Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a site set up in IIS, and I have a virtual directory that should only be available to localhost.

In IIS6, this was trivial to set up.

However, those property sheets are gone in IIS7 and I cannot find a corresponding setting. RequestFiltering and denyURLSequence isn't right, because that doesn't have an attribute for IP, at least, not that I could find.


share|improve this question
up vote 2 down vote accepted

You need IIS module called "IP and Domain Restrictions" (bundled with IIS) .. or grab improved version: Dynamic IP Restrictions.

Once installed configure to block all IPs except selected (should be no problems at all -- very easy GUI).

share|improve this answer

You can include the following code block inside your web.config file of the virtual directory to restrict access only to localhost.

            <ipSecurity allowUnlisted="false">
                <add ipAddress="" allowed="true" />

If you already have the system.webServer block, then you need to add only the security block.

share|improve this answer
You would still have to make sure that the IP and Domain Restrictions module is installed in IIS for that to work. – vcsjones Jul 26 '11 at 0:28
Thanks sparx. I tried this, but it seemed as if IIS wasn't picking up on the existence of the file. In fact, I had changed several things in applicationHosts.config as well and those changes weren't noticed, either. I have feature delegation turned on (I think), so no idea what was going on. – marc esher Jul 26 '11 at 11:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.