firewall pass & cracked server IIS

Hi,

today someone cracked my server and I have 2 questions:

what i have: updated WS2019 with hyper-v and virtual WS2019 with IIS + ASP.NET

q:

- on main server i have blocked all incoming IPs except my, but i have few incomming connection from malicious IPs to port 500 & 4500, how this is possible?

- on virtual I have IIS with my ASP.NET apps, all ports except 80 & 443 are blocked, but server been infected by CoronaRansom and everything been enrypted include system files, isnt IIS sites isolated and is impossible to crack system through site?

Thanks for ideas, R