Home / server / Questions / 57667
In Process
p.campbell
Asked: 2009-08-24 10:10:21 +0800 CST

IIS7 Applications: Deny WAN visitors and allow LAN visitors

  • 772

Consider an IIS7 deployment with multiple Applications under a Web Site. Each is running under its own AppPool. We want to disallow all outside visitors access to one Application in particular. All internal users should be allowed access.

The current strategy is to check the requesting IP address. This likely could be done in IIS7 and a web.config. The screenshot is the first stab at allowing internal users. Those who present from:

  • 192.168.0.X should be allowed.

  • an external IP, (i.e. a public address) should be denied.

    First stab at IIS7 settings

Question: How would you configure your Application to suit this requirement, either by:

  • inetmgr or
  • web.config
security permissions iis-7

2 Answers

  1. Use the IIS Manager and deny all access except from your private IP subnet.

    That or host the site on a second different IP and setup internal DNS to handle the name lookup, and not make the app available from the outside at all.

    • 1

  2. I think I understand what you are asking as I am having the same issue. To try and describe this another way, I want to restrict access to "one" of the Applications on my Site, to a specific list of IP addresses and ranges. However, when you configure this in InetMgr, the restriction is placed on the Site, not the specific Application. I also tried adding the IP address restriction rules manually to my web.config in the Application and that did not work either.

    How do you add an IP address restriction to the Application and leave the rest of the Site open?

    • 1