Windows Firewall rules from IPBan not applied correctly ?

[Emilio-mld]

Hello,

First I want to thank you for this software and allowing everyone to benefit from it.

I am currently testing IPBan on one of our test servers (Windows Server 2016).
My goal is to protect RRAS RemoteAccess service from attacks.

To test IPBan I have installed it, mostly kept the default configuration (only changing FailedLoginAttemptsBeforeBan and whitelisting my workstation's IP).
I can see that IPBan does its job very well since it creates the firewall rules according to the settings from ipban.config (i.e after 3 failed attempts).

My problem is that I can still try to login from banned IPs, despite the fact that they are in a firewall block rule. These failed logins will show up in the event viewers and logfiles but will not be catched by IPBan as I guess it considers them as already dealt with.
Even worse, I can effectively login from one of these IPs, meaning that if an attacker gets lucky he will get access.
My understanding of Windows firewall is that a block rule will always take precedence, so I don't understand how this is possible.

I did not find anything from previous issues, is this a known Windows firewall problem ? Maybe my understanding is flawed, any help will be greatly appreciated.

[Emilio-mld]

Answered my own question...
I am ashamed to say this but it was due to third party antivirus software overriding Windows firewall.

Again, many thanks for your work !

[jjxtra]

You are not the first one to run into this LOL