Normally I would add some addresses (client IP) with deny or allow status to IIS configuration to restrict access to web pages (so from IP A.A.A.A it would be possible to get to the web page, but from B.B.B.B not). However I have a setup with SSL as well, so user can enter
In the first case she/he will be redirected to https. However, when user explicitly enters the second form no matter what IP it is, she/he gets access all the time. I am surprised that settings for restricting access apply only to HTTP, not HTTPS. Anyway, the question is:
How can I restrict access to web pages (for HTTPS), or how I can make existing restriction for HTTP to work for HTTPS as well?
The solution is stupid-simple: it is required to change the default access to "deny" (however I don't understand how/why default=allow and allowing single user makes sense and can work). With default access set to deny it works as required, however oddly I (I am allowed to access the site) cannot use HTTP, only HTTPS.