Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an IIS7 server that's hosted out outside (as in a completely different location) of our HQ. It was going to be used for a new project, but it subsequently fell through and now we have a server that's not being used. I've basically converted it to a storage provider for our Salesforce account because Appirio is just priced ridiculously.

I have IP address and domain restrictions set to block all except for the ones I select, like our offices. The problem is that we have field workers that use Salesforce outside of the offices like at their homes or via mobile devices. That's where the IP restrictions become a hindrance because they'll be blocked and won't be able to do what they need to do.

So, is there a way to restrict access to the server without IP restrictions? I can't do authentication through Windows or Salesforce. I was thinking about using a token in the URL string to validate the visitor because they'll only be accessing the server through Salesforce which I can control, to a degree, but I'm not sure. I also have an available SSL certificate which I could put into use, but I'm not sure what to couple it with?

share|improve this question
VPN (Virtual private network) is the solution. Nothing else. – mailq Oct 18 '11 at 9:01
I've corrected my question. When I said "out", I meant "outside" of our HQ. It's in a datacenter somewhere and is just an IIS server. So, the VPN that @mailq is suggesting still wouldn't work. – Gup3rSuR4c Oct 18 '11 at 21:45
VPN even works in data centers. I'll bet ya. – mailq Oct 18 '11 at 21:52
Well, no, what I meant was that our users that are accessing it from home or a mobile device won't be able to just like in the IP restrictions. I'm sure there's VPN capabilities on some tablets and phones, but our stuff is all over the place and half of it is in another state. I'm not going to hunt down every individual just to figure out how to put a VPN on their device, if it's even possible. – Gup3rSuR4c Oct 18 '11 at 21:54
Well, what's then? You can't use layer 5-7 restrictions, due to your used software. And you don't accept layer 3-4 restrictions because of the implications. And it is impossible to implement layer 1-2 restrictions as you have no influence on that. How many layers remain? I would say layer 8. – mailq Oct 18 '11 at 22:05

Yes, you just need to add the iis7 server role for Ip Restriction. You the need to delegate the feature to the required site in iis so the option appears at that level.

Then you can specify simple rules for ip restrictions. Once enabled you can also manage this setting directly from the web.confg file depending how iis is configured so you could even manage this setting from your own website scripting language.

share|improve this answer
Come on. Reading isn't that hard. Just in case it actually is hard for you, this is right in the question So, is there a way to restrict access to the server without IP restrictions? – MDMarra Oct 18 '11 at 21:39
Ok my bad for miss reading... iis7 does support client certificate Mapping for authentication. Basically clients hold Certs with private keys that match cert in iis to authenticate against.. – Marty Oct 20 '11 at 1:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.