Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is what I have:'s A record to my public IP. CNAME pointed to the same IP.

DefaultWebSite is bound to * IP addresses in IIS and has the default iisstart.htm page. in IIS) is bound to in IIS and has host binding with a modified default iisstart.htm page.

So far this works perfectly and points to the iisstart.htm for each public site.

The issue arises when I add a new site called intranet and set that site's default document to portal.aspx I have the "Intranet" site bound to with the hostname bound to "intranet".

After adding the intranet site, takes me to portal.aspx in the "intranet" site instead of the iisstart.htm in the wwwroot "Default Web Site."

I attempted to set "intranet" to DENY anonymous users and it does, however the issue with the default site being redirected is still there.

Is there a way to set this up so that intranet is accessibile from my LAN but not from the www? I know I can bind the site to another IP that isn't mapped externally and enter from that IP instead of the IP bound to my External static IP, but that seems rather hackey and kludgey.

I also have not configured DNS on the LAN side or set up AD as I expected to wipe the server and reset after I mapped out what the Server environment is going to be. I will need to do this at somepoint so that DNS has a host record for "internet". For the moment I'm doing it in the local HOSTS file.

share|improve this question
Open an elevated PowerShell, type: 'ls IIS:\sites' can you post the output here? – Peter Hahndorf Nov 19 '12 at 19:47
ls : Cannot find drive. A drive with the name 'IIS' does not exist. At line:1 char:1 + ls IIS:\sites + ~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (IIS:String) [Get-ChildItem], DriveNotFoundException + FullyQualifiedErrorId : DriveNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand – user1431356 Nov 19 '12 at 20:09
that is what you get when you run it non-elevated. Please use 'Run as administrator' when starting PowerShell. – Peter Hahndorf Nov 19 '12 at 20:17
No, that is from the elevated prompt. I swear :) – user1431356 Nov 19 '12 at 20:44
screenshot goodness – user1431356 Nov 19 '12 at 20:54
up vote 0 down vote accepted

I'm making the assumption you have multiple IP addresses in use on this particular box. The only way to restrict external traffic from accessing a site is to physically route that traffic differently. If you bindings look like this:

  1. *:80 -> Default
  2. -> Intranet

Then any request to your intranet site still technically matches the default site as well. If you are using a single IP address to handle all incoming traffic it should be a different IP address than any traffic you want to be accessed internally only, otherwise there is no way to prevent users outside of your firewall from getting to it.

I would set it up more like this:

  1. -> Default
  2. -> Intranet

And then on your router only allow port 80 traffic to route to the first IP, this eliminates any potential cross contamination all together. Its much cleaner and not a hack by any means, this is how most sites are setup.

share|improve this answer
I had considered that, but I was hoping that once I setup DNS on the server I could pickup the hostname "Intranet". I just don't know whether that will resolve traffic coming from outside going to the public website instead of the intranet site. – user1431356 Nov 19 '12 at 21:38
That feature is built-in, you want to use host headers. Just put in your name like intranet.myorg.local or whatever it is when you configure the bindings. – Brent Pabst Nov 19 '12 at 21:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.