Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking to block traffic from China and Korea based on the Okean block list.

I understand how to set up IP Address Restrictions in IIS7 from the User Interface.

However, I don't want to manually enter a large block list and doing so would make it difficult to keep the list up-to-date.

Is there a way to import the list and/or a text-based file in IIS7 that would allow IP Address restrictions?

Note, I'm using Amazon EC2, so if there's a way to do this using an Amazon EC2 Security Group, that would also be a solution. And yes, I recognize I could set up a local firewall but I would prefer to address this either via IIS or EC2.

If there is no standard way of approaching this, can somebody point me at an API that would allow me to load the list into IIS7?

share|improve this question
up vote 3 down vote accepted

Use Configuration Editor to view how the IP block list is structured in the applicationhost.config file (it might be easiest to enter one in the GUI, then look at the file to work out the section, then work backwards from there), then add one using Configuration Editor, and instead of hitting Apply, hit Generate Script.

This will show you three programmatic ways of adding an IP to the block list - Javascript, MWA and AppCMD. Pick whichever you're most comfortable with, then script it.

Details on Answer added by Rob below

The Configuration Editor is an icon that's available from the home page of the IIS Manager in the Management section.

The key is system.webServer/security/ipSecurity.

When you follow advice below and generate a C# script, it looks like this...

using System;
using System.Text;
using Microsoft.Web.Administration;

internal static class Sample {

  private static void Main() {

    using(ServerManager serverManager = new ServerManager()) { 
      Configuration config = serverManager.GetApplicationHostConfiguration();

      ConfigurationSection ipSecuritySection =

      ConfigurationElementCollection ipSecurityCollection =

      ConfigurationElement addElem = ipSecurityCollection.CreateElement("add");
      addElem["ipAddress"] = @"";
      addElem["subnetMask"] = @"";

      ConfigurationElement addElem1 = ipSecurityCollection.CreateElement("add");
      addElem1["ipAddress"] = @"";
      addElem1["subnetMask"] = @"";

share|improve this answer
Very nice, you schooled me :)... Marking your answer as correct and updating some details for the next poor soul. – Rob Aug 28 '11 at 17:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.