rule that targets the port. On Windows: Protocol: TCP, Local port: 3389 (for RDP). On Linux: sudo iptables -A INPUT -s 203.0.113.45 -p tcp --dport 3389 -j DROP.
IP is from your own network: Check your internal IPs (like 192.168.1.x). If it's a local device, it's probably infected or misconfigured. Run a malware scan on that device.
Attacks on specific services like FTP or MySQL: These are common targets. Block the IP, but also rename default accounts (like "admin" or "root") and use strong passwords.

How to stop this from happening again

Blocking one IP is a band-aid. Here's the real prevention:

Use a blacklist service: Many routers and firewalls can pull from real-time block lists (like Spamhaus or AlienVault). Enable that in your settings.
Set up rate limiting: On Linux, use iptables to limit connections per second: sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set and sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP. This drops IPs that try more than 4 connections in 60 seconds.
Change default ports: If you run SSH or RDP, move them to non-standard ports (like 2222 or 3390). It won't stop a targeted attack, but it'll reduce noise.
Keep logs clean: Set your firewall to log only blocked traffic or warnings, not every single attempt. You'll still see noise, but less clutter.

When to worry

If you see thousands of IPs hitting you at once, if your internet slows to a crawl, or if you notice data being sent out (check your bandwidth usage), you might be under DDoS attack. Contact your ISP or use a service like Cloudflare. But for 99% of cases, it's just internet background radiation. Block it and move on.

I've had users panic over this and unplug their whole network. Don't. You're safe. The noise is normal. But if that one IP keeps bugging you, now you know how to shut it up in minutes.