0

I am managing a web application that uses forms authentication. Most of it (including the login functionality) was written by a 3rd party so I cannot change it's architecture. The web application uses forms authentication to require all users to log in before they can access anything.

The application has an admin section that end-users should not be able to see and they are kept out of via forms authentication. But it doesn't look good that they can see the a login option and the 3rd party's branding.

Therefore I want to restrict access to this section of the application (which is actually implemented as a separate IIS Site) to certain IP addresses. So I installed the IPv4 Address and Domain Restrictions module and have set up some trial IP restrictions. But these setting do not have any effect. Why is this? Am I trying to do something that is impossible? (due to integrated authentication?)

Improve this question

1 Answer 1

Reset to default
0

This is certainly possible and it sounds like you have installed the proper module. Its possible that you have not configured the module with the proper settings to DENY access first and then ALLOW your specific ranges of IPs.

It's also worth noting that depending on your firewall setup the firewall may mask the original IP address from the requester so you may not be able to actually setup IP restrictions on external IPs, rather only internal IPs which could get a bit hairy.

Improve this answer
4
  • I have certainly DENYed access first, and then added a spurious allow IP address to test - I expected to then be unable to access the site, but still can.
    – Annabel
    Aug 21, 2012 at 1:33
  • As to the firewall, it's running on an Amazon EC2 instance, so IP addresses may well be masked (there are issues there of servers having internal and external IP addresses). The only IP addresses I want to allow will be external IP addresses outside of the AWS security group.
    – Annabel
    Aug 21, 2012 at 1:37
  • I think I will next try to narrow down the issue by creating a small 'Hello World' app on the same server and see if IP Restrictions work with that.
    – Annabel
    Aug 21, 2012 at 1:41
  • You may also be able to use Amazon's firewall as well. Allow all traffic to a specific port type of thing.
    – Brent Pabst
    Aug 21, 2012 at 15:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .