iis | security | aspnet

IP Security - Configure IP address restrictions in Web.Config on IIS

Restrict access to your website using IIS IP security

Abhith Rajan
Abhith RajanJanuary 09, 2018 · 1 min read · Last Updated:

When your website is using some kind of proxy/firewall just like Sucuri to increase the security, you need to make sure that only the allowed ones are accessing the site directly, so that all the requests to the site is going through the firewall.

To ensure this, we use the IP security feature in IIS, in which we can configure which IP’s are allowed.

<system.webServer>
  ...
  <security>
    <ipSecurity allowUnlisted="false">
      <clear />
      <add ipAddress="-.-.-.-" subnetMask="-.-.-.-" allowed="true" />
      <add ipAddress="-.-.-.-" subnetMask="-.-.-.-" allowed="true" />
      <add ipAddress="-.-.-.-" subnetMask="-.-.-.-" allowed="true" />
      <add ipAddress="-.-.-.-" subnetMask="-.-.-.-" allowed="true" />
    </ipSecurity>
    ...
  </security>
</system.webServer>

In the above code, we set allowUnlisted attribute to false to prevent access to all IP address unless they are listed. And then we add the allowed IP addresses one by one. eg.

<add ipAddress="192.168.134.0" subnetMask="255.255.254.0" allowed="true" />

Additional Resource

This page is open source. Noticed a typo? Or something unclear?
Improve this page on GitHub


Abhith Rajan

Written byAbhith Rajan
Abhith Rajan is a software engineer by day and a full-stack developer by night. He's coding for almost a decade now. He codes 🧑‍💻, write ✍️, learn 📖 and advocate 👍.
Connect

Is this page helpful?

Related SnippetsView All

Related ArticlesView All

Related VideosView All

Yubikey - The Ultimate Beginner Guide (How to Setup & Use)

Signal - the most secure messenger for everyone

Common API Security Pitfalls - Philippe De Ryck

Related Tools & ServicesView All

haveibeenpwned.com

Have i been pwned?

Check if you have an account that has been compromised in a data breach
SmarterASP.NET

SmarterASP.net - Unlimited ASP.NET Web Hosting

ASP.NET Hosting by SmarterASP.net. Unlimited ASP.NET Hosting Plans Starting at $2.95 a month.