7

I come from the Windows 2003 Server world and it's IIS version is much different then IIS 10 on Windows 2016 Server. The 2003 server appears to have denied all IP addresses by default. How to I deny all IP's in IIS 10. I have a few IP ranges I would like to allow and see how to enter those, but how do I deny all IP ranges in IIS 10?

Off The Gold
  • 183
  • 1
  • 1
  • 8

1 Answers1

7

First you need to add a Windows Server Role from Web Server (IIS) > Web Server > Security > [x] IP and Domain Restrictions. This will add an IP Address and Domain Restrictions feature to your IIS Manager, and you can add the required deny / allow entries. See <ipSecurity>.

The <ipSecurity> element defines a list of IP-based security restrictions in IIS 7 and later. These restrictions can be based on the IP version 4 address, a range of IP version 4 addresses, or a DNS domain name.

The default installation of IIS does not include the role service or Windows feature for IP security. To use IP security on IIS, you must install the role service or Windows feature.

On IIS Manager you can create a list of Allow / Deny entries. IP address ranges are specified as Classless Inter-Domain Routing (CIDR) subnets using either network mask or CIDR notation. I personally prefer to use the latter. The first match is used, so you'd add the global deny last.

This example denies usage from single specific IP 198.51.100.5, allows others in range 198.51.100.0 - 198.51.100.255 (/24) and denies rest i.e. 0.0.0.0 - 255.255.255.255 (/0):

Mode    Requestor          Entry Type
=====================================
Deny    198.51.100.5       Local
Allow   198.51.100.0(24)   Local
Deny    0.0.0.0(0)         Local

View Ordered List... in both Actions pane and the context menu allows ordering. Unordered list has more options (Edit Feature Settings...) like the ability to choose the deny action (403 Forbidden default, 401 Unauthorized, 404 Not Found or Abort that refuses the connection).

Esa Jokinen
  • 43,252
  • 2
  • 75
  • 122
  • Thanks, yes, I had added the Role already. But how do I deny all IP ranges. I read the documentation and it is not clear to me after reading 3 times. Disclaimer: I am more a developer than system admin. – Off The Gold Apr 03 '18 at 18:08
  • 1
    I'll improve my answer tomorrow. It's beer o'clock in Finland. :) – Esa Jokinen Apr 03 '18 at 18:11
  • Hi, any more thoughts on this? – Off The Gold Apr 04 '18 at 14:35
  • 1
    Finally got same time to actually test this. The ordering of entries matters over the prefix: it's always the first match, not the one that has smallest CIDR subnet. – Esa Jokinen Apr 05 '18 at 12:56